This File Steals Passwords
Source: YouTube · John Hammond · published Apr 24, 2024 · 19:09
The video demonstrates how Windows SCF (Shell Command Files) can be weaponized for credential theft through NTLM hash capture 0:00.
Key Takeaways:
• SCF files can hide their file extension regardless of Windows settings, making them perfect for disguising as system icons like the recycle bin 1:15
• By configuring SCF files to point to remote SMB servers, attackers can capture NTLM hashes when Windows attempts to load the file's icon 4:01
• The technique works as a zero-click attack - credentials are stolen simply by viewing a folder containing the malicious SCF file or displaying it on the desktop 10:55
• While not a new technique, it can be combined with social engineering and browser vulnerabilities (like older Chrome versions' drag-and-drop flaw) to distribute malicious SCF files 12:20
This method highlights how seemingly innocent Windows features can be exploited for credential harvesting and potential lateral movement in networks 18:13.
Sources:
- 0:00 Introduction to SCF files and their potential for disguise
- 1:15 SCF files hide file extensions regardless of settings
- 4:01 Using SCF files to point to remote resources for credential theft
- 10:55 Zero-click attack through folder access or desktop display
- 12:20 Chrome vulnerability and drag-and-drop attack vector
- 18:13 Summary of SCF file capabilities for credential thef
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
do you notice anything different about My Windows desktop anything odd it might be hard to spot in fact I'd go so far to say is that it's practically impossible to spot with just your eyes alone also hi I'm back in a hotel room again lot of travel these days but here's the kicker the recycle bin on my desktop is not the real recycle bin in fact if I take a look at the properties this is a sccf file or a file explorer command file that can do some interesting things if I were to open this up in notepad say I fire that up and then I try to browse just open up on my desktop of all places setting this to all files so I can get the file extension. SCF let me open up my recycle bin so to speak and this is it it's just simple plain text and that is the structure for a SCF or shell command file an…