Using a SCF file to Gather Hashes Logo

Using a SCF file to Gather Hashes

0
Free
Visit Website

Have you ever been on an internal network assessment and discovered an unauthenticated writable Windows-based file share? In addition to finding potentially sensitive information, you can abuse this to gather user hashes from users who are browsing the file share. In this attack, a special file with a SCF file extension is placed onto the file share. SCF files can control Windows Explorer, but in this case, we use one to elicit an unsuspecting user to submit their NTLMv1/2 hash to us, the attacker.

FEATURES

ALTERNATIVES

ISF (Industrial Exploitation Framework) - An exploitation framework for industrial systems with various ICS protocol clients and exploit modules.

Charlotte is an undetected C++ shellcode launcher for executing shellcode with stealth.

Comprehensive tutorial on modern exploitation techniques with a focus on understanding exploitation from scratch.

A PowerShell toolkit for attacking Azure environments

SauronEye helps in identifying files containing sensitive data such as passwords through targeted directory searches.

A set of YARA rules for identifying files containing sensitive information

A tool for enumerating and attacking GitHub Actions pipelines

A subdomain enumeration tool for penetration testers and security researchers.