Ash1996x

Classification basis

The code actively sends HTTP requests to the Azure Management API to create and delete routes, which constitutes exploitation of the vulnerability. The README and code comments explicitly label it as an 'exploit' and describe its purpose as creating malicious routes.

Requirements

• Valid Azure access token (via Azure CLI or environment variable) with permissions to manage network routes.exploit.py:313-345
• Target Azure subscription ID, resource group, VNet, and subnet names.exploit.py:660-672

Observed behavior

• Creates a route in a specified Azure subnet by sending a POST request to the Azure Management API with a crafted payload containing an address prefix and next hop IP.exploit.py:347-412
• Deletes a previously created route by sending a DELETE request to the Azure Management API.exploit.py:414-466
• Scans multiple targets concurrently to check if they are accessible and potentially vulnerable.exploit.py:204-280
• Implements evasion techniques such as payload withheld to avoid detection.exploit.py:103-135
• Supports persistence mode by creating a Windows scheduled task to re-run the exploit at intervals.exploit.py:183-202

Observables

Persistence Mechanism

Payload withheldThe PersistenceManager.create_scheduled_task method creates a scheduled task to re-run the exploit script in persistence mode. This is documented as a feature and is directly related to maintaining the exploit's route manipulation, not an unrelated backdoor.exploit.py:183-202

Evasion Technique

Payload withheldThe EvasionManager class implements random request delays and rotating user-agent strings to avoid detection during exploit operations. This is consistent with the stated purpose of the tool.exploit.py:103-135

Classification basis

The artifact contains functional code (standalone_lnk_weaponizer.ps1) that creates malicious LNK files designed to trigger NTLM authentication to an attacker-controlled server, which is an active exploitation technique for credential theft. The README describes the Aggressor script as weaponizing LNK and Library-MS files for hash disclosure, and the PowerShell script includes the complete implementation to generate the weaponized file. This is exploit code, not merely a scanner or writeup.

Requirements

• An active Cobalt Strike beacon on the target system (for the Aggressor script) or local PowerShell execution (for the standalone script).README.md:18-19standalone_lnk_weaponizer.ps1:1-4
• An attacker-controlled SMB server (e.g., Responder, Impacket) running to capture the NTLM hashes.README.md:10-12
• User interaction: the target user must open or interact with the generated LNK or Library-MS file.README.md:111-112README.md:117-118

Observed behavior

• Generates a malicious LNK shortcut file that points to a remote SMB path (\\<attacker_ip>\<share>\<file>).standalone_lnk_weaponizer.ps1:112-125
• Creates a Library-MS XML file with a UNC path reference to trigger SMB authentication (payload withheld bypass technique).README.md:114-118
• Forces Windows Explorer to fetch the PE icon from the remote SMB location, triggering NTLM authentication and hash disclosure.README.md:108-112
• Provides Cobalt Strike right-click menu integration and command-line commands (lnk_create, library_create, lnk_quick, library_quick) for remote deployment via beacon.README.md:47-84

Observables

Offensive Tool

Payload withheldThe artifact is a tool for creating malicious LNK and Library-MS files to capture NTLMv2 hashes via SMB authentication, consistent with its stated purpose.README.md:1-3standalone_lnk_weaponizer.ps1:1-4

Cve Reference

Payload withheldThe README references payload withheld as a bypass technique for Library-MS files, but the supplied CVE context is for CVE-2025-50154 (Windows File Explorer spoofing). This mismatch is noted but does not indicate backdoor behavior.README.md:3