CVE-2026-32202

The provided code is a functional Python script that generates a malicious .lnk file exploiting CVE-2026-32202. This vulnerability allows an attacker to capture NTLMv2 hashes by crafting a shortcut file with a UNC path pointing to an attacker-controlled SMB server, triggering authentication when the folder is viewed.

This PoC generates a malicious .lnk file that exploits CVE-2026-32202, a zero-click forced authentication vulnerability in Windows Explorer. The crafted .lnk file triggers an SMB connection to an attacker-controlled UNC path during icon rendering, leaking Net-NTLMv2 credentials without user interaction.

This PoC generates a malicious .lnk file that exploits CVE-2026-32202, a zero-click forced authentication vulnerability in Windows Explorer. The crafted .lnk file triggers an outbound SMB connection to an attacker-controlled UNC path during icon rendering, leaking Net-NTLMv2 credentials without user interaction.

This PoC generates a malicious .lnk file that exploits a zero-click forced authentication vulnerability in Windows Explorer. When the .lnk file's icon is rendered, it triggers an SMB connection to an attacker-controlled UNC path, leaking Net-NTLMv2 credentials due to incomplete trust verification in `CControlPanelFolder::GetUIObjectOf`.

This repository contains a functional exploit PoC for CVE-2026-32202, which leverages a crafted .lnk file to trigger a zero-click forced authentication attack. The exploit abuses the Control Panel folder's icon rendering mechanism to coerce a victim into an outbound SMB connection, leaking Net-NTLMv2 credentials.

This repository contains a functional exploit PoC for CVE-2026-32202, which leverages a .lnk file to trigger an outbound SMB connection to an attacker-controlled server, leaking the victim's Net-NTLMv2 hash. The exploit constructs a malicious .lnk file with a crafted IDList that includes a UNC path to a .cpl file, causing Windows Explorer to attempt to resolve the icon and initiate the SMB connection.

This repository contains a functional Python script that generates a malicious LNK file exploiting CVE-2026-32202. The exploit leverages a crafted _IDCONTROLW structure to trigger an outbound SMB connection when the LNK file is processed by Windows Explorer.

The repository claims to exploit CVE-2026-32202 via crafted LNK files for NTLMv2 hash coercion but lacks actual exploit code, instead redirecting to an external download link (tinyurl.com). The README is detailed but serves as a lure rather than providing functional PoC code.