├── Internet Explorer.txt └── README.md /Internet Explorer.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/defcon-russia/shortcut_auto_bind/9e03182b2746f1c392bb578d0a9032802cd0ef98/Internet Explorer.txt -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # shortcut_auto_bind 2 | Windows LNK/URL shortcut auto-binding hotkey (not a bug, feature) 3 | 4 | This is a small note about one MS Windows feature, that could be not known to everyone. At least I did not know about it before I did this small research. 5 | 6 | Explorer on startup will parse all URL/LNK files (PIF... if you are old) and get hot-key value. Then it will be registered with a hook. 7 | 8 | ![Shortcut](https://defcon-russia.ru/images/hotkey.png) 9 | 10 | Of course, you can add raw value of hot-key code, so it can bypass windows limitation ("CTRL+ALT+..." only), and with this simple trick you can register, for example, DEL key or ESC.. or almost anything. 11 | 12 | This is a feature, of course, not a bug, but it can be abused by malware guys (as autorun by trigger)... so good thing to know. 13 | 14 | LNK: 15 | ![Edit lnk](https://defcon-russia.ru/images/lnk_2e.png) 16 | 17 | URL: 18 | ![Shortcut](https://defcon-russia.ru/images/url_46.png) 19 | 20 | Explorer.exe on stratup... 21 | ![Explorer](https://defcon-russia.ru/images/explorer.png) 22 | 23 | Path from where explorer.exe will search for shortcuts 24 | 25 | * %AppData%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar . 26 | * %AppData%\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts 27 | * %AppData%\Microsoft\Windows\Start Menu 28 | * %UserProfile%\Desktop 29 | 30 | PoC: 31 | 32 | Copy "Internet Explorer.lnk" to the Desktop, restart PC (or just restart explore.exe), press DEL. 33 | --------------------------------------------------------------------------------