SMB Share Poisoning

Placing an SCF lure in a writable SMB share can cause Windows systems that browse or enumerate its icon to request a remote resource and attempt outbound NTLM authentication. A reachable listener may capture a NetNTLM challenge-response, not the account's stored NT hash. The procedure can be operated from the Internet only when the SMB share is Internet-reachable and the operator has write access; client access to the lure and network egress to the listener are also required.