.. / NTLM-stealing_creds-desktop
Star

The desktop.ini files contain the information of the icons you have applied to the folder. We can abuse this to resolve a network path. Once you open the folder you should get the hashes. Make sure you have Responder running on the attacker IP address.

Command Reference:

Attacker IP: 10.10.14.4
Command: Copy Extra code: Copy References:

https://book.hacktricks.xyz/windows-hardening/ntlm/places-to-steal-ntlm-creds#desktop.ini