Microsoft Windows LNK File UI Misrepresentation Remote Code Execution Vulnerability

This repository is a proof-of-concept (PoC) tool for CVE-2025-9491, a Windows UI misrepresentation vulnerability affecting .lnk (shortcut) files. The repository contains three files: a detailed README.md, the main exploit script (main.py), and a requirements.txt specifying the pylnk3 library. The main.py script is a Python tool that allows users to create new .lnk files with obfuscated (whitespace-padded) arguments, obfuscate existing .lnk files, or parse and display the contents of .lnk files. The exploit leverages the fixed-size 'Target' field in Windows shortcut properties, using whitespace padding to hide malicious command-line arguments from users inspecting the shortcut. The tool supports various padding patterns and custom character sets for obfuscation. The primary attack vector is local: the attacker must convince a user to open or inspect a malicious .lnk file, which can then execute hidden commands. The tool does not provide a remote shell or network-based payload, but enables stealthy local execution of arbitrary commands via shortcut files. The repository is well-documented and structured, with the main exploit logic contained in main.py.