# Dismantling Smart App Control

LNK files with non-canonical target paths get rewritten by explorer.exe, stripping Mark-of-the-Web before SmartScreen/SAC checks, enabling silent code execution.

- Payout: Real-world hack
- Severity: high
- Program: Windows Smart App Control
- Credited: Joe Desimone
- Disclosed: 2024-08-06
- Write-up quality: 8/10
- Original: https://www.elastic.co/security-labs/threat-command/dismantling-smart-app-control
- Library page: https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-dismantling-smart-app-control
- Tags: domain:desktop impact:integrity impact:rce kind:incident platform:threat-intel sev:high tech:windows technique:chained technique:source-review vuln:access-control vuln:misconfiguration

**Target:** Windows explorer.exe LNK handling / SmartScreen & Smart App Control
**Root cause:** explorer.exe's _SaveAsLink() canonicalizes malformed LNK target paths and rewrites the file on disk, dropping the Zone.Identifier alternate data stream before CheckSmartScreen() runs.
**Steps:**
1. Craft an LNK whose target path is non-canonical, e.g. `powershell.exe.` (trailing dot/space) or relative `.	arget.exe`, or a multi-level path in a single target-path-array entry.
2. Deliver the LNK with Mark-of-the-Web (downloaded).
3. User clicks the LNK; explorer.exe resolves the real exe, rewrites the LNK canonically, removing MotW.
4. CheckSmartScreen() then runs on a file with no MotW, so no warning; target launches.
5. Chain with a signed/known-good host (e.g. cdb debugger) to run shellcode.
**How found:** Researchers targeted MotW bypasses since SmartScreen only scans MotW files and SAC blocks certain types with MotW; they stumbled on the fact that explorer.exe rewrites non-canonical LNKs, and traced _SaveAsLink() vs CheckSmartScreen() call stacks to confirm MotW removal precedes the security check.
**Exploitation:** Attacker delivers a crafted LNK (via download) that points to a legitimate binary like powershell.exe or cdb; on click explorer canonicalizes and rewrites the LNK, stripping MotW, so SmartScreen/SAC never warn and the payload executes with minimal user interaction.
**Escalation:** Chained LNK stomping with the Microsoft cdb debugger to achieve arbitrary shellcode execution, and combined with reputation hijacking of known-good script hosts (Lua/Node/AutoHotkey/JamPlus) for full in-memory code execution.
**Insight:** When a security check keys off a metadata stream (MotW/Zone.Identifier), look for any component that rewrites the file before the check runs; malformed-but-canonicalizable structures (trailing dots/spaces, relative paths, packed path arrays) trigger silent rewrites that drop the metadata.