Check Upload to SMB/FTP

Drop the malicious file in a writable share to coerce NTLM auth.

Test writable SMB/FTP shares and plant NTLM-theft payloads (e.g. malicious .lnk) that fire when browsed. A hit captures a NetNTLMv2 hash from any user who opens the directory.