Windows 10 ‘Finger’ command can be abused to download or steal files

guest · Sep 19, 2020

Windows 10 ‘Finger’ command can be abused to download or steal files
September 15, 2020
https://www.bleepingcomputer.com/ne...and-can-be-abused-to-download-or-steal-files/

The list of native executables in Windows that can download or run malicious code keeps growing as another one has been reported recently.

These are known as living-off-the-land binaries (LoLBins) and can help attackers bypass security controls to fetch malware without triggering a security alert on the system.
Works for download and exfil
The latest addition is finger.exe, a command that ships with Windows to retrieve information about users on remote computers running the Finger service or daemon.

Security researcher John Page discovered that the Microsoft Windows TCPIP Finger command can also function as a file downloader and a makeshift command and control (C3) server that can serve for sending commands and exfiltrating data.
Click to expand...

Demo scripts available
The researcher created proof-of-concept (PoC) scripts - DarkFinger.py for the C2 and the client-side DarkFinger-Agent.bat - and released them publicly to demonstrate how finger.exe’s double functionality.
Windows Defender stopped certutil activity and logged the event, while the DarkFinger script completed the action uninterrupted on a Windows 10 machine: [...]
Click to expand...

Log in or Sign up

Windows 10 ‘Finger’ command can be abused to download or steal files

guest Guest

Log in or Sign up

Windows 10 ‘Finger’ command can be abused to download or steal files

guest Guest

Useful Searches