The list of native executables in Windows that can download or run malicious code keeps growing as another one has been reported recently.
These are known as living-off-the-land binaries (LoLBins) and can help attackers bypass security controls to fetch malware without triggering a security alert on the system.
Works for download and exfil
The latest addition is finger.exe, a command that ships with Windows to retrieve information about users on remote computers running the Finger service or daemon. Communication is carried via the Name/Finger network communication protocol.
Security researcher John Page discovered that the Microsoft Windows TCPIP Finger command can also function as a file downloader and a makeshift command and control (C3) server that can serve for sending commands and exfiltrating data.
According to the researcher, the C2 commands can be masked as finger queries that fetch files and exfiltrate data, without Windows Defender detecting the anomalous activity.
One problem could be that port 79, used by the Finger protocol, is often blocked within an organization, the page says in a blog post on Friday.
However, an attacker with sufficient privileges can bypass the restriction by using Windows NetSh Portproxy, which acts as a port redirector for the TCP protocol.
This method would allow getting past firewall rules and communicate with servers over the unrestricted ports for HTTP(S). This way, Portproxy queries are delivered to the local machine IP and then forwarded to the specified C2 host.
Using finger.exe to download files also has limitations but nothing that can’t be overcome since encoding them with Base64 is enough to evade detection.
Demo scripts available
The researcher created proof-of-concept (PoC) scripts – DarkFinger.py for the C2 and the client-side DarkFinger-Agent.bat – and released them publicly to demonstrate how finger.exe’s double functionality.
In a video showing how the scripts work, Page compared his newly discovered method to certutil.exe, another LoLBin in Windows abused for malicious purposes.
Windows Defender stopped certutil activity and logged the event, while the DarkFinger script completed the action uninterrupted on a Windows 10 machine:
DEMO: Windows TCPIP Finger Command / C2 Channel and Bypassing Security Software Demo
Video Source from YouTube: https://www.youtube.com/watch?v=cfbwS6zH7ks
A report from Cisco Talos last year listed 13 LoLBins in Windows but security researchers found new executables that fit the bill.
One of the most recent is none other than the Windows Defender antivirus built into Windows, which can download arbitrary files using the -DownloadFile command-line argument, added either in version 4.18.2007.9 or 4.18.2009.9.
Another one is “desktopimgdownldr.exe,” an executable present in Windows 10’s system32 directory, which is part of the Personalization CSP for changing the lock screen and desktop background images.