Windows 10 ‘Finger’ command can be abused to download or steal files

Posted by & filed under Security Alerts.

The list of native executables in Windows that can download or run malicious code keeps growing as another one has been reported recently.

These are known as living-off-the-land binaries (LoLBins) and can help attackers bypass security controls to fetch malware without triggering a security alert on the system.

Works for download and exfil

The latest addition is finger.exe, a command that ships with Windows to retrieve information about users on remote computers running the Finger service or daemon. Communication is carried via the Name/Finger network communication protocol.

Security researcher John Page discovered that the Microsoft Windows TCPIP Finger command can also function as a file downloader and a makeshift command and control (C3) server that can serve for sending commands and exfiltrating data.

According to the researcher, the C2 commands can be masked as finger queries that fetch files and exfiltrate data, without Windows Defender detecting the anomalous activity.

One problem could be that port 79, used by the Finger protocol, is often blocked within an organization, the page says in a blog post on Friday.

However, an attacker with sufficient privileges can bypass the restriction by using Windows NetSh Portproxy, which acts as a port redirector for the TCP protocol.

This method would allow getting past firewall rules and communicate with servers over the unrestricted ports for HTTP(S). This way, Portproxy queries are delivered to the local machine IP and then forwarded to the specified C2 host.

Using finger.exe to download files also has limitations but nothing that can’t be overcome since encoding them with Base64 is enough to evade detection.

Demo scripts available

The researcher created proof-of-concept (PoC) scripts – DarkFinger.py for the C2 and the client-side DarkFinger-Agent.bat – and released them publicly to demonstrate how finger.exe’s double functionality.

In a video showing how the scripts work, Page compared his newly discovered method to certutil.exe, another LoLBin in Windows abused for malicious purposes.

Windows Defender stopped certutil activity and logged the event, while the DarkFinger script completed the action uninterrupted on a Windows 10 machine:

 

DEMO: Windows TCPIP Finger Command / C2 Channel and Bypassing Security Software Demo

Video Source from YouTube:  https://www.youtube.com/watch?v=cfbwS6zH7ks 

 

report from Cisco Talos last year listed 13 LoLBins in Windows but security researchers found new executables that fit the bill.

One of the most recent is none other than the Windows Defender antivirus built into Windows, which can download arbitrary files using the -DownloadFile command-line argument, added either in version 4.18.2007.9 or 4.18.2009.9.

Another one is “desktopimgdownldr.exe,” an executable present in Windows 10’s system32 directory, which is part of the Personalization CSP for changing the lock screen and desktop background images.

 

The information contained in this website is for general information purposes only. The information is gathered from BLEEPING COMPUTER, while we endeavour to keep the information up to date and correct, we make no representations or warranties of any kind, express or implied, about the completeness, accuracy, reliability, suitability or availability with respect to the website or the information, products, services, or related graphics contained on the website for any purpose. Any reliance you place on such information is therefore strictly at your own risk.  Through this website, you are able to link to other websites which are not under the control of CSIRT-CY. We have no control over the nature, content and availability of those sites. The inclusion of any links does not necessarily imply a recommendation or endorse the views expressed within them. Every effort is made to keep the website up and running smoothly. However, CSIRT-CY takes no responsibility for, and will not be liable for, the website being temporarily unavailable due to technical issues beyond our control.