Idea
attack clients, e.g. browser, office to obtain foothold into the network
precondition: knowledge about client under attack
which os?
which applications?
11.1 Target Reconnaissance
11.1.1. Information Gathering
metadata tags of publicly-available documents: exiftool
11.1.2 Client-Fingerprinting
Trigger client to click link, which then fingerprints its os, browser etc
JavaScript fingerprinting, e.g. fingerprint.js
canarytokens.org
11.2. Exploiting Microsoft Office
most often malicious office macros are used to infect a workstation
the user must:
open the file
click “enable editing”
explicitly enable marcos for document
*.docx does not store macros, must user
*.doc stores macros
11.3. Abusing Windows Library Files
Windows library files (*.Library-ms)
allow to include remote storage into local file explorer
on double click: open explorer and shows the content of the remote folder (just like default folders)
Attack
share library file with victim (e.g. email), if the victim clicks the file it seems that only local files are presented
library file points to attacker controlled directory, which contains a script which triggers a reverse shell (user must click on *.Ink file)
Last changeda year ago