Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 0 down vote favorite

I was reading how exploits usually work and how they have been used in the past etc etc.

I wanted to know, if there are still some exploits that can work with minimal user allowed access?

For example, earlier an autorun could work in a USB. If the autorun started and the user just clicked on Yes for once on the autorun (the first prompt that comes because of the autorun), I could possibly run ANY script I wanted on the USB.

But now, this is not possible since from Vista onwards I believe, I cannot configure the autorun in an USB. This feature has been disabled. (PLEASE FEEL FREE TO POINT OUT IF THIS CAN STILL WORK).

I can still think of a lot of things I can do to a linux box and exploit it. However, I wanted to know are there any such exploits for Windows?

Another example, I can write a python script that traverses through each file until a particular file is found and then emails me the content of it. All of these being completely automated. And as you would have easily guessed, the problem here is making the user run .exe. I cannot disguise the running of exe (IF SOMEONE KNOWS THIS, I WOULD WANT TO KNOW HOW!) hence, I believe is not an exploit that would work.

So I hope, this clears up what I mean by a potential exploit. Something that could use some user intervention like clicking a button or something (but not something like running an exe because nobody is that stupid). So yeah,

Are any of the following scenarios possible?

  1. Is there a way I can connect to a windows machine and get access (the other machine being on same local network)?

  2. I can fool the user to run a script on his machine? (Something like the USB example I thought of, but I later realized that it wouldnt work for Vista onwards).

P.S: This is just out of plain curiosity/eagerness to learn new things and not for any bad thing or something.

Feel free if I am missed a tag or something.

share|improve this question
2  
This is a quite an open ended question and possibly may be closed. But to answer you question, scenario 1: yes it is possible, provided there are some vulnerable services that are running on the box. Highly unlikely that you can attack a Vanilla installation of Windows. Q2. If this is possible, you might as well make the user run a malicious exe. Why a script? – asudhak Oct 3 '12 at 14:43
Hi Sylar - welcome to Security SE. There are actually many ways to exploit windows (go have a look at cvedetails.com/microsoft-bulletins.php for examples), but your question isn't structured in a way that is usefully answerable here. – Rory Alsop♦ Oct 3 '12 at 15:15
In addition to the "not a real question" annotation and previous comments: This question is also time-localized. What may be a workable exploit now, might not be workable next month (or even next week, after Patch Tuesday). These are not a good fit for the StackExchange format. – Iszi Oct 3 '12 at 15:16
1  
By the way, parentheses are sub-notes to redirect understanding. All capital letters within a string (usually something resorted to after alternate typefaces, bold, italics, etc.) is a critical warning. Your use of both at the same time is offensive to my eyes. You should adapt your writing to exclude the use of either of those as much as possible. – Jeff Ferland♦ Oct 3 '12 at 16:11
@asudhak : I meant the script/exe running without the user knowing that he ran it. Like in the USB scenario I described, where the user is clicking on a button from Autorun not realizing it is triggering the running of an exe. - JeffFerland: I am sorry. I didn't realize that. I apologize for it. – user13701 Oct 3 '12 at 19:40

closed as not a real question by Iszi, Terry Chia, Polynomial, Rory Alsop♦ Oct 3 '12 at 15:13

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, see the FAQ.

1 Answer

up vote 1 down vote

A maintained operating system is a system for which the vendor emits fixes ("updates") for discovered security holes. Windows XP and later versions are still maintained. So it can safely be said that any vulnerability which is:

  1. widely known (e.g. published in a forum as an answer to a question such as yours);
  2. fixable from the operating system itself;

has been fixed (or will be in the next few days) and up-to-date systems are not vulnerable to it. Of course, systems for which automatic updates have been deactivated can be vulnerable.

This highlights the importance of a so-called Zero-Day vulnerability: that's a vulnerability which is known to the attacker but not to many people otherwise. Since it does not fulfill property #1, it is probably unpatched yet.

Similarly, some things cannot be fixed from the OS. For instance, physical access. If the attacker can put his corporeal hands on the computer, then the computer is mostly doomed and the OS cannot do much against it. He can, in particular, temporarily remove the hard disk, manipulate its contents to alter, for instance, the OS kernel (that's the way to make an "invisible exe": just modify the code which reports what processes are running), and then put the disk back in the machine. More advanced techniques include infecting the BIOS or even the keyboard firmware.

An inherently unfixable security issue is the human user. If the user can be convinced to run an arbitrary executable application, e.g. "cunningly" disguised as an innocent-looking PDF file attached to an email (but, in reality, the file is called report.pdf.exe), then there is no security anymore. User education is of paramount importance.

share|improve this answer