0

Is it possible to compose an attack vector in such a way that a remote victim will not be required initially to interact with an attacker? That is, if OS is vulnerable then you'll execute the vulnerability successfully without victim perception.

So far in the blogs, articles that I've read, they usually suggest that you create a bait (PDF, Flash Player, etc) then abet the victim to trigger it, but the real life scenario may not work like that.

Enticing someone to click a link or to download a crafted vulnerable file may sound suspicious and shrewd end - user may immediately stop interacting. Aside from all that you will use your credibility.

2
1

To do this, you need to attack the services running on a remote machine. There are numerous Metasploit modules that do this, and a nice, curated list can be found on Exploit-DB. The term you are looking for is a "remote exploit".

7
  • I was wondering how those services on remote machine are exposed without any preliminary or intermediate validity checks for data execution, but after those answers, it renders to be that this whole scenario is all true. I don't have enough reputation to accept the answer. Oct 24 '17 at 12:46
  • 1
    Here's a simple scenario: an FTP server has a weakness in the login screen. If you enter a really long username, it starts to run into the FTP services memory execution space, which would normally result in the service crashing. But, if crafted carefully, you can use code in the username field, which then gets executed by the FTP program because it thinks it is just its own code. Boom. You own the machine.
    – schroeder
    Oct 24 '17 at 14:30
  • There is no reason for the FTP program to distrust its own code in memory. The weakness was in how the username field was created by the developer (known as a buffer overflow). Because proper coding relies on humans, these types of weaknesses occur.
    – schroeder
    Oct 24 '17 at 14:31
  • sorry I forget to acccept the answer but I'll, since the answer to question is correct. Before that, can you elaborate a bit further the possibility of having very solid example of real "remote" exploit, normally community even call the LAN exploit as remote but IMHO it depends on which point of view you are evaluating it, the person next to you is remote and the person at the other corner of world is remote also. So the remote definition is very slack, as you know very well nowadays OS are more sensitive to data privacy and performing many input validations. Jan 12 '18 at 13:42
  • WRT to that do you still believe that there is still real remote vulnerability in the wild? Jan 12 '18 at 13:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.