-1

A penetration test was allegedly done through the following method. The tester sent a user a a hyperlink that:

Silently installed a piece of software/code/etc through the browser with 0 user interaction. Shelled the app silently through 0 user interaction. Return a screen shot of the users entire desktop out through port 80 to the tester.

I'm having a hard time believing that 0 user interaction was involved in all this. I could understand an exploit to get the code onto the system, but not actually invoke the software. I could also see the user being tricked into allowing extensions/plugins/whatever, but not a completely silent deploy.

Has anyone experienced this kind of test? or heard of an exploit that allows this?

EDIT:

It was an Email sent through lotus notes. The user clicked the link. End of user actions.

2
  • Through what route was the link sent? That's the important info. Email readers can process links, and that requires no interaction. Or, the tester had control over the endpoint and activated the link. We need more info.
    – schroeder
    Commented Dec 4, 2014 at 18:00
  • To clarify, by 0 user interaction, do you mean they never opened the email, they opened the email but never clicked the link, or that they opened the email, clicked the link, but never agreed to install/run anything that popped up? Commented Dec 4, 2014 at 18:14

3 Answers 3

2

A browser that is functioning correctly would not allow for this to happen. But vulnerabilities have existed that make visiting the page to be the only interaction needed to launch malicious software. I believe CVE-2014-1776 is a recent example of such.

Here is a more detailed analysis. The summary at the beginning of the article gives an overview:

  1. The HTML page loads a Flash SWF file.
  2. The Flash SWF ActionScript performs a heap spray. A Flash Sound object is referenced here.
  3. Control is transferred to a JavaScript function in the HTML page.
  4. The JavaScript function sprays the heap, exploiting the use-after-free vulnerability in IE.
  5. A time-triggered ActionScript function in the SWF file will be invoked, gaining compete access to process memory.
  6. The ActionScript function traverses the Import Address Table for the modules kernel32.dll and ntdll.dll, storing the address of SetThreadContext and ZwProtectVirualMemory.
  7. The ActionScript function overwrites the virtual function table (vftable) pointer of the Sound object, pivots the stack with a number of return-oriented programming (ROP) gadgets, and executes the shellcode.
5
  • But the OP said "0 interaction", which would seem to mean that the user did not click the link (therefore no browser vuln).
    – schroeder
    Commented Dec 4, 2014 at 18:07
  • 1
    I took that to mean 'no clicking on approval to install/run/ect.' Obviously there was some user interaction; the user had to somehow access the email. What ever software they used to access the email could have had its own vulnerability. If the claim is "I sent him an email to his gmail account that hacked his computer without ever logging into gmail (and with no account syncing)", then I would find that claim much harder to believe. Commented Dec 4, 2014 at 18:12
  • Correct, The user clicked 1 link. Commented Dec 4, 2014 at 18:18
  • @JoeSwindell Then here is a great answer. Clicking links IS enough to be pwned.
    – schroeder
    Commented Dec 4, 2014 at 18:20
  • 2
    @schroeder agreed. Click here... Commented Dec 4, 2014 at 18:23
1

Has anyone experienced this kind of test? or heard of an exploit that allows this?

This is totally possible.

A clever attacker can set up a site so that if you click on it even once, within seconds he can take over your computer. Even worse, you might not have to go to his site. If you click a link that leads to his site, he could feasibly "own" your computer.

Whenever you visit a Web page, lots of invisible activity can happen on your computer. For example, if the Web site welcomes you with your own name, that's because last time you visited, it put a special text file called a cookie on your computer. If a stock ticker scrolls past or sports scores update automatically, the site could be executing a script on your computer. This stuff is normal. But the fact that your computer is willing to receive and execute instructions from a Web site is what hackers exploit.

Not all Web-based attacks are visible to the intended victim. Sophisticated hackers use tricks to hide what they're doing. But such sophisticated attacks are rare.

Example:

https://www.youtube.com/watch?v=c8cQ0yU89sk

3
  • 2
    I'm not clicking that! Commented Dec 4, 2014 at 18:57
  • haahahah too good!
    – Desthro
    Commented Dec 4, 2014 at 19:44
  • @DavidHoude Too fair =)
    – Lucas NN
    Commented Dec 4, 2014 at 19:53
0

Downloading and executing software by just visiting a site with no user-interaction is usually called a drive-by download. Common exploits are through the notorious buggy Java or Flash plugins or through browser bugs like MS14-064. There don't even need to be the malware installed on the computer, instead a RAT (Remote Access Toolkit) can be fully run from inside the exploited browser.

So these kind of attacks are unfortunately possible and they are in active use. They will be usually spread by links in (phishing) mails, hacked web sites (often through bugs in CMS like wordpress or plugins with backdoors) or malvertising.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .