5:21 AM
mitraaa
One of the easiest ways into a system is by using a USB flash drive that implements the
U3 standard. The U3 system is a secondary partition included with USB flash drives
made by SanDisk and Memorex, like those shown in Figure 9-8. The U3 partition is
stored on the device as read only, and it often contains free software for users to try or
download. The U3 partition menu is configured to automatically execute when the USB
stick is inserted into certain computers.
The U3 hack works by taking advantage of the autorun feature built into Windows.
When inserted into a computer, the USB flash drive is enumerated, and two separate
devices are mounted: the U3 partition and the regular flash storage device. The U3
partition immediately runs whatever program is configured in the autorun.ini file on the
partition. Each manufacturer provides a tool to replace the U3 partition with a custom
ISO file for branding, or deletion of the partition. The partition can be overwritten using
the manufacturer’s tool to include a malicious program that executes in the context of
the currently logged-on user. The most obvious attack is to read the password hashes
from the local Windows password file, or install a Trojan for remote access. The password
file can be e-mailed to the attacker or stored on the flash drive for offline cracking later
using tools like fgdump.
A USB flash drive–based tool like this can be built in a few easy steps. First, a custom
autorun script is created to launch a command script when the USB device is inserted
into the computer, as shown in the following example autorun.inf file:
[autorun]
open= go.cmd
icon=autorun.ico
Next, a script to run programs, install tools, or perform other actions is created, as in
the following example we’ll call go.cmd:
@echo off
if not exist \LOG\%computername% md \WIP\%computername% >nul
cd \WIP\CMD\ >nul
.\fgdump.exe
Once the script and utilities have been assembled, copy the files to the U3CUSTOM
folder provided by the U3 device manufacturer or use a tool like Universal_Customizer
(http://www.hak5.org/packages/files/Universal_Customizer.zip). The ISOCreate.cmd
included with Universal_Customizer can package up the autorun program, executables,
and scripts in the U3CUSTOM directory into an ISO to be written to the U3 device.
U3 standard. The U3 system is a secondary partition included with USB flash drives
made by SanDisk and Memorex, like those shown in Figure 9-8. The U3 partition is
stored on the device as read only, and it often contains free software for users to try or
download. The U3 partition menu is configured to automatically execute when the USB
stick is inserted into certain computers.
The U3 hack works by taking advantage of the autorun feature built into Windows.
When inserted into a computer, the USB flash drive is enumerated, and two separate
devices are mounted: the U3 partition and the regular flash storage device. The U3
partition immediately runs whatever program is configured in the autorun.ini file on the
partition. Each manufacturer provides a tool to replace the U3 partition with a custom
ISO file for branding, or deletion of the partition. The partition can be overwritten using
the manufacturer’s tool to include a malicious program that executes in the context of
the currently logged-on user. The most obvious attack is to read the password hashes
from the local Windows password file, or install a Trojan for remote access. The password
file can be e-mailed to the attacker or stored on the flash drive for offline cracking later
using tools like fgdump.
A USB flash drive–based tool like this can be built in a few easy steps. First, a custom
autorun script is created to launch a command script when the USB device is inserted
into the computer, as shown in the following example autorun.inf file:
[autorun]
open= go.cmd
icon=autorun.ico
Next, a script to run programs, install tools, or perform other actions is created, as in
the following example we’ll call go.cmd:
@echo off
if not exist \LOG\%computername% md \WIP\%computername% >nul
cd \WIP\CMD\ >nul
.\fgdump.exe
Once the script and utilities have been assembled, copy the files to the U3CUSTOM
folder provided by the U3 device manufacturer or use a tool like Universal_Customizer
(http://www.hak5.org/packages/files/Universal_Customizer.zip). The ISOCreate.cmd
included with Universal_Customizer can package up the autorun program, executables,
and scripts in the U3CUSTOM directory into an ISO to be written to the U3 device.
0 comments:
Post a Comment