Point, Click, Root.

← Back to Stories (view on slashdot.org)

Posted by CmdrTaco on Thursday August 12, 2004 @05:36AM from the thats-just-plain-scary dept.

An anonymous reader writes "The Metasploit Project just released version 2.2 of the Metasploit Framework. This release includes a VNC server payload that can be used with almost any of the Windows exploits. The scary thing about this payload is that the VNC server executes as a new thread in the exploited process; without writing any files to the disk drive. Is this the end as we know it for simple remote command shell exploits? A couple articles have already mentioned this project."

11 of 216 comments (clear)

Min score:

Reason:

Sort:

Works when the machine is locked too by Anonymous Coward · 2004-08-12 05:40 · Score: 5, Interesting

The cool thing about the VNC payload is that it works if the machine is not logged in, or if the screen is locked.
1. Re:Works when the machine is locked too by nine-times · 2004-08-12 05:51 · Score: 3, Interesting
  
  Parent has a good point, how often do you leave your servers logged in?
  On the other hand, hackers can VNC in and watch what you do without you knowing they're connected. Or while you're trying to type your password to log in, they could just keep typing a letter or two, thereby keeping you from logging in.
2. Re:Works when the machine is locked too by Ytsejam-03 · 2004-08-12 06:44 · Score: 5, Interesting
  
  The cool thing about the VNC payload is that it works if the machine is not logged in, or if the screen is locked.
  So does anything else that exploits a service running as LocalSystem. As long as the service is running, it does not matter the workstation is locked or not logged in.
  
  I assume you're saying this because you saw the screen shot linked in the summary. Notice that it says "System" at the top of the start menu. This is not the user's desktop, and you won't get to see the user's running apps. You'll have to exploit something running in the user's session to do that.
  
  This won't let you do anything that you could not already have done by installing, say, netcat with the same exploit.
Umm... by Trolling4Dollars · 2004-08-12 05:42 · Score: 5, Interesting

How does something start off as a "portable network game" and end up as a f*cking remote GUI root?

--
Un-news
1. Re:Umm... by Otter · 2004-08-12 05:50 · Score: 5, Interesting
  
  How does something start off as a "portable network game" and end up as a f*cking remote GUI root?
  I suppose, the same way Goldeneye started as a game and ended up as the boot disk for Xbox Linux...
  
  --
  What I'm listening to now on Pandora...
What a cool tool by ikeleib · 2004-08-12 05:50 · Score: 4, Interesting

For all the whining about how this makes it so easy for script kiddies, consider that it also makes it so easy for admins who are not in tune with the latest script kiddy 'sploits. This allows them to quickly test their networks in click-n-drool fashion. This can be a very useful tool.
Re:Nothing that... by Maestro4k · 2004-08-12 05:52 · Score: 3, Interesting
- What a sad day when even taking over someone's machine can be done point-and-click style. Seemed so much more personal when you just had a remote shell.
Those days have been gone for a while, script kiddies routinely point n' click to take over machines. They might have to *gasp* type something in an IRC channel to control their zombies but it's all highly idiot-proof. (Which is good I suppose since most script kiddies seem to be idiots.)
Re:Why? by aborchers · 2004-08-12 05:58 · Score: 3, Interesting

So, what you're saying is that the tool is only useful if it allows you to do something malicous with the machine? I guess we know which side of the computer security fence you're on. ;-)

--
Trouble making decisions? Just flip for it.
Just like in the movies by Animats · 2004-08-12 06:02 · Score: 4, Interesting

Now, at long last, hacking tools have caught up with the movie versions. Point and click at last. The attack even shows up on the attacked PC on screen! With windows opening and mouse movement, even. Watch for this tool showing up in a movie within a year.
Incidentally, note that this isn't a hole in VNC. It's an attack that installs VNC. VNC doesn't have to be present on the target before the attack.
Re:Why? by Wizzo1138 · 2004-08-12 06:07 · Score: 3, Interesting

I would hope that any self-respecting cracker would scoff at using this. So I wonder if it wasn't some self-respecting cracker who came up with this, just to give the script kiddies something to play with. While they keep the admins concerned about VNC hacks, the real crackers can get their work done under the radar, using the good ol' command line.

Or maybe it's time to find my tin-foil hat...

--
Always go to other people's funerals, otherwise they won't come to yours.
Re:Why? by stratjakt · 2004-08-12 06:12 · Score: 4, Interesting

No, it's quite simple.

The easier it is for any 13 year old asshat to exploit these vulnerabilities, the more the value of self-titled "security experts" goes up. Then they can jack small businesses for a 5 grand "consulting fee" to recommend they install a firewall.

They're creating a problem in the hopes they'll be paid to solve it, in short.

Kind of like a windshield salesman going around daring /encouraging neighbourhood kids to throw rocks at passing cars.

--
I don't need no instructions to know how to rock!!!!