Windows 10 Finger command can be used to steal files

The latest addition is finger.exe, a command that ships with Windows retrieve information about users on remote computers running the Finger service or daemon. Communication is carried via the Name/Finger network communication protocol.

Security researcher John Page discovered that the Microsoft Windows TCPIP Finger command can also function as a file downloader and a makeshift command and control (C3) server that can serve for sending commands and exfiltrating data.

According to the researcher, the C2 commands can be masked as finger queries that fetch files and exfiltrate data, without Windows Defender detecting the anomalous activity.

One problem could be that port 79, used by the Finger protocol, is often blocked within an organization, the page says in a blog post on Friday.

However, an attacker with sufficient privileges can bypass the restriction by using Windows NetSh Portproxy, which acts as a port redirector for the TCP protocol.

This method would allow getting past firewall rules and communicate with servers over the unrestricted ports for HTTP(S). This way, Portproxy queries are delivered to the local machine IP and then forwarded to the specified C2 host.

A report from Cisco Talos last year listed 13 LoLBins in Windows but security researchers found new executables that fit the bill.

One of the most recent reported on is none other than the Windows Defender antivirus built into Windows, which can download arbitrary files using the -DownloadFile command-line argument, added either in version 4.18.2007.9 or 4.18.2009.9.

Another one is “desktopimgdownldr.exe,” an executable present in Windows 10’s system32 directory, which is part of the Personalization CSP for changing the lock screen and desktop background images.

Previously, we reported that Microsoft Teams could also help an attacker retrieve and execute malware from a remote location.

VortexShield takes security seriously and we always try to stay on top of the latest exploits and vulnerabilities to better serve our customers.