WHOIS Calling the 80s to Get Their Finger Back
summary
Demonstrates a working RAT proof-of-concept that never opens sockets itself but abuses OS TCP utilities to get a reverse shell and exfiltrate data: whois over TCP port 43 and finger on port 79 are used with bash one-liners and nested loops to send commands and read replies. Demos use a netcat server, Windows finger (ships since XP), and a VBA downloader with ~10% VirusTotal detection; limitations include the protocol closing sockets per response and many spawned processes. Detection: block outbound ports, log command lines, and watch abnormal WHOIS/FINGER traffic.
AI-written summary · about
chapters (7)
- 0:00Introduction
- 8:05Demo
- 11:27Finger
- 14:41Windows Version
- 15:33Macros
- 16:30How to mitigate
- 18:19Questions
related talks
18mSchrödinger’s RAT: Profiling Stakeholders in the Remote Access Trojan Ecosystem
54mWhere did you find that?
42mWho Let the Dogs Out? When PUPs Become BlackCat's Best Friend
47mDetecting and analyzing files-less malware
01h 06mComputrace Backdoor Revisited
01h 06mHow hacking works
39mHow to think like a hacker
21mWHOIS Your Daddy: Tracking Iranian-backed Cyber Operations...