Vipersec | Malicious Symbolic Links: Part 1 The Concept

Malicious Symbolic Links: Part 1 The Concept

6th Oct 2015

While symbolic links are very useful for everyday work, they can also be misused by distributing malware. Of course, to exploit this, the victim has to download a malicious symbolic link via social engineering and execute it.

This can be achieved because the symbolic links can call the command line (cmd.exe) without any limitation to the parameters that will be provided.

Figure 1 - The execution process of the symbolic link

As illustrated in figure 1, in the first stage the symbolic link calls the windows command line and copies itself as a batch file to the temporary directory (this directory is used for storing temporary files and the user always has write permissions).

The batch file gets executed with no problem and generates the vbs (visual basic scripting) malware downloader which finally delivers the malware to the compromised computer.

But lets take a closer look in the malicious symbolic link first.

Figure 2.1 - The properties of the symbolic link

Figure 2.2 - The properties of the symbolic link

As shown in figure 2.1, in order to copy itself and execute the new batch file (poc.bat) the symbolic link's target is the windows command line:

			  
%windir%\system32\cmd.exe /c copy note.txt.lnk %tmp%\poc.bat & start %tmp%\poc.bat & exit

The "Start in" field needs to be clear so the command line will always start in the path where the symbolic link gets executed (figure 2.2), otherwise the file copy will fail.

Figure 3 - Symbolic link opened with notepad++

If anyone opens the malicious symbolic link (note.txt.lnk) with notepad++ he would see what is illustrated in figure 3. The original symbolic link that was generated by windows is in the first two lines, after that follows the batch code for the generation of the vbs downloader. I have also added a fake error message to the downloader to make it more realistic.

In this simple proof of concept (figure 3) the malicious symbolic link only downloads a text file from vipersec. The only disadvantage is that the malicious symbolic links generated in Windows 7 and above do not work in Windows XP and vice versa.

You can download the proof of concept to test it by yourself if you wish. Make sure that you unzip the files first. There are two versions:

Windows 7, 8, 10: Windows7plus_poc.zip
MD5: e3576ba6f18eb51fa475d737f40a5a4c

Windows XP: WindowsXP_poc.zip
MD5: 9b9b52b1c67ea687978d8f15c3f21abb

Continue to the 2^nd part, feedback and comments are always welcomed.

Links

Recent Posts