Cyber genius David Kennedy (aka The Mad Hugger) and his rockstar team have done it again. Just when you thought your Anti-Virus was safe, the TrustedSec team has shown once again that pinning all your corporate security hope on AV protection alone is not a good strategy.
A ton of new features have been added (check out their video above) and some of the older features have been re-written and revamped. Making SET 4.0 codenamed “Balls of Steel” (who makes up these names??) one of the coolest pentesting tools out there.
I just had to check out the new “PyInjector” feature (injects shellcode straight into memory) and see how it fared against a fully updated Windows 7 with one of the best AV/network protection suits installed:
Looks like it worked pretty good!
Okay, I have been playing around with Windows 8 for a while now, checking out it’s updated security features and I have been pretty impressed so far. Here is a screenshot of the same attack against a Windows 8 system using only the included Microsoft Windows Defender:
No shell, only an ever repeating screen of errors.
Okay, let’s try the new Java 7 attack against both and see how it fairs. First the Windows 8 system:
Hmm… Seems to have stopped it at the request stage. Windows Defender did have an update that I installed just prior to running this test. Though I thought it odd that nothing showed in the Windows Defender log.
Okay and the Windows 7 system with the good AV:
Just got to the sending applet part, but no shell. Looks like it stopped it too.
I tried the regular Java attack that has been re-tooled and I was able to get a remote shell with both versions of Windows. It was odd though as neither would let me actually do anything with the shell. Anything I tried to input into the shell would just be echoed onto the webpage on the target machine.
This just shows that even though in some cases the AV was able to stop the attacks, I was still able to get a full remote shell. Users must be educated about online risks, and network defense can not be focused on AV protection alone. Social Engineering is one of the top targeted attack methods used against corporate networks.
Sometimes your user is your last and greatest line of defense.
Cross-posted from Cyber Arms