Executing An .exe File Automatically

[Infiltrator]

Hi All,

I would like to know if that's possible for an .exe file to automatically execute itself upon arrival on a target machine without any user interaction.

For example, I am running two VMs one of them is a web server that has some file uploading mechanism and the other machine is the attacker machine.

Now when I upload an .exe file from the attacker machine to the victim machine (web server) I would like the .exe file to execute itself upon arrival if this is even possible at all?

Your comments will be much appreciated thank you.

Regards,

Infiltrator

Edited June 5, 2010 by Infiltrator

[emaster28]

Have u seen the section on the USB Switchblade or Hacksaw? If you have, then sorry, this reply is useless.

[ChevronX]

Possibly some sort of packaged exe, with the /s switch. Silent installer or away to have an autorun file execute. Unsure, im sure others will have better ideas then I have.

[will-wtf]

Self execution can only really be made with autorun (now mostly patched) or an exploit as self execution is the main component in malware... :S

A while back there was a .GIF exploit that would cause this to happen :)

[Infiltrator]

Self execution can only really be made with autorun (now mostly patched) or an exploit as self execution is the main component in malware... :S

A while back there was a .GIF exploit that would cause this to happen :)

I guess I could do the following

put a php/asp shell on the server and use that to execute your exe or use some sort of exploit script to do the dirty work for me.

Edited June 7, 2010 by Infiltrator

[redxine]

Ah - thus is entering the realm of buffer overflows. And that is quite a bit of an art. Looking at where a service has a memory leak and taking advantage of it to spill your code perfectly into the IP value of the next memory address, and having the processor run your code with it....

The only other thing I could think of is having it replace an already existing binary (such as one in cgi-bin [look for bad permissions]) and then calling it remotely with a request.