Information Gathering
In this section,
we’ll discuss various methods of enumerating a target’s installed software
without interacting with the target machine.
These techniques are best-suited for situations
in which we have no way to interact with the target.
Since we are not interacting with the target,
we won’t alert monitoring systems or leave forensic traces of our inquiry.
One approach is to inspect the metadata tags of publicly-available documents
associated with the target organization.
These tags can include a variety of information
a document including author,
creation date,
the name and version of the software used to create the document,
operating system of the client, and much more.
In some cases,
this information is stored explicitly in the metadata,
and in some cases it is inferred,
but either way the information can be quite revealing,
helping us to build an accurate profile of software installed on clients
in a target organization.
Although this is a “hands-off” approach to data gathering,
the trade-off is that we may not gather accurate information.
Still, this approach is viable and effective.
Let’s practice searching for and retrieving documents from
the Mountain Vegetables website.
The text on the site states that the website is currently under development.
Scrolling through the page and hovering over buttons,
we find a link to download a brochure.
Once we click CURRENT,
Firefox opens the document in a new tab where we can download it.
We’ll use exiftool to display the metadata of any supported file.
We’ll use exiftool with -a to display duplicated tags,
and -u to display unknown tags in brochure.pdf:
This generated a lot of output.
The Create Date and Modify Date sections reveal the relative age of the document.
The Author section reveals the name of an internal employee.
We could use our knowledge of this person
to better establish a trust relationship
by dropping their name casually into a targeted email or phone conversation.
This is especially helpful
if the author maintains a relatively small public profile.
The output further reveals that the PDF was created with Microsoft PowerPoint
for Microsoft 365.
This is crucial information for us to plan our client-side attack
since we now know that the target uses Microsoft Office.
Since there is no mention of “macOS” or “for Mac”
in any of the metadata tags,
it’s very probable that Windows was used to create this document.
We can now leverage client-side attack vectors
ranging from Windows system components to malicious Office documents.