Persistent Asynchronous and Fileless Backdoor

2010 - Stuxnet• Exploited MS10-061 – Windows Printer Spooler• Exploited an arbitrary file write vulnerability• WMI provided a generic means of turning a file write toSYSTEM code execution!• The attackers dropped a MOF file to gain SYSTEM-levelexecution.• Microsoft fixed this exploit primitivehttp://poppopret.blogspot.com/2011/09/playing-with-mof-files-on-windows-for.html