Hostile Airwaves: Mousejacking On internal engagements, poisoning name resolution requests on the local network (à la Responder) is one of the tried and true methods of obtaining that coveted set of initial Domain credentials.  While this approach has worked on many clients, what if Link Local Multicast Name Resolution (LLMNR) and NetBIOS Name Service (NTB-NS) protocols are configured securely or disabled?  Or, what if Responder was so successful that you now want to prove other means of gaining that initial foothold?

There are a multitude of attacks a penetration tester can leverage when conducting physical walkthroughs of client spaces.  One of the more interesting, and giggle-inducing, involves exploiting wireless peripherals.  This technique, known as “mousejacking”, involves exploiting vulnerable 2.4 GHz input devices by injecting malicious keystrokes (even if the target is only using a wireless mouse) into the receiving USB dongle.  This is made possible because many wireless mice (and a handful of keyboards) either don’t use encryption between the device and its paired USB dongle, or will accept rogue keystrokes even if encryption is being utilized. Let’s explore…