It turns out that (modulo some details) it's possible to trick a Windows computer connected to a network you control into opening a browser that points to a URL of your choosing. That's because NCSI initiates probes using plain HTTP rather than HTTPS, so the usual injection attacks can be carried out without the user having to take any action of their own.
(The directory OP linked to appears to be a payload they just added to the repo that fingerprints users who are presumably on the receiving end of such an attack; the actual code to carry out the attack in the first place is outside of that directory.)
---
The interesting part about that is that that's more or less what captive portals are supposed to do. One imagines that where this gets interesting is when one couples it with one of those attacks where you convince someone's computer to disconnect from a public WiFi hotspot and connect to your computer instead; then you can force a page to pop up without them realizing you're not the owner of the WiFi hotspot.
I wonder how easy it would be to carry out a phishing attack via such a mechanism? Force a captive portal prompt to launch on an unsuspecting user and have it render UI that looks like Windows and tells them they need to re-enter their Microsoft account credentials or credit card number or something.
It turns out that (modulo some details) it's possible to trick a Windows computer connected to a network you control into opening a browser that points to a URL of your choosing. That's because NCSI initiates probes using plain HTTP rather than HTTPS, so the usual injection attacks can be carried out without the user having to take any action of their own.
(The directory OP linked to appears to be a payload they just added to the repo that fingerprints users who are presumably on the receiving end of such an attack; the actual code to carry out the attack in the first place is outside of that directory.)
---
The interesting part about that is that that's more or less what captive portals are supposed to do. One imagines that where this gets interesting is when one couples it with one of those attacks where you convince someone's computer to disconnect from a public WiFi hotspot and connect to your computer instead; then you can force a page to pop up without them realizing you're not the owner of the WiFi hotspot.
I wonder how easy it would be to carry out a phishing attack via such a mechanism? Force a captive portal prompt to launch on an unsuspecting user and have it render UI that looks like Windows and tells them they need to re-enter their Microsoft account credentials or credit card number or something.