Re: Putty Proxy login/password discolsure....

[Brian Dessent <brian () dessent net>]

Valdis.Kletnieks () vt edu wrote:

> For bonus points, figure out how to reboot the machine without being
> detected.  For starters, there's that pesky 'uptime' ;)

1. Pull power plug on target machine.
2. Open case, disconnect data cable from target hard drive.
3. Use PATA/SATA-to-USB cable to connect target hard drive to attacker's
laptop.
4. Re-energise target machine (it won't boot, this is only to supply
power to target hard drive.)
5. Using laptop, mount target hard drive and <insert malfeasance here>.
6. When done, install rootkit on filesystem of target hard drive.
7. Power down, unplug USB adapter cable, reattach target hard drive's
controller, close case, boot target.
8. Using rootkit installed in 6, get privilege and manipulate log files,
utmp, kernel state, et al. to cover any traces of a shutdown.
9. Profit.

Brian

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/