Re: kind of off topic but not much -- Windows XP connects to mail server before logging in MBR exploit?

[Robin Wood <robin () digininja org>]

On 2 August 2011 22:27, Chip <jeffschips () gmail com> wrote:
> On 8/2/2011 4:49 PM, Robin Wood wrote:
> > On 2 August 2011 17:53, Chip<jeffschips () gmail com>  wrote:
> > > I know this is not entirely along the lines of metasploit but knowing
> > > that
> > > almost all who subscribe to this list are network gurus I thought I would
> > > post my question here -- it may, in fact, have something to do with an
> > > exploit affecting the MBR of a host machine.
> > >
> > > I have a windows xp machine which connects to a mail server with
> > > encrypted
> > > traffic before anyone logs in, right after start up and when the windows
> > > xp
> > > login splash screen comes up.   I know this is the case because I
> > > attached
> > > an inline tap to the network to watch traffic and see this activity every
> > > time the machine starts up.
> > >
> > > Reading a lot recently about MBR exploits I'm wondering how I can track
> > > down
> > > what culprit is doing this?  Since it occurs ONLY prior to login, I
> > > cannot
> > > look at tasklist or netstat in a shell and see anything.  I'm hoping
> > > someone
> > > on this list could advise either in the list or off the list.
> > >
> > > I do have some captured packets of the activity, but it is encrypted TLS
> > > traffic.
> > Create a meterpreter binary and run it on the machine with psexec
> > you've then got full access to the machine and can watch what happens
> > when you log in at the keyboard.
> >
> > Have you checked who owns the mail server the traffic is going to? Is
> > it a legit one or some dodgy backstreet one? If it goes via domain
> > name you could try doing a DNS MITM to send it to a machine you own,
> > it might not validate that the certificate is the correct one so you
> > would be able to capture the traffic and decode it. You can do the
> > same if it does IP you just need to setup routing and IPs correctly.
> >
> > Robin
> Very, very interesting option and since it does do domain name lookup -- I
> can see that in the network tap -- I find that might be the way to go!  My
> question is if I used the meterpreter binary psexec method, will that load a
> session prior to login, because this malware seems to drop silent once login
> occurs.  And if I get a meterpreter session, are you then suggesting I run
> tasklist or netstat then to tease out the culprit?
>
> Thanks.

It depends on what it counts as a login, it may only be watching for
one from the GUI, if so psexec may not be noticed. If it is then just
install an old ftp server from exploit-db and exploit that to get your
Meterpreter shell, there is no login then.

And yes, watch with tasklist and other tools. I'm no good with
forensics, I'm sure there are others on this and other lists who will
be able to tell you what to look for.

Robin
_______________________________________________
https://mail.metasploit.com/mailman/listinfo/framework