Re: kind of off topic but not much -- Windows XP connects to mail server before logging in MBR exploit?

[Joshua Smith <lazydj98 () gmail com>]

servifythis will also do that

On Tue, Aug 2, 2011 at 9:42 PM, Average SecurityGuy <
averagesecurityguy () gmail com> wrote:

> You could also set up the meterpreter executable as a service. You would
> need srvany.exe from Microsoft. It might be difficult to find but it is
> available. Srvany will take any executable and turn into a service.
>
>
> On Tue, Aug 2, 2011 at 5:32 PM, Robin Wood <robin () digininja org> wrote:
>
> > On 2 August 2011 22:27, Chip <jeffschips () gmail com> wrote:
> > > On 8/2/2011 4:49 PM, Robin Wood wrote:
> > > > On 2 August 2011 17:53, Chip<jeffschips () gmail com>  wrote:
> > > > > I know this is not entirely along the lines of metasploit but knowing
> > > > > that
> > > > > almost all who subscribe to this list are network gurus I thought I
> > would
> > > > > post my question here -- it may, in fact, have something to do with an
> > > > > exploit affecting the MBR of a host machine.
> > > > >
> > > > > I have a windows xp machine which connects to a mail server with
> > > > > encrypted
> > > > > traffic before anyone logs in, right after start up and when the
> > windows
> > > > > xp
> > > > > login splash screen comes up.   I know this is the case because I
> > > > > attached
> > > > > an inline tap to the network to watch traffic and see this activity
> > every
> > > > > time the machine starts up.
> > > > >
> > > > > Reading a lot recently about MBR exploits I'm wondering how I can
> > track
> > > > > down
> > > > > what culprit is doing this?  Since it occurs ONLY prior to login, I
> > > > > cannot
> > > > > look at tasklist or netstat in a shell and see anything.  I'm hoping
> > > > > someone
> > > > > on this list could advise either in the list or off the list.
> > > > >
> > > > > I do have some captured packets of the activity, but it is encrypted
> > TLS
> > > > > traffic.
> > > > Create a meterpreter binary and run it on the machine with psexec
> > > > you've then got full access to the machine and can watch what happens
> > > > when you log in at the keyboard.
> > > >
> > > > Have you checked who owns the mail server the traffic is going to? Is
> > > > it a legit one or some dodgy backstreet one? If it goes via domain
> > > > name you could try doing a DNS MITM to send it to a machine you own,
> > > > it might not validate that the certificate is the correct one so you
> > > > would be able to capture the traffic and decode it. You can do the
> > > > same if it does IP you just need to setup routing and IPs correctly.
> > > >
> > > > Robin
> > > Very, very interesting option and since it does do domain name lookup --
> > I
> > > can see that in the network tap -- I find that might be the way to go!
> >  My
> > > question is if I used the meterpreter binary psexec method, will that
> > load a
> > > session prior to login, because this malware seems to drop silent once
> > login
> > > occurs.  And if I get a meterpreter session, are you then suggesting I
> > run
> > > tasklist or netstat then to tease out the culprit?
> > >
> > > Thanks.
> >
> > It depends on what it counts as a login, it may only be watching for
> > one from the GUI, if so psexec may not be noticed. If it is then just
> > install an old ftp server from exploit-db and exploit that to get your
> > Meterpreter shell, there is no login then.
> >
> > And yes, watch with tasklist and other tools. I'm no good with
> > forensics, I'm sure there are others on this and other lists who will
> > be able to tell you what to look for.
> >
> > Robin
> > _______________________________________________
> > https://mail.metasploit.com/mailman/listinfo/framework
>
>
>
> --
> Stephen Haywood
> Security Consultant
>
> Twitter: @averagesecguy
> Blog: averagesecurityguy.info <http://averagesecurityguy.info>
>
>
> _______________________________________________
> https://mail.metasploit.com/mailman/listinfo/framework


-- 
- Josh

_______________________________________________
https://mail.metasploit.com/mailman/listinfo/framework