EDIT 2012-07-01: Please read HD’s comment below, as of 1st of July 2012, you can set “MeterpreterUserAgent” and “MeterpreterServerName” to do that from the framework itself. The meterpreter/reverse_http(s) payload’s network communications leaves traces of its existence in many places “Mainly HTTP Proxy logs” One of the most obvious and easiest-to-detect signs are the “User-Agent:” header from the … [Read more…]
This post is showing how to create a passive ethernet tab using only an ethernet cable and four RJ-45; it is not about creating a good passive ethernet tap, or even to explain what it is, that has already been explained better by others, the result will be ugly, not optimal… but hey, it works!. Passive … [Read more…]
Even though this post is focusing on finding flame malware files in a windows domain environment, the concepts are valid for looking for “any” particular file in your domain machines. If you do not know what’s flame, look here. A list of flame Command and Control servers (DNS & IPs) can be found here. In … [Read more…]