Quantcast
Channel: All Posts - Malicious Link - Blog by mubix - Rob Fuller
Viewing all articles
Browse latest Browse all 1156

Evidence of Compromise - Metasploit's PSEXEC

$
0
0
Was messing with the Windows service binaries in Metasploit today and I noticed something unique I hadn’t noticed before. For the PSEXEC module, the service name (actually just the display name, ‘service name’ is random) always started with an uppercase ’M’. Curious to why that was I looked and found Line 246 of the PSEXEC module to be the culprit: I can guess why the M is there. Might be just a quirk with old Windows versions that didn’t allow lowercase service names, not sure.

Viewing all articles
Browse latest Browse all 1156

Trending Articles