| « IMPORTANT: No New ClamAV Signatures for CSA Versions Earlier than 6.0.1.138 | Priveon Training Schedule Updated » |
Metasploit update allows backdooring of fully functional EXE
03/25/10
Metasploit update allows backdooring of fully functional EXE
Attention Pentesters!
There was an interesting update to Metasploit (go do your SVN UP) that now allows msfencode to add an existing msfpayload to a pre-existing EXE of your choice while retaining full EXE functionality. What does this mean? Well, for starters, it would allow you to get an individual to run a known .exe that functions as expected to the user yet runs your shellcode in the background (like meterpreter).
Once you attach to the meterpreter session or it attaches back to you, you can now use the somewhat recent ability to migrate the meterpreter session from the backdoor of the new exe to something that will not terminate like explorer.exe.
Voila! Pwned via the Bowling_Elves.exe... Again...
For more info and step-by-step process by example see: here
XML Feeds©2010 by Priveon, Inc.