full-disclosure - Psexec on *NIX

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20040506231244.E43.0@argo.troja.mff.cuni.cz>
From: peak at argo.troja.mff.cuni.cz (Pavel Kankovsky)
Subject: Psexec on *NIX 

On Thu, 6 May 2004, Chris Carlson wrote:

> I know it is possible to remotely install any solution and then use
> it, but it doesn't make sense to do so.  Why would I install and run
> an ssh daemon just to use it to run another program, then delete the
> ssh daemon?  Why would I do that with anything?  It just doesn't make
> sense.

Psexec does more or less the same thing in an automated way: it uploads a
program to the target machine (via ADMIN$ share), registers it as a new
services, starts the service, connects to the service and asks it to
execute the given command, stops the services, unregisters the service
and removes the program.

Last time I looked, smbclient and rpcclient from Samba TNG were able
to accomplish all of the listed tasks but service registration and
unregistration.

An alternative method to run code on a remote MS Windows machine is to
start an uploaded program by the Scheduler service (assuming this service
is running or at least ready to be started). This can be done using
rpcclient.

--Pavel Kankovsky aka Peak  [ Boycott Microsoft--http://www.vcnet.com/bms ]
"Resistance is futile. Open your source code and prepare for assimilation."