Tcstool

Definitely let me know. I'll play with this when I have a little time. I've got something Black Hat-ish I'm wanting to try with this.

Yeah this card works fine, no worries.

So here's what I'm looking for...Figured you guys might have some feedback: I need some print server software that will keep copies of the documents sent to the hosted printers. My preference is Free/Open source software, but I can live with commercial software as long as it's cheap. Is anyone familiar anything out there that can accomplish this?

Sure man, Darren and I did a quick interview about it at PhreakNIC since this is what my presentation was about, but I really just hit the high points during that interview and didn't get into the nuts and bolts of it. You are more than welcome to dig into the technical side of it and do a presentation about it.

Permission granted! I would love to see this idea evolve. Since Microsoft has made COFEE only available to law enforcement, I think having a portable, self-contained audit and incident response tool like this could grow into a really nice open source project.

Ask and you shall receive! I have added under the local machine status section a command to enumerate the printers on the machine, their ports, and certain other properties. Thanks for the suggestions!

I agree 100%, but really that could be said of any information gathering tool. As far as not needing one piece of information or the other, that's what I like the use of batch files in this. You can just knock the lines out on the fly and rebuild your ISO image.

Actually it runs really fast. On a 1st generation P4 with 512 MB of RAM it takes around 3 minutes. On a modern Athlon with 1 GB of RAM it took a little over a minute. The slowest parts are the registry export and the MD5 calculations. I think to be able to gather that much evidence in an incident, that's not too shabby, particularly considering your can write all your data to your device. Pretty nice little portable investigative tool I think.

So this leans more towards the white hat side of things, but I thought I would share the code from my U3 incident response payload I presented at PhreakNIC. It does require 4 third party tools to run: PSInfo-http://technet.microsoft.com/en-us/sysinternals/bb897550.aspx PSList-http://technet.microsoft.com/en-us/sysinternals/bb896682.aspx PSLoggedon-http://technet.microsoft.com/en-us/sysinternals/bb897545.aspx MD5sums-http://www.pc-tools.net/win32/md5sums/ Everything else is command line fu. It's been a great asset to me when I've had to work with malware analysis or go investigate a machine that's been owned. Hope you enjoy and hit me up if you have questions First the go.vbs to determine where to locate the data; This file should be launched from autorun.inf (Based off Gonz0r's solution): Set objFSO = CreateObject("Scripting.FileSystemObject") Set objShell = CreateObject("Wscript.shell") Set colDrives = objFSO.Drives For Each objDrive in colDrives If objFSO.FileExists(objDrive.DriveLetter & ":\u3ir.dat") Then strPath = objDrive.DriveLetter & ":" objShell.Run ".\u3ir\go.bat " & strPath End If Next Now the batch script: REM Set log file location IF NOT EXIST %1\output ( MD %1\output ) CD u3ir REM enumerate local accounts and currently logged on users net users >> %1\output\localaccts-%computername%.txt psloggedon /accepteula >> %1\output\localaccts-%computername%.txt REM Grab network info, arp tables, open connections, and firewall status ipconfig /all >> %1\output\localnet-%computername%.txt ipconfig /displaydns >> %1\output\localnet-%computername%.txt arp -a >> %1\output\localnet-%computername%.txt netstat -ano >> %1\output\localnet-%computername%.txt route print >> %1\output\localnet-%computername%.txt type %systemroot%\system32\drivers\etc\hosts >> %1\output\localnet-%computername%.txt netsh firewall show state >> %1\output\localnet-%computername%.txt netsh firewall show service >> %1\output\localnet-%computername%.txt net use >> %1\output\localnet-%computername%.txt REM Grab a list of installed software and running processes psinfo /accepteula /h /s >> %1\output\sysinfo-%computername%.txt pslist -t /accepteula >> %1\output\sysinfo-%computername%.txt REM Grab state of all services on the machine sc query state= all >> %1\output\sysinfo-%computername%.txt REM Grab a list of the printers on the machine and properties cscript %systemroot%\system32\prnmngr.vbs -l >> %1\output\sysinfo-%computername%.txt REM Export the registry of the machine REM HKEY_LOCAL_MACHINE reg export HKLM %1\output\hklm-%computername%.reg REM HKEY_CURRENT_USER reg export HKCU %1\output\hkcu-%computername%.reg REM HKEY_CLASSES_ROOT reg export HKCR %1\output\hkcr-%computername%.reg REM HKEY_USERS reg export HKU %1\output\hku-%computername%.reg REM HKEY_CURRENT_CONFIG reg export HKCC %1\output\hkcc-%computername%.reg REM calculate MD5 hashes of the system directory md5sums %systemroot% >> %1\output\osmd5-%computername%.txt md5sums %systemroot%\system >> %1\output\osmd5-%computername%.txt md5sums %systemroot%\system32 >> %1\output\osmd5-%computername%.txt So what does all this wonderful code gather you from your target machine? All the user accounts The users currently logged on and what time they logged on The IP configuration of all the NICs The contents of the DNS cache The ARP table entries The TCP port states, and the process ID that is using that port The routing table The HOSTS file contents The status of the Windows firewall and the rules it is operating by All mapped network drives All installed programs and Windows updates All the running processes on a machine in tree view so you can see which process spawned which subprocess The state of all the services on the machine A complete export of the machine registry The md5 values of all the files in the windows directory, the windows\system directory, and the windows\system32 directory. Hope this helps somebody out. Again hit me up if you have any questions.

I think it depends on what you are trying to accomplish. How many machines are you talking about emulating on your CD? Just one, or lots? Are you wanting to only simulate something to run exploits against, or are you wanting to simulate something which involves all the steps of the pentesting process? You might want to check out De-ICE live pentesting CDs for ideas.

Agreed w/above. Pstools features a utility called psshutdown for remotely shutting machines off. It works very, very well.

I've seen that with some thin access points and Airodump-ng before. Not sure what exactly it is. I'll look into it and let you know what I figure out.

That's great stuff. I'm going to add to my toolkit. Thanks man!

Hey man I'd love to help you out with this. I live down in Cookeville so we could easily set something up. Drop me a line.

Good video Irongeek! I really enjoyed the recap....even saw myself lurking in the background a couple of times!

Hey you can use http://tcstool.wordpress.com...I plan to get that going full swing after a shaky start. It's tough to run a blog with a new baby in your house!

Yeah that's me. I really hated the guy before me went over on time so much, but I felt what he was doing was important. I really wanted to get everyone out by 6 PM, so I screamed through it on purpose and still only got out 4 minutes before. I was actually sitting there dropping slides as it got later and later! I actually cut it from 28 to 14 in the middle of his presentation. Anyways, I'm glad you liked it. I distributed probably 50 copies total of my payload and the customizer so far.

One thing that's important to remember is that PhreakNIC broadcasts the talks on closed circuit TV accessible from all the rooms, so the number of people in the room isn't always reflective of the number of people watching the talk. A lot of folks will get their dinner or whatever and watch the talks from the comfort of their luxury rooms at the Days Inn by the Stadium :-p Glad to post here finally. Long time lurker but first time poster. I had a great time talking to Darren and Shannon about my U3 incident response adaptation.