From b55aa3884199fe2048f2fdc1f44c49c54606971f Mon Sep 17 00:00:00 2001 From: webbreacher Date: Thu, 23 Jan 2014 17:20:18 -0500 Subject: [PATCH] Adding files I forgot to add yesterday --- presence/windows/blind.md | 2 +- presence/windows/windows_cmd_config.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/presence/windows/blind.md b/presence/windows/blind.md index 8a67efd..e294932 100644 --- a/presence/windows/blind.md +++ b/presence/windows/blind.md @@ -26,4 +26,4 @@ The files below are things to pull when all you can do is to blindly read. Examp | `%WINDIR%\system32\config\default.sav`
`%WINDIR%\system32\config\security.sav`
`%WINDIR%\system32\config\software.sav`
`%WINDIR%\system32\config\system.sav` | Backup Windows registry files (http://forensics.wikia.com/wiki/Windows_registry_entries) | | `%WINDIR%\system32\logfiles\httperr\httperr1.log` | IIS 6.x web server error logs. | | `%WINDIR%\system32\logfiles\w3svc1\exYYMMDD.log` where YYMMDD = year month day | Web server log files. | -| `unattend.txt, unattend.xml, sysprep.inf` | Used in the automated deployment of Windows images and can contain user accounts. | \ No newline at end of file +| `unattend.txt, unattend.xml, unattended.xml, sysprep.inf` | Used in the automated deployment of Windows images and can contain user accounts. Sometimes found in the `%WINDIR%\Panther\` directory. | \ No newline at end of file diff --git a/presence/windows/windows_cmd_config.md b/presence/windows/windows_cmd_config.md index aa4eae6..15b4ef7 100644 --- a/presence/windows/windows_cmd_config.md +++ b/presence/windows/windows_cmd_config.md @@ -214,7 +214,7 @@ For some of these `wmic` commands that pull information (versus perform an actio ### Process Create * **Command with arguments**: `wmic process call create [EXECUTABLE]` - * **Description**: Launches an executable. Replace [EXECUTABLE] with the name of the executable you'd like to launch (for example: calc.exe). Do not include quotes around the value (for example: *DO* use calc.exe; do *NOT* use "calc.exe"). + * **Description**: Launches an executable. Replace [EXECUTABLE] with the name of the executable you'd like to launch (for example: calc.exe). Do not include quotes around the value (for example: *DO* use calc.exe; do *NOT* use "calc.exe"). Another option for this command comes from [Rob Fuller's talk](http://www.slideshare.net/mubix/windows-attacks-at-is-the-new-black-26665607): `wmic /node:DC1 /user:DOMAIN\domainadminsvc /password:domainadminsvc123 process call create "cmd /c vssadmin list shadows 2>&1 > c:\temp\output.txt"` * **Output**: *
**Windows 2008:** Show/Hide
C:\Users\johndoe>wmic process call create calc.exe
Executing (Win32_Process)->Create()
Method execution successful.
Out Parameters:
instance of __PARAMETERS
{
ProcessId = 1936;
ReturnValue = 0;
};