Kimberly S. wrote: > Hi all, > > I am currently working on a no holds barred pen test that includes social > engineering. > As such, I intend to get a trojan installed onto the clients network via > email or autostarting CDROM, but want something that is going to not be > caught by AV software (they say they have Norton AV enterprise wide). > I was hoping that someone out there in pen test land already had developed > something of the same ilk and could save me some time by sending me a copy > or linking to something I could use. > > Features desired are: > > 1>> > Machine A on client site makes a configurable encrypted OUTBOUND connection > to Machine B. Desire a netcat type outbound connection on port 80 that will > detect and use the clients existing Internet Browser proxy settings. > > I know this is quite a tall order; really the most important element is that > Machine A makes the outbound connection, and that the traffic at least looks > a bit like HTTP and it survives a reboot. > > Any help would be *so* appreciated! > > Well, here is the only advice I can give you at this point. Try to make the outbound connection 443. Encryption will thort attempts to detect common network hacks. One property of encryption is that it not only can scramble (and thus "hide") confidential network traffic, but malicious traffic as well! :) Also -- although I've read that many companies detect this now -- write the email in HTML with Javscript that automatically runs the attachment. This is especially good if the user has a preview window open. And when you have the code that does that perhaps you are better off making the email urgent. This in combination with social engineering the help desk that you are a new user -- or what every user story you will give them -- should really work great. "Hi I'm so-and-so... I need x,y,z done... let me send you this email... blah blah blah..." I believe there is a tool out there at scrambles common fingerprints to known trojans -- such as subseven or back oriface -- but I do not remember its name. Perhaps someone on this list will. Good luck. I'd be interested to know how it turns out. 'ken' -- "I grew convinced that truth, sincerity and integrity in dealings between man and man were of the utmost importance to the felicity of life, and I formed a written resolution to practise them ever while I lived." -Benjamin Franklin, The Autobiography of Benjamin Franklin ---------------------------------------------------------------------------- This list is provided by the SecurityFocus Security Intelligence Alert (SIA) Service. For more information on SecurityFocus' SIA service which automatically alerts you to the latest security vulnerabilities please see: https://alerts.securityfocus.com/
This archive was generated by hypermail 2b30 : Fri Jan 11 2002 - 12:23:37 PST