NT 시스템에 대한 모의 해킹 중 다양한 서비스를 원격 인스톨하는 기법을 사용하는 경우가 있습니다.

기본적인 명령어의 사용법이나 개념 이해를 도울 수 있는 자료가 있기에 올려봅니다.
-

- How may I remotely install RA on a single distant PC?
- You can use a free tool called psexec.exe available from www.sysinternals.com to deploy and run Slave on all the machines of your LAN with a single line of text.

For the ones that want to understand how it works, you need the Administrator account of the distant PC, and the PC must be reachable by TCP/IP.
Open a DOS box and type the following commands:

  • NET USE \192.168.112.24IPC$ /user:administrator password
  • COPY "C:Slave.exe" "\192.168.112.24C$WinNT (you may have to replace WinNT by Windows)
  • NETSVC \192.168.112.24 schedule /start   (make sure that the Scheduler Service is started)
  • NET TIME \192.168.112.24                        (note the time of the remote PC)
  • AT \192.168.112.24 10:00 "C:Slave.exe"    (replace 10:00 by the time of the PC plus one minute)

That's it! RA is running on the remote PC so you can access it with Master! You can also use the following commands:

  • REGINI -m \192.168.112.24  ra.reg             (to install some Registry settings on the remote PC)
  • SHUTDOWN \192.168.112.24 /R /Y /C /T:0  (to reboot the remote PC)

There is a LOGON SCRIPT in the PDF Manual to remotely install/Update/Remove RA on remote PCs.

-

출처 : http://www.twd-industries.com/en/faq.htm

정리해 보자면...
1. psexec 를 활용하여 명령어 한번에 원격 서비스 설치 가능
예) psexec \* -u domainadministrator -p password -c -d -i "C:myservice.exe"
       - psexec
\192.168.124.145 -u domainmike -p secret -c -d -i "C:myservice.exe"

2. psexec 활용 불가 시
net use
\192.168.112.24IPC$ password /user:administrator
copy "C:slave.exe" "
\192.168.112.24C$WinNT
netsvc \192.168.112.24 schedule /start
net time
\192.168.112.24
at \192.168.112.24 10:00 "C:slave.exe"

or

regini -m
\192.168.112.24 ra.reg
shutdown
\192.168.112.24 /r /y /c /t:0

이 기법은 원격 VNC 설치에도 즐겨 사용되는 기법입니다.
2009/08/11 14:58 2009/08/11 14:58

Trackback Address :: https://youngsam.net/trackback/734