Utilizing winexe to create a backdoor

On Thursday of this week I was fortunate enough to work along side a colleague of mine as we were conducting a forensic investigation. We had retrieved a active laptop and wanted to conduct a live memory dump of the system. Unfortunately there was a password on the screen saver and we didn’t want to compromise the data in anyway. His solution to achieve our goals was to utilize a program called winexe on a *nix system.

Winexe allows a person to connect to the IPC$ share of an active host. Now you might say “whats the point”. Take a moment and look at it from a corporate investigative standpoint. If you have a system that you possess a local admin account for (perhaps a standard one utilized by the company help desk) you can utilize this to access that IPC$ share.

Now winexe will open winexesvc control named or “ahexe.” After a successful connection it passess optional parameters (ex. –runas, –system) and the command itself to winexesvc process via the pipe.

Then winexesvc creates two pipes: ahexec_stdio%08X, and ahexec_stderr%08X (where %08X is replaced by unique number) and runs command with I/O redirected to those pipes.

Now we create a Netcat reverse shell and we are into the system from the Linux console. Completing a nifty little memory dump. Viola active memory secured on a password protected system.

I will have future posts on utilizing Netcat and tools and tricks for capturing the active memory.

You can find this great tool at http://eol.ovh.org/winexe/