Re: vnc reverse question

[neil-on-metasploit at restricted.dyndns.org (Neil)]

For the win32_adduser, it's fine since the purpose of that is to really 
create a user. But what about the exploit(not payload), does it change 
anything likes files? Can we also safely say that after we reboot the 
affected machine, the system is back in state how it was prior to the 
attack? I think, the reason why I am asking this is because of the behavior 
of malicious worms. Even if we reboot an infected machine, the worm will 
still be there. 

Thanks. 

neil 

H D Moore writes: 

> The only Windows payloads which have the ability to modify the system are:
> - win32_exec: executes whatever command you want, which could modify..
> - win32_adduser: creates a new local user account on the system
> - win32_*_uploadexec: uploads a file to c:\metasploit.exe and executes it 
>
> After exploit certain system-level flaws, you should reboot the system to 
> prevent any in-memory modifications from causing a crash at a later date. 
> For instance, if you use the LSASS or MS03-026 exploits on an active 
> domain controller, there is a small chance the system will crash sometime 
> after you have exited your shell/pay/load/vnc session. If you are testing 
> production systems, make sure you are able to reboot them after a 
> successful exploit session.