|
Server : Apache/2.4.18 (Ubuntu) System : Linux canvaswebdesign 3.13.0-71-generic #114-Ubuntu SMP Tue Dec 1 02:34:22 UTC 2015 x86_64 User : oppastar ( 1041) PHP Version : 7.0.33-0ubuntu0.16.04.15 Disable Function : pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority, Directory : /usr/share/nmap/nselib/data/psexec/ |
Upload File : |
The files in this directory are the data files required for smb-psexec.nse. The .lua files are configurations. Each of these defines a profile for a psexec execution. nmap_service.exe is a program that facilitates the operation of smb-psexec.nse. It is uploaded to the remote host and runs the programs it's directed to run, redirecting their output to a file. This file is then downloaded by the script and displayed to the user. When Nmap released version 5.20, it was discovered that some over-zealous antivirus software tagged this program as spyware[1]. For that reason, when stored on the host machine, it is now encoded by xoring every byte of the file with 0xFF. When uploaded to a target machine, it is decoded in-stream. This prevents programs on the host machine from tagging it as malicious, but does not prevent the target from detecting it (which is arguably a good thing). The encoder.c program reads a program from stdin, encodes it by xoring with 0xFF, and writes it to stdout. [1] http://seclists.org/nmap-dev/2010/q1/198