metasploit-framework/external/source/DLLHijackAuditKit
HD Moore df918670a2 Add a revision
git-svn-id: file:///home/svn/framework3/trunk@10140 4d416f70-5f16-0410-b530-b9f4589650da
2010-08-25 15:13:06 +00:00
..
01_StartAudit.bat Actually track this in SVN 2010-08-25 14:21:53 +00:00
02_Analyze.bat Actually track this in SVN 2010-08-25 14:21:53 +00:00
DLLAudit.pmc Actually track this in SVN 2010-08-25 14:21:53 +00:00
README.txt Actually track this in SVN 2010-08-25 14:21:53 +00:00
analyze.js Use the same wait logic for analyze 2010-08-25 15:05:37 +00:00
audit.js Fix CSV parsing when the timestamp has a comma, extend the wait period during the audit to handle slow systems better. 2010-08-25 15:04:19 +00:00
package.sh Add a revision 2010-08-25 15:13:06 +00:00
regenerate_binaries.rb Regenerated binaries, error when CSV is missing 2010-08-25 14:33:09 +00:00
runcalc.dll Regenerated binaries, error when CSV is missing 2010-08-25 14:33:09 +00:00
runcalc.exe Regenerated binaries, error when CSV is missing 2010-08-25 14:33:09 +00:00
runtest.dll Regenerated binaries, error when CSV is missing 2010-08-25 14:33:09 +00:00
runtest.exe Regenerated binaries, error when CSV is missing 2010-08-25 14:33:09 +00:00

README.txt

This file contains invisible Unicode characters

This file contains invisible Unicode characters that are indistinguishable to humans but may be processed differently by a computer. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

Execute 01_StartAudit.bat as an administrative user. This will attempt to launch the
handler for all known file types. When this process is complete, access the open
ProcMon window and use the Save option from the File menu. Save the output to this
directory as a file named Logfile.CSV and make sure you choose the CSV file type.

Once Logfile.CSV has been created, execute 02_Analyze.bat as an administrative user.
This will attempt to validate each result and generate a list of proof-of-concepts
within the Exploit subdirectory. For the best results, manually review the ProcMon
logs to ensure that various corner cases and other related vulnerabilities are not
missed. 

Have fun!

-HD <hdm[at]metasploit.com>