Download Netsupport Manager 12 Crack
Iberico Dillard
Once the main NetSupport Manager executable (presentationhost.exe) is started, it beacons to the domain geo.netsupportsoftware[.]com to retrieve geolocation of the host followed by an HTTP POST to [.]182/fakeurl.htm
For this part of the post I obtained a network traffic PCAP file from the Tria.ge behavioral report for this sample: -3et5gaeg4y/behavioral2. The network traffic for NetSupport manager is pretty easy to spot with the right telemetry and rules. From this network traffic, multiple Suricata alerts fired:
So using the NetSupport scripting engine I was able to find the versions of the software running on the hundreds of hosts on the network and target those that may be vulnerable. More notable were the number of hosts running with no authentication required. Of course the power of this application can allow anyone to compromise hosts easily allowing for remote commands, file uploads and total control of the clients on the network. Therefore due care and attention should be applied when running it on your corporate network and at the very least ensure that all clients require a strong password before the manager can connect.
It was a bit surprising there isn't more free testing tools out there for this service. There are public exploits available and the natural follow up to this would involve writing my own test script without the need to use the NetSupport Manager to run the script. I couldn't find any reference to the NetSupport Manager packet format. I did perform some quick protocol analysis on port 5405 between a manager and client and wrote a quick nmap script to output the response from the client when sending it a query (captured with Wireshark) from a manager which worked in the test environment but didn't work in the customer environment. I'll carry out further testing and post it in my next blog update.
So, we start with finding out what NetSupport Manager Gateway actually is; a piece of software that allows remote administration and access to hosts from a centralised manager. The Gateway aspect is a single interface to ease paths through firewalls. In other words, the key to me getting inside your network!
0aad45d008