Reply to thread

Message

<blockquote data-quote="Victor M" data-source="post: 1058713" data-attributes="member: 96560">I have read ( <a href="https://doubleoctopus.com/security-wiki/threats-and-tools/meterpreter/" target="_blank">What is Meterpreter ? - Security Wiki</a> ) that meterpreter is a payload which follows on in a exploit. I have tested it many moons ago. And it doesn&#039;t require user interaction.Yes, the red team has penetrated MalwareBytes Anti-exploit potection of apps mentioned in firewall rules. But since I am testing OpenEDR, it comes with Comodo Internet Security, which has Auto Containment. And all unknown exe&#039;s and some rarely used Windows exe&#039;s like attrib.exe, route.exe and conhost.exe are contained. I have not read that these 3 are LoL bin&#039;s, but they may be new undocumented ones. So, with Auto Containment, I am probably safe guarded from them trying to gain persistence. However, my guess is that they are using some reverse shell, and they can still copy documents and delete files without anything hampering them.&nbsp; And even without gaining persistence, they can re-exploit the firewall apps anytime to gain re-entry. OpenEDR also has Data Loss Prevention, but I haven&#039;t gotten to that feature yet.</blockquote>

[QUOTE="Victor M, post: 1058713, member: 96560"] I have read ( [URL='https://doubleoctopus.com/security-wiki/threats-and-tools/meterpreter/']What is Meterpreter ? - Security Wiki[/URL] ) that meterpreter is a payload which follows on in a exploit. I have tested it many moons ago. And it doesn't require user interaction. Yes, the red team has penetrated MalwareBytes Anti-exploit potection of apps mentioned in firewall rules. But since I am testing OpenEDR, it comes with Comodo Internet Security, which has Auto Containment. And all unknown exe's and some rarely used Windows exe's like attrib.exe, route.exe and conhost.exe are contained. I have not read that these 3 are LoL bin's, but they may be new undocumented ones. So, with Auto Containment, I am probably safe guarded from them trying to gain persistence. However, my guess is that they are using some reverse shell, and they can still copy documents and delete files without anything hampering them. And even without gaining persistence, they can re-exploit the firewall apps anytime to gain re-entry. OpenEDR also has Data Loss Prevention, but I haven't gotten to that feature yet. [/QUOTE]

Verification