Information Systems Auditing

During an audit I had to determine whether a particular remote control service was installed on the Domain workstations and servers. It was determined during the interview process that no remote control software was in use.  I decided to obtain the evidence to the contrary.  I had already compromised a Domain Administrator account so I had the appropriate permissions.

Get a list of servers and workstations.
C:\>net view /domain
C:\>net view /domain:<domain_name> >> host_list.txt

The host_list.txt will need to be edited as descriptions of the workstations and servers will show up to the right of the host name. You can quickly edit it in Excel (text to columns). Of course if this was Linux and /or you had awk you could pipe it and choose the first column (| awk ‘{print $1}’)

The command we will be using to query remote services is called Service Control (sc) from the Windows Resource Kit.  For more information on the command see this site.

C:\>for /f %i in (host_list.txt) do @echo %i >> results.txt && sc %i query <Service_Name>

In addition to the service results I would like to have the fully qualified domain name and ip address of the server or workstation I am querying.  A quick addition of the nslookup command you and you get this:

C:\>for /f %i in (host_list.txt) do @nslookup %i >> results.txt && sc %i query <Service_Name> >> results.txt

Finally, I would like to know, with reasonable assurance, the user of that workstation.  For that we will be using a command line tool from the pstools tool kit called psloggedin.  Once that tool is installed on your auditor workstation/laptop you can add it to our command.

C:\>for /f %i in (host_list.txt) do @nslookup %i >> results.txt && sc %i query <Service_Name >> results.txt && psloggedin -l -x %i >> results.txt

I wrote a quick script to parse the output of the above command so it can be sorted and analyzed in your preferred spreadsheet application.

#!/usr/bin/perl

$numArgs = $#ARGV +1;
if($numArgs < 1){
  print "Invalid Number of Arguments\n";
  print "serviceparse.pl \n\n";
  exit;
}

#open the file
$infile = "$ARGV[0]";
open(DAT, $infile) || die("Something did not work.  You figure it out.");

#save file contents into an array
@raw_data=;
close(DAT);

#Cycle through the entire array
for($count=0;$count<=$#raw_data;$count++){

  #get fully qualified domain name
  if(@raw_data[$count] =~ /Name:/){
    @array = split(/:/, @raw_data[$count]);
    $host = @array[1];
    $host =~ s/^s+//;
    $host =~ s/s+$//;

    #get ip address
    @array = split(/:/, @raw_data[$count+1]);
    $ip = @array[1];
    $ip =~ s/^s+//;
    $ip =~ s/s+$//;

    $service = "";
    $user = "";
    for($c=$count+1;$c<=$#raw_data;$c++){

      if(@raw_data[$c] =~ /RUNNING/){
        $service = "Installed and Running";
      }
      if(@raw_data[$c] =~ /STOPPED/){
        $service = "Installed and Stopped";
      }
      if(@raw_data[$c] =~ /FAILED 1722/){
        $service = @raw_data[$c+2];
        $service =~ s/^s+//;
        $service =~ s/s+$//;
      }
      if(@raw_data[$c] =~ /FAILED 1060/){
        $service = @raw_data[$c+2];
        $service =~ s/^s+//;
        $service =~ s/s+$//;
      }

      if(@raw_data[$c] =~ /locally:/){
        @array = split(//, @raw_data[$c+3]);
        $user = @array[1];
        $user =~ s/^s+//;
        $user =~ s/s+$//;
      }else {if(@raw_data[$c] =~ /Error opening HKEY_USERS/){$user = "";}}

      if(@raw_data[$c] =~ /Server:/){print "$host,$ip,$service,$user\n";last;}
    }
  }
}

Run this script from the command line and pipe it to save the output.

$perl serviceparse.pl results.txt > parseresults.csv