Analysis of captured network traffic (PCAP) revealed unauthorized lateral movement between two internal hosts. An attacker operating from 192.168.1.101 used SMB to connect to 192.168.1.104 (DESKTOP-CEO), enumerate network shares, access sensitive files, and ultimately deploy a malicious executable disguised as a legitimate Google binary using PsExec. The attacker leveraged compromised credentials belonging to user kporter and abused Windows named pipes to interact with internal services for remote code execution.
The attacker established an SMB session to DESKTOP-CEO and connected to the IPC$ share to access the srvsvc named pipe, which was used to enumerate available network shares. Through this enumeration, the attacker discovered a share named Clients and accessed files within a Paid directory, reading documents including Orbis.txt and Maple.txt.
Following the reconnaissance phase, the attacker authenticated as user kporter using NTLMSSP authentication and connected to the ADMIN$ share on DESKTOP-CEO. A file named googleupdate.exe was uploaded to the ADMIN$ share , a payload deliberately named to mimic legitimate Google software. PsExec artifacts were also observed, including the creation of a PSEXEC-DESKTOP-SALES-EAD2ADE0.key file, confirming the use of PsExec for remote execution.
The attacker then opened the svcctl named pipe through IPC$ to communicate with the Service Control Manager, creating a Windows service to execute the dropped payload on the target machine.
Who:
What:
When: