Windows Server RemCom Tool Remote Shell

RemCom is a small (10KB UPX packed) remote shell/telnet replacement that lets you execute processes on remote windows systems, copy files on remote systems, process their output, and stream it back. It allows execution of remote shell commands directly with full interactive console without having to install any client software. On local machines, it is also able to impersonate so it can be used as a silent replacement for runas command.

Exploitation

Stages

1. The attacker compromises a Windows system and gains a foothold.
2. The attacker transfers the RemCom tool to the compromised system.
3. The attacker uses the RemCom tool to move laterally using compromised credentials.

Prerequisites

The attacker compromises the Windows server and gains administrator credentials for the target system.

Alert Logic Coverage

Alert Logic® has evaluated its customer base for exposure to the exploit and has developed signatures for mitigating the threat depending on the security service in place.

The Network-Based Intrusion Detection System (IDS) has been updated with the new signatures for this exploit when detected via Alert Logic Threat Manager™. If this signature is detected, an incident is generated in the Alert Logic console.

Detection of this threat is provided via the Alert Logic ActiveWatch for Log Manager™ service. Log messages are produced by the vulnerable system when an exploit of this type is leveraged. An incident will be generated in the Alert Logic console if these log messages are observed.

Recommendations for Mitigation

The attacker must have exploited some other entry vector to gain access to the local victim host. Ensure that all software on internet-facing hosts is up-to-date.