MaxFocus Remote Wipe required. (Urgent)

[OaksLabs]

I ROFL at that last part! ^^^^

Well it will automatically start doing this:

 

[bertie40]

I saw the following.

http://www.fixitscripts.com/problems/simple-download-and-install-silent-exe

So, by plugging in the location of that prog, and linking it to a startup event, when that scumbag fires up the machine, it will wipe it.

Can a tracert or some other location finder command be included.

Sorry,.....scripting just aint ma thang

 

[Slaters Kustum Machines]

Here is the same tool without the warnings (no user interaction required with this one): http://www.oakslabs.com/OPD2.exe

But for the love of God don't double click on it!!

So, turns out he's not kidding........














Threw it on a Win 7 VM to see what happens. Once the CMD window closed I opened task manager and launched explorer and the typical user data storage locations are gone! Then if you reboot the machine is no longer bootable. Pretty cool tool........hmm............

 

[OaksLabs]

So, turns out he's not kidding........
Threw it on a Win 7 VM to see what happens. Once the CMD window closed I opened task manager and launched explorer and the typical user data storage locations are gone! Then if you reboot the machine is no longer bootable. Pretty cool tool........hmm............

Yes -- which is why I felt the need to put a warning with it. I designed this tool for a quick PC wipe before disposal, and the regular version makes you acknowledge two warnings that everything is about to be wiped.

I do have some ethical reservations about this tool because it is so destructive, but it is a non-secure delete and in theory a file undelete tool can recover the data -- but you'd have to sift through a lot of other files. I haven't tried this, but at the very least PhotoRec could get the data.

 

[Slaters Kustum Machines]

Yes -- which is why I felt the need to put a warning with it. I designed this tool for a quick PC wipe before disposal, and the regular version makes you acknowledge two warnings that everything is about to be wiped.

I do have some ethical reservations about this tool because it is so destructive, but it is a non-secure delete and in theory a file undelete tool can recover the data -- but you'd have to sift through a lot of other files. I haven't tried this, but at the very least PhotoRec could get the data.

It's like the fully automated active@killdisk bootable disk that boots straight to data destruction with no warning whatsoever.

 

[OaksLabs]

I saw the following.

http://www.fixitscripts.com/problems/simple-download-and-install-silent-exe

So, by plugging in the location of that prog, and linking it to a startup event, when that scumbag fires up the machine, it will wipe it.

Can a tracert or some other location finder command be included.

Sorry,.....scripting just aint ma thang

If you can put OPD2.exe in the startup folder of the PC and a batch file with :

shutdown /r /t 0

that should be enough to nuke the PC.

For the tracert information, I'd do something like this (batch file):

REM Save tracert infomation to file in C: drive
tracert 8.8.8.8 >c:\tracert.txt

REM Open FTP Firewall port
netsh firewall add allowedprogram program=C:\Windows\System32\ftp.exe "FTP" ENABLE

REM Make a script file to auto-FTP the tracert file

REM FTP Server
echo open ftp.oakslabs.com> c:\temp.txt

REM Username
echo public_ftp>> c:\temp.txt

REM Password
echo *************>> c:\temp.txt

REM File
echo send C:\tracert.txt>> c:\temp.txt

echo quit>> c:\temp.txt


REM Run FTP
ftp -s:c:\temp.txt

This script has my public FTP information in it -- if you can't find a FTP server to use and I see your file come in I'll send it to you.

 

[Markverhyden]

Yes -- which is why I felt the need to put a warning with it. I designed this tool for a quick PC wipe before disposal, and the regular version makes you acknowledge two warnings that everything is about to be wiped.

I do have some ethical reservations about this tool because it is so destructive, but it is a non-secure delete and in theory a file undelete tool can recover the data -- but you'd have to sift through a lot of other files. I haven't tried this, but at the very least PhotoRec could get the data.

If it does not touch the FAT then recovery would be pretty easy using any number of tools.

 

[OaksLabs]

If it does not touch the FAT then recovery would be pretty easy using any number of tools.

It is a straight file system only tool. the FAT/MFT should still be intact.

 

[Slaters Kustum Machines]

I don't suppose there's any covert way to get the mac address from that dongle, is there? Is that something that Max could find out?

If the devices have the 9.10 agent you can enable network discovery and get the MAC that way.

The assets tab should also have all available adapters and MAC's listed for the devices.

The Summary tab will give internal and external IP addresses.

 

[Markverhyden]

It is a straight file system only tool. the FAT/MFT should still be intact.

I figured it was not a anti-forensic level tool. But, never the less, many thanks for sharing it with the community. Got a copy tucked away for those odd situations.

 

[TAPtech]

You should make every attempt to find the location of these devices to aid the police in catching the crooks!

 

[bertie40]

I appreciate it may be able to retrieve the data, but nevertheless, this is a significant step forward for us.

If nothing else to comfort the owners a bit.

Now all I need is some way to trigger the webcam and ftp the photos back.
[emoji48]

 

[bertie40]

I getting "installation package could not be opened, verify package exists etc".
I've come across this before but cant remember how i got around it.

some msiexec command switch ?

Edit: solved

 

[FremontPC]

Now all I need is some way to trigger the webcam and ftp the photos back.

A story of one victim that used GFI and Prey Project for this:

https://alanhardisty.wordpress.com/...t-a-dash-of-cunning-and-a-little-bit-of-luck/

 

[FremontPC]

Maxfocus and Prey Project mentioned here:

http://forums.maxfocus.com/Stolen-notebook-Can-Max-be-any-help-m900805831.aspx

 

[Slaters Kustum Machines]

I getting "installation package could not be opened, verify package exists etc".
I've come across this before but cant remember how i got around it.

some msiexec command switch ?

Edit: solved

What was the fix?

 

[Slaters Kustum Machines]

Run this script from GFI Script Check and pass the Prey API key as the only parameter. This is for the latest (at the time) 64bit version. It should work unless the hosting changes as they seem to keep all prior versions.

@echo off
bitsadmin /transfer myDownloadJob /download /priority high https://s3.amazonaws.com/prey-releases/node-client/1.3.9/prey-windows-1.3.9-x64.msi c:\Support\prey-windows-1.3.9-x64.msi
c:
cd c:\Support
msiexec.exe /i prey-windows-1.3.9-x64.msi /lv installer.log /q AGREETOLICENSE=yes API_KEY=%1 INSTALLDIR="c:\Prey"

 

[Markverhyden]

What happens when someone steals a hackers computer. One of my favorites.

 

[OaksLabs]

Any updates? With OPD.exe, it is a silent destroy with no confirmations, but have any other of the laptops been turned on/connected to the internet?

 

[bertie40]

Nope. I've created the script and set it to install and run.

I've only seen one machine come online.

It wasn't just my customer which got robbed. They rampaged through the entire building, breaking into all the other offices and nicking stuff

Weirdly, they ignored several laptops in the office, and, thankfully, didn't look in the hallway cabinet where the NAS was.

It would be nice to track them down, but the higher priority is to scrub the data.

Did this company have insurance cover for this ?
No.

This didn't appear to be the work of kids.

They had to traverse several roofs, climb a wall and remove a metal grating covering one of the windows.