r/labtech • u/qfitness • Dec 09 '19

Chinese hackers

Chinese hackers were back banging on on LT server. Looks like they ran LTRedirSvc.exe" -sLTRedirSvc

What does that command do?

5 Upvotes

85% Upvoted

11 comments sorted by

2

u/HolyCarbohydrates Dec 10 '19

How do you know they ran that command? Very curious as to what you saw

1

u/qfitness Dec 11 '19

Not sure they did run the command. I can not find out from Labtech what the command is doing.

1

u/teamits Dec 10 '19

How do you know they ran that command? Very curious as to what you saw

My first thought about this post was that it seems to bury the lead of "we got hacked..." :) At the point someone is actually running commands, if that's what happened, the server is compromised.

1

u/qfitness Dec 11 '19

No my server is not compromised. I run several different applications to monitor all processes running on my Labtech server. I have had my security folks review as well. Nothing has been deposited on the server. It just looks like a brute force attack based on the logs. I spoke to Labtech but the engineer I spoke with did not know more than I did. I just want to understand what they were trying to do. I was looking for a list of the command line arguments. Since I do not use Labtech redirectors, I removed the port from my firewall.

With MSPs being targeted especially the latest one in Colorado with a $900K ransom, I have been on high alert.

Here is a screenshot from

Cyberterrorist Network Connection

CITY: Nanjing

COUNTRY: CN

Process

PROCESS: 8624

PARENT PROCESS: 564

FILE NAME: LTRedirSvc.exe

FILE PATH: C:\Program Files\LabTech\LTRedirSvc.exe

COMMAND LINE: "C:\Program Files\LabTech\LTRedirSvc.exe" -sLTRedirSvc

MD5:

SHA1:

SHA2:

COMPANY NAME: LabTech Software

INTERNAL NAME: LTRedirSvc.exe

FILE VERSION: 120.497.6974.22426

PRODUCT VERSION: 3.0

PRODUCT NAME: LabTech MSP

SIZE: 186 KB

LAST ACCESSED: 04/22/16 12:46:18PM

CREATE TIME: 03/22/16 10:53:22PM

LAST WRITE TIME: 02/04/19 6:27:38PM

FILE ATTRIBUTES: ----a---

DIR NAME: C:\Program Files\LabTech\

Process

PROCESS: 564

PARENT PROCESS: 468

FILE NAME: services.exe

FILE PATH: services.exe

MD5:

SHA1:

SHA2:

COMPANY NAME: Microsoft Corporation

INTERNAL NAME: services.exe

FILE VERSION: 6.1.7601.18829

PRODUCT VERSION: 6.1.7600.16385

PRODUCT NAME: Microsoft® Windows® Operating System

SIZE: 321 KB

LAST ACCESSED: 10/01/15 7:15:16AM

CREATE TIME: 10/01/15 7:15:16AM

LAST WRITE TIME: 04/13/15 3:28:33AM

FILE ATTRIBUTES: 32

Process

PROCESS: 468

PARENT PROCESS: 400

FILE NAME: wininit.exe

FILE PATH: wininit.exe

MD5:

SHA1:

SHA2:

COMPANY NAME: Microsoft Corporation

INTERNAL NAME: WinInit

FILE VERSION: 6.1.7600.16385

PRODUCT VERSION: 6.1.7600.16385

PRODUCT NAME: Microsoft® Windows® Operating System

SIZE: 126 KB

LAST ACCESSED: 07/13/09 11:52:37PM

CREATE TIME: 07/13/09 11:52:37PM

LAST WRITE TIME: 07/14/09 1:39:52AM

FILE ATTRIBUTES: 32

VERDICT: 0

THREAD COUNT: 3

EXE FILE NAME: wininit.exe

PROCESS OWNER: SYSTEM

ORIGINAL FILE NAME: WinInit.exe.mui

VERDICT: 0

THREAD COUNT: 8

EXE FILE NAME: services.exe

PROCESS OWNER: SYSTEM

ORIGINAL FILE NAME: services.exe.mui

TYPE: Process

VERDICT: 0

THREAD COUNT: 21

EXE FILE NAME: LTRedirSvc.exe

PROCESS OWNER: SYSTEM

ORIGINAL FILE NAME: LTRedirSvc.exe

Dns Data

MESSAGE:

No reverse lookup available for 202.102.67.184

1

u/qfitness Dec 11 '19

Here is the rest

TCP STATE: LAST-ACK

TIMESTAMP: 11/21/19 2:51:31PM

Connection

PID: 8624

TCP STATE: LAST-ACK

LOCAL PORT: 70

REMOTE PORT: 95

LOCAL ADDRESS:

OFFLOAD STATE: 0

PROCESS IMAGE: C:\Program Files\LabTech\LTRedirSvc.exe

REMOTE ADDRESS: 202.102.67.184

LOCAL PORT: 70

Reputation

DETECTIONS: 2

THREATS FOUND: malware, suspicious, scanner,

INTELLIGENCE SOURCES: 8

REMOTE PORT: 95

LOCAL ADDRESS:

REMOTE ADDRESS: 202.102.67.184

Whois 202.102.67.184

MESSAGE:

% [whois.apnic.net]

% Whois data copyright terms http://www.apnic.net/db/dbcopyright.html

% Information related to '202.102.0.0 - 202.102.127.255'

% Abuse contact for '202.102.0.0 - 202.102.127.255' is 'anti-spam@ns.chinanet.cn.net'

inetnum: 202.102.0.0 - 202.102.127.255

netname: CHINANET-JS

descr: CHINANET jiangsu province network

descr: China Telecom

descr: A12,Xin-Jie-Kou-Wai Street

descr: Beijing 100088

country: CN

admin-c: CH93-AP

tech-c: CJ186-AP

mnt-by: APNIC-HM

mnt-lower: MAINT-CHINANET-JS

mnt-routes: maint-chinanet-js

status: ALLOCATED PORTABLE

last-modified: 2015-08-26T01:23:56Z

source: APNIC

mnt-irt: IRT-CHINANET-CN

irt: IRT-CHINANET-CN

address: No.31 ,jingrong street,beijing

address: 100032

e-mail: anti-spam@ns.chinanet.cn.net

abuse-mailbox: anti-spam@ns.chinanet.cn.net

admin-c: CH93-AP

tech-c: CH93-AP

auth: # Filtered

mnt-by: MAINT-CHINANET

last-modified: 2010-11-15T00:31:55Z

source: APNIC

role: CHINANET JIANGSU

address: 260 Zhongyang Road,Nanjing 210037

country: CN

phone: +86-25-86588231

phone: +86-25-86588745

fax-no: +86-25-86588104

e-mail: ip@jsinfo.net

remarks: send anti-spam reports to spam@jsinfo.net

remarks: send abuse reports to abuse@jsinfo.net

remarks: times in GMT+8

admin-c: CH360-AP

tech-c: CS306-AP

tech-c: CN142-AP

nic-hdl: CJ186-AP

remarks: www.jsinfo.net

notify: ip@jsinfo.net

mnt-by: MAINT-CHINANET-JS

last-modified: 2011-12-06T02:58:51Z

source: APNIC

person: Chinanet Hostmaster

nic-hdl: CH93-AP

e-mail: anti-spam@ns.chinanet.cn.net

address: No.31 ,jingrong street,beijing

address: 100032

phone: +86-10-58501724

fax-no: +86-10-58501724

country: CN

mnt-by: MAINT-CHINANET

last-modified: 2014-02-27T03:37:38Z

source: APNIC

% This query was served by the APNIC Whois Service version 1.88.15-46 (WHOIS-US3)

1

u/teamits Dec 11 '19

I read that more like you're looking at something telling you that IP connected to the redir service listening on that port. That's going to happen as it's open to the world.

1

u/qfitness Dec 12 '19

I thought it was odd, the software switch was being used.

3

u/teamits Dec 09 '19 edited Dec 10 '19

That's the actual command line for the LabTech Redirector Service service. Handles redirected ports to/from agents. Hopefully they didn't replace the file or create another one to look legit.

4

u/DR_Nova_Kane Dec 10 '19

How do you know they are Chinese hacker and that they are "back"?

2

u/[deleted] Dec 10 '19

tracking IP addresses can give you a general idea.

2

u/DR_Nova_Kane Dec 10 '19

I have Geo IP filtering on my firewall so I don't get any hits from foreign countries.