Windows Gather Local NBD Server
Maps remote disks and logical volumes to a local Network Block Device server. Allows for forensic tools to be executed on the remote disk directly.
Rank
- Normal
Authors
- Wesley McGrew < wesley [at] mcgrewsecurity.com >
Development
Similar Modules
- post/windows/gather/forensics/duqu_check
- post/windows/gather/forensics/enum_drives
- post/windows/gather/forensics/imager
Usage Information
$ msfconsole
## ### ## ##
## ## #### ###### #### ##### ##### ## #### ######
####### ## ## ## ## ## ## ## ## ## ## ### ##
####### ###### ## ##### #### ## ## ## ## ## ## ##
## # ## ## ## ## ## ## ##### ## ## ## ## ##
## ## #### ### ##### ##### ## #### #### #### ###
##
msf > use post/windows/gather/forensics/nbd_server
msf post(nbd_server) > set DEVICE [STRING]
msf post(nbd_server) > set SESSION [INTEGER]
## ### ## ##
## ## #### ###### #### ##### ##### ## #### ######
####### ## ## ## ## ## ## ## ## ## ## ### ##
####### ###### ## ##### #### ## ## ## ## ## ## ##
## # ## ## ## ## ## ## ##### ## ## ## ## ##
## ## #### ### ##### ##### ## #### #### #### ###
##
msf > use post/windows/gather/forensics/nbd_server
msf post(nbd_server) > set DEVICE [STRING]
msf post(nbd_server) > set SESSION [INTEGER]
Module Options
| DEVICE | Device to map (use enum_drives for possible names) |
| NBDIP | IP address for NBD server (default: 0.0.0.0) |
| NBDPORT | TCP port for NBD server (default: 10005) |
| SESSION | The session to run this module on. |
| VERBOSE | Enable detailed status messages |
| WORKSPACE | Specify the workspace for this module |