I was recently made aware by an infosec colleague of mine DMFH (aka Donny Harris) about an M$ utility called the Problem Step Recorder, aka psr.exe. It comes standard on Windows 7 machines. In a nutshell it’s used to provide a step-by-step breakdown of user activity to provide to tech support after a user has re-created a problem, complete with screen captures! NOTE: it does NOT capture keystrokes. So, thankfully M$ did not embed a keylogger into Windows 7. It shows a script of sorts of user’s activity in windows, info about PIDs, what mouse buttons are clicked and different hooks and internal system calls. What got me was the screen captures… I know there are metasploit modules (screenspy and screenshot) and AutoIT apps, and that every keylogger on earth has a screencap ability. DMFH made a good point tho: psr.exe would not be caught by most AV’s being that it is a signed and trusted system utility. And, if a user sees psr.exe in their taskmgr and google it, they’ll see its an M$ troubleshooting tool, so they may be less concerned with it.
I realize that if you’re on a box and can run psr.exe you’ve already owned it, or are close to doing so; this is not the next l33t h@x0r attack, but another tool in your arsenal. One use case could be you have shell access to machine (no meterpreter) and you can’t figure out a way to get tools onto the box for some reason. If it’s a Windows 7 (didn’t find it on server 2k8 r2) you can grab screencaps and save them somewhere you can hopefully access. Also, to reiterate my point, it’s an M$ utility so you don’t have to bring in another app that could trigger AV.
Below are a few pictures showing what the web archive (.mht) file contained.
Here are the commands to run psr.exe from the cli. I did try it from a shell gained via metasploit and it worked like a champ. The key is migrate (if you’re not already running as them) into a PID of a user to capture that users’ session.
psr.exe /start /output c:Usersusernametest.zip /sc 1 /gui 0
You need to issue (or schedule task) the below command to stop psr.exe from runningrecording.
Here’s a blog post I found that details some of the switches of psr.exe.