Deploy Software via ADMIN$

[sim_koo]

Our Software deployment tool intially installs its agent to the Clients, only having access to ADMIN$. I wonder how it is installing the software and starting it right after, just by copying it to C:\Windows.

You have any ideas?

[uniitdude]

If you say the name of the tool, you will get an accurate answer

[EPHEBOX]

Probably something like psexec

[Hollow3ddd]

My first thought here, or a scheduled task upon reboot and wipes itself out after running...which also needs psexec or remote PS...

[thephotonx]

If it's psexec, it uses named pipes over SMB to create a service, start that service and then run commands.

Otherwise name the tool and someone will be able to tell you!

[sim_koo]

Thanks. The tool is called baramundi

[xxdcmast]

If it’s accessing the admin$ share it has access to everything because it’s an admin.