identify the IP of the .exe payload

[samer]

hi every one
if we create a .exe payload (for example ...meterepreter/reverse_tcp... with LHOST=192.168.10.10...)
with a output file in .exe format (suppose reverse.exe)

their is any tool that can identify the IP address and the port number that is present in reverse.exe (in this case 192.168.0.10.10)

WITHOUT executing it ,and type netstat in the command prompt and see at witch port and ip we are connected ???
thanks

[KMDave]

You could also use a firewall on the machine, start it and see which IP it tries to connect to.

Besides that you could try a hex editor and look for the pattern. Create an executable file with an address you know and look for it. Might work, haven't tried it out yet.

[Andy90]

I presume the IP wouldn't be stored in the same way as variable strings? (ie the strings command?)

[hawaii67]

A hex editor will not show anything like an IP address.
You'll have to reverse the exe e.g. with IDA Pro

[thorin]

Open the exe in a text editor that support RegEx and search for a IP pattern.

Copy the exe to a *nix machine and use strings or grep on it.

Edit: BAH....I missed the no execution part...however, I'm still leaving this in case someone needs the info in the future.
Do a netstat -ab on the box it's running on to identify which executable is connected to which systems outside. (Note: netstat -ab is slow, but it'll work).

[imported_blackfoot]

Yes, separate out the part of the header containing the ip addresses and convert from network encoding to see the information you need. The ip address will be in octets as you know.

Use inet_ntoa

If you are simply printing rather than storing you can print it directly as a string

(Late edit: Apols if I misinterpreted...my solution is coming over the network...maybe the query relates to compiled code within the exe in which case you will need to reverse engineer)

[m-1-k-3]

hi every one
if we create a .exe payload (for example ...meterepreter/reverse_tcp... with LHOST=192.168.10.10...)
with a output file in .exe format (suppose reverse.exe)

their is any tool that can identify the IP address and the port number that is present in reverse.exe (in this case 192.168.0.10.10)

WITHOUT executing it ,and type netstat in the command prompt and see at witch port and ip we are connected ???
thanks

http://cwsandbox.org/?page=submit

not sure but try it ...

m-1-k-3

[xorred]

using the cwsandbox for that job is irresponsible, as you will be overloading their servers with such requests, at the same time when all kind of valid ones are sent to them... if you're going to use a sandbox to see the IP, why not just see the connection it makes in wireshark, or netstat? Or the firewall, or whatever? Why creating a whole new virtual environment at the sandbox site for the purpose?

[m-1-k-3]

using the cwsandbox for that job is irresponsible, as you will be overloading their servers with such requests, at the same time when all kind of valid ones are sent to them... if you're going to use a sandbox to see the IP, why not just see the connection it makes in wireshark, or netstat? Or the firewall, or whatever? Why creating a whole new virtual environment at the sandbox site for the purpose?

just upload the file and they will analyse it for you! what are you talking about?

m-1-k-3

[Ghost40]

We could use wireshark or the likes, but he mentioned, without running the exe. I would use IDA to reverse it.