Changing file attributes using timestomp

In the previous recipe, we read about some of the important and useful meterpreter file system commands that can be used to perform various tasks on the target machine. Meterpreter contains another interesting command called timestomp. This command is used to change the Modified-Accessed-Created-Entry (MACE) attributes of a file. The attribute value is the date and time when any of the MACE activities occurred with the file. Using the timestomp command, we can change these values.

Getting ready

Before starting with the recipe, there is a question that may strike in your mind. Why change the MACE values? Hackers generally use the technique of changing the MACE values so as to make the target user feel that the file has been present on the system for long and that it has not been touched or modified. In case of suspicious activity, the administrators may check for recently modified files to find out if any of the files have been modified or accessed....