Hacker’s Strategies Revealed WEST CHESTER UNIVERSITY Computer Science Department Yuchen Zhou March 22, 2002

Requirements: Hardware: -Two computers -One hub -Internet access Software: - Windows 98/2000 -Trojan horse (Glacier 6.0) -Sniffer ( password monitor) -Port scanner (Fluxay IV)

Case 1: Trojan Horse: Suppose a Trojan horse (server.exe) was installed on computer A already. One can execute a control program(client.exe) on computer B to control computer A.

Planting a Trojan Horse Direct execution of a Trojan horse Sent as an attachment Link an icon (as a “bait”) to a Trojan Horse Guess password of a user and then use remote execution

Hacking Remotely Run a client program to control the compromised system remotely

Searching... port delay time domain begin from to Victim found

All folders and files in computer A. We can copy, rename, run or delete them remotely. All folders and files in computer A. We can copy, rename, run or delete them remotely.

Computer A’s basic information System information of computer A. System information of computer A. Password related commands Control related commands Network related commands

All the passwords in computer A's cache. Password in cache

Monitoring computer A’s screen

Controlling Computer A’s screen

Other operations you can use to control computer A Find/copy/delete files from computer A Share a directory Kill a process Change the registry Record the keyboard Shut/restart the computer

All commands we can use

Case 2: Sniff a Password If computer A transmits some data frames to a server machine D via an Ethernet, every computer will receive a copy. Only computer D should accept it; others should discard the data frames. However, a sniffer running on machine B or C receives it and analyzes it even B or C is not the destination.

The URL computer A visiting user name password Computer A’s IP address log on time monitoring NIC When the password was detected, it will display here. When the password was detected, it will display here.

This file’s name is “webfilter.txt”, “pwmonitor” need this file to identify the URLs. That is to say, only when the URL computer A visiting is in this filter file can the passwords be sniffed. Because this sniffer is created in China, most of the URLs located in China, but we can find yahoo.com here. This file’s name is “webfilter.txt”, “pwmonitor” need this file to identify the URLs. That is to say, only when the URL computer A visiting is in this filter file can the passwords be sniffed. Because this sniffer is created in China, most of the URLs located in China, but we can find yahoo.com here.

Case 3: Hack a Server Computer A is a server, B is a client Scans the ports of computer A Guesses the password of admin. After the computer is compromised, a hacker can plant some backdoor software to the server and execute it remotely.

Hosts’ type usernamepasswordhosts Flaxuy is the most popular ports scanner used in China these days. It scans all services (ports) of the servers provide, once it finds a certain service (FTP, telnet...), it will try to find the users and guess the passwords... Flaxuy is the most popular ports scanner used in China these days. It scans all services (ports) of the servers provide, once it finds a certain service (FTP, telnet...), it will try to find the users and guess the passwords...

Scan from to Host type Guess password Display password if get

Scanning...

Now we get the password.

Computer ’s Administrator is “TopTooler”, the password is “toptooler”, we can establish a IPC connection. Computer ’s Administrator is “TopTooler”, the password is “toptooler”, we can establish a IPC connection. password

Using this command, we can log on to the server as an administrator. Using this command, we can log on to the server as an administrator. Then copy a Trojan horse to a server Then copy a Trojan horse to a server

The Trojan horse will be started automatically at 13:50p.m. on the server. The Trojan horse will be started automatically at 13:50p.m. on the server.