botnets by john kristoff

32

Upload: dhruv-jain

Post on 28-Mar-2015

71 views

Category:

Documents


4 download

DESCRIPTION

Uploaded by Hack Archives - http://undergroundlegacy.co.cc -

TRANSCRIPT

Page 1: Botnets by John Kristoff

� � � �� �� ��� � �� ��� �� � ��� �� � �� �� � � � ��� � � � �� �

� � ���

"! #%$ & '"( )! * *

+ ) , $ ! & ) # -( ) - &$ . - /10

# ) )32 4 5 5"6 # 6 &2 .' ) )$ ( . $ ! & ) # -( ) - &$ . - /10

7 8 9 : ; :=< > 9 : 9

! & ) # -( ) - &$ $ '@? - &( ' )BA

? 6 $ ( )! $ CDE ;F G F 9

Page 2: Botnets by John Kristoff

� � � �� �� ��� � �� ��� �� � ��� �� � �� �� � � � ��� � � � �� �

� � � ��� !#" $ � % �

� & ' " ( $ � � � ) ) ( �*

� +, -

� .0/ $ 1 ( �* / � ! 2 ) 3 *

� � 4 ( � $ �* % ! ( � / � % �*

Page 3: Botnets by John Kristoff

� � � �� �� ��� � �� ��� �� � ��� �� � �� �� � � � ��� � � � �� �

� � � � � � �

� � "! # "$ % � &(' )+* ! # , )+- .$ # .! - / #0 . 1 # 2* ! .43 # * 0

� 5* 6 - 7 8- 0 7 6 . 7 2 1 * . 7 0 7 0 9 7! ,: )+- .

� ;0 * $ ! #$ . 1 - ! .! ! 20 # * , < * =?> * 0 # 8* 0 * $ , > , #

� = * 2 .- 2! @ A * 8 #! @ , - 0 <! @ , * =' B 2 @ CD !

� ; 1 # 2* A E # . 2- . #$ . * = ! ! A * 0 3

� & * $ $ # .> - 0 E - 2 #0 * .- 0 ! 1 # = 2 , # * = > . 1 . 1 ! F

Page 4: Botnets by John Kristoff

� � � �� �� ��� � �� ��� �� � ��� �� � �� �� � � � ��� � � � �� �

� � � �

� � � !" # $&% # !' # ! (*) + ,- #) .) /0 # .) 1

� 2 � , + � % # ! ! # � % # ! ! � � , � � , % # � . # 3 /% 4% 1&5

� % # ! ! # � 3 " 67 8:9 0 �) + ,

� ;- + 0 # .5

� ) + < � � . % # , +>= +? ' 3 # ( . � � , � . . �% @ . # # 3 )

� ;- + ' A ' #) +5

� B # C= ( , .- + $ .= @ +" 3 #D D + ) = ' - ( ) - ( � D = ) ' � !

� $ # $ A � � � , EF G HIKJ

Page 5: Botnets by John Kristoff

� � � �� �� ��� � �� ��� �� � ��� �� � �� �� � � � ��� � � � �� �

� � � � � �

� ! "$# % & ')( %* + ( * & ,.- / % &�0 1 , '32 / 4

� ( % / ( 0 + ( 0 / 56 7 * / 08 / 0 *

� 9/ , ,: % ( 9 % ;< = % 1 + / *

� 8 1 % ' &- 9/ >@? 1A / * "( 0 + 1 , 9 1 0 / # ? 4 1 &/ *

� < ( & B ' % A 0 / 1 , ,.- % / 9

� 7C 6 D E* &( >/ 0 FG G H D0 / % 4@* ' % ;( = ? 1? / 0

Page 6: Botnets by John Kristoff

� � � �� �� ��� � �� ��� �� � ��� �� � �� �� � � � ��� � � � �� �

� ��� ! "# $&% ! ' ( '

� )�* " # "# $+ ,- . � ( '

� )/ 0 1 2 3 ! 4! 3 "5 ! 6� 7 8! ! # " . . 6 . ( 9! :

� ; 7 . . 4! � '! . 6 * � # ' 4� . .&! $ * � "# $ '� � .< ( '

� !>= % =

3 ' '-? @ @A " 6B " 9� � .= * � @* � "# $ ,=

3 ' .

� C � '! ? 8 4 7 '! 9� 4* ! " # $ , # ( 9 9 ( # % " ' ' "* < , ( # * 4! " , ( # %

Page 7: Botnets by John Kristoff

� � � �� �� ��� � �� ��� �� � ��� �� � �� �� � � � ��� � � � �� �

� �

� � � ! " #$ %'& (*) +� , - . ! . / ) ! . #0

1 2 . + $3 4 ! . 0 / 5 # - - ) 0 , ) 0 , 5 #0 !$ # 6 . 0 7$ ) + !$3 5 !3 $ �

Page 8: Botnets by John Kristoff

� � � �� �� ��� � �� ��� �� � ��� �� � �� �� � � � ��� � � � �� �

� � �

1 � � ! "$# %& # ' (�) * !+ ', � ) * !- .0/ + # % %# !

1 1# % % � ! " ) " * ) � 2 . , " # ' 2# # 2/43 ( '� & & , "

1 5� ) ) 6# ' " & '# (, + (, " ) , '7 , ' )

1 8 * " " , ! � ! "9 , / , " + : � ! ! , . )

1 �<; ! ! * !- # ! + # %& '# % * ) , " :# ) ( = ) >

1 & '# 2 � 2 .0/ � 2# ( ( : � ( - # (& '# %# (, "

Page 9: Botnets by John Kristoff

� � � �� �� ��� � �� ��� �� � ��� �� � �� �� � � � ��� � � � �� �

� �

1 �� ! � "# � $� %& ' (�) # � $� %& ' * $ '+ + , (� )

1 �� ! * $ '+ ( ) - ! , " " ' & + , (� )

1 . '+ # '+ / � $0 & ,1 " , 2 ' / ) ' $ " 3 ( 2 , ( - !4 5 , / / + ' $ $

1 . * $ 0 � -� ) * $ "� - 6 $87 () 0 � - $ , " / - ! , " " ' & " , 2 ' $

1 . * $ 0 � -� ) * $ 9: . " , 2 ' * $ ' / ( ) ;� " / $ '+ # '+ < $ =

1 . * $ 0 � -� ) * $ > > < $ = , $ $ ) -� , ( ' / ?� ( ! 9: . " , 2 '

1 @ ) " " ' - ( ' / ! ) $ ( $ 'A !� %� (� " $ * $0 � -� ) * $ % ' ! ,# � ) +

Page 10: Botnets by John Kristoff

� � � �� �� ��� � �� ��� �� � ��� �� � �� �� � � � ��� � � � �� ��

� � � � � � �

Welcome to irc.whitehouse.govYour host is h4x0r.0wnz.j00There are 9556 users and 9542 invisible on 1 server

5 :channels formed1 :operators onlineChannel Users Topic#help 1#oldb0ts 5 .download http://w4r3z.example.org/r00t.exe

End of /LIST

Page 11: Botnets by John Kristoff

� � � �� �� ��� � �� ��� �� � ��� �� � �� �� � � � ��� � � � �� � �

� � � !" #$ % & " ')( � * +-, . ' ' * ./ ' ( . *" 0 12 3" ' * . 4 2& 5

� 6 � ', ( 2 ' 78 . / + 4 � � * 9: ; , " *< " *, / � ! ! � &

� = % %?> , " 4 '� , " *< " 12 3" , '� / 3 2 " & ',

� @" ' 6 � A ; .& 4 $ # 4-" . 3 ( 2 ' 7 ' 7" , " B

Page 12: Botnets by John Kristoff

� � � �� �� ��� � �� ��� �� � ��� �� � �� �� � � � ��� � � � �� ��

� � � � � � �

� "! # $&% $ '( % ! ) ! *+ ! * ), ) ! - .0/ * 1 / % ' $ # *( % $ / 2

� ( 23 45 6 / 7 ) % $ *! 8 ! ) ) 8 3 9;: 8 $ 2 ! 1( - 1 / % )

� 45 6 / 7 ) ( *! < ! )% $% ( 2 % % / , 7 ) ! % % < ! ' $ )= *! ( 2 % )

� $% < ' / 2 $&% / * $ 2 #?> 1 / % ) = ( 2 1 ! ! ( ) $ 8 3 ) 7 / % % ! -

� ) 7 $ 9! ) ' ( 3 $ 2 - $ = ( % ! $ 2 = / ' $ 2 # 1 / % 2 ! %

� $ - 8 ! = / 2 2 ! = % $ / 2 ) ' ( 3 1 ! 1 / % )

� ( 2 ( 8 / # / , ) 2 $ = 9 ) $ 2 ( = < ( 2 2 ! 8 ' ( 3 1 ! 1 / % )

Page 13: Botnets by John Kristoff

� � � �� �� ��� � �� ��� �� � ��� �� � �� �� � � � ��� � � � �� � �

� �

� �� ! " # � $ % � � & & " � '( ) $ � % * " +! , % ( $ ( - - � " , ,

� ./ 0 # � ' ' � $ & ) ! , " - % � 12 $ - # � $ % �� & , " �3 " �

� 0 4 � � % 5 56 , 2 $ #( , " 7 7 8 , 9 4 � , % 8 , 9 � ( :( )

� ' � $ 2 %� � 2 $ 7 7 , : 2 % 4 - $ , :( % # 4 � � "; ! 2 3 ( & " $ %

� 4 % %�<= > >( 4 ( � <@? 2 % % $ ,? $ � � % 4 : " , % " � $? " - ! > , � 1 % :( � " >

� 5 4 " � " ( � " ' ( $ ) 1 � " " � � & � :BA # � , % ./ 0 , " �3 2 # " ,

Page 14: Botnets by John Kristoff

� � � �� �� ��� � �� ��� �� � ��� �� � �� �� � � � ��� � � � �� ��

� �

� �� !" #$ % &(' ) ) *,+ )

- .,/ 0 1 # 2 0 / 3 2" $ #

- / & 4/ $ # / + / & % 5 * 5

- 6' 2 5 !" #$ % *,+ 7$ # !" # + 2 & % " + & # 5 5 + / 8 # * 5 0 &(' 5 # 9

- 6' " + 0 * + ) & *,+ 1 0 / + 0 / 2 0 : / !" # $ %

Page 15: Botnets by John Kristoff

� � � �� �� ��� � �� ��� �� � ��� �� � �� �� � � � ��� � � � �� ��

� � � � � �

- �! " # $ # $&% '( ) $ * +, - $!. / $!0 , # * )% , . # 132 #

- '( ) $ * +, - $. / $0 , # * ", + 12 #

- $. 4, / / )65 , ) ", ' ( ) $ * +, - $!. / $!0 , # , * )% )

- 7 *( , 8 8 - 9 8 % 8: 2 * #. , + 5 *( 1 / 2 +, $. 5 ;< =

- [^(www|mx\d+|ns\d+)]\w+\.\w+\.\w+

- > , + * #: , # ?( * # 8 2 2 @ )2 A(

- B 2 + #: $. A 5 /C( D * 0 , . D # 1 1 8, + / E2 ) F&G 4 H

Page 16: Botnets by John Kristoff

� � � �� �� ��� � �� ��� �� � ��� �� � �� �� � � � ��� � � � �� ��

� � � � � �

� "! # $ $"% &(' ) #* + ' ) , + ! - .% * + ! /% &(' ) #* +

� 0 - 1 1 $ $ + % .* ' 2* , 3 4 2 & 4 )5 ' 1 4 , % .* , 4 2% ' . , +

� 6 1 ! +* 3 4 2 & ' 1 ! ) # 7 7

� 89 : ;9 9 <= , ' > + ? 2! @A B @ 9 9 9 <C 9 , ' > + ?

� @D := : ;C 8 := E 4 # & 2 F* ' 1 4 2 2 1* 2! ! 1 ! ) #

� & 4% & F ! # ! ) 2! % 1 ! +* )' E* 3 4 2 &G

� 6 ! ) + 4 , * . + - F E 4 2 2 4 ) # 2! F 1' % H 1 4 + 2 <*JI #I

, ) + F 1I ! . # ?

Page 17: Botnets by John Kristoff

� � � �� �� ��� � �� ��� �� � ��� �� � �� �� � � � ��� � � � �� ��

� � � !

zone "rogue.example.net" { type master; file "/etc/db.badname";};-----------------------------------$TTL 30D@ IN SOA ns1.example.net. root ( 2004101700 3H 15M 1W 1D ) IN NS ns1.example.net. IN A 192.0.2.1

Page 18: Botnets by John Kristoff

� � � �� �� ��� � �� ��� �� � ��� �� � �� �� � � � ��� � � � �� ��

� � � � � !

� " # $% &' (*) ' + $ ,.- /' +) 021 '43

526 - 7) $ - /) 0 0' / 8 + 6 9

� 7) $ $ ' 7 - ' ( 5) - + 8 $ + - /6 7 - ' ( - ) 6 9 ( % - ' :; <

� " # 7) $ - /) 0 0' / = + > 8 + =% /' >*? ) $' 3

526 - $% & ' /' +) 0 1 ' +

� :; < 7 @*% $? ' ( - ) 9) 8 $ - - ) $ ' A 7) $ - /) 0 0' / = + >

� <CB $ 7 @ /) $ 8ED 8 $? - @ ' 7 0) + 6 /' ) # 5) - @ 8 + ( 8 # # 8 76 0 -

Page 19: Botnets by John Kristoff

� � � �� �� ��� � �� ��� �� � ��� �� � �� �� � � � ��� � � � �� ��

� � �

� "! #$ %& ')( ! * $ ! %+ #, -. ! & / ' , - #, - / %, 0

� 1 2 * $ ! $ ! , % ! ( ! - & ' 34 0 ! %5 /! 0 ' 3 ' /! %

� 67 $ 4 & / %! 5 3 8, 9 # 5 - : , / ; ' &=<

8$ /

� 4 %, 8 5 8 0 + - , / & 4 ! # ' > ' # /, %! #$ %& ')( ! * $ ! % ' ! &

� ? 5 3 ! @ 8 5 & ! : & ' - A ; , 0 ! & B7 %! . ! 9 & $ 4 4 , % /

Page 20: Botnets by John Kristoff

� � � �� �� ��� � �� ��� �� � ��� �� � �� �� � � � ��� � � � �� � �

� � � � � � � � �

� � "! # � ! $ "% #�& ' "( )* & + , � # �

� - "! . $ & *0/ %21 , � ' . % 3 �( / �! ,4 & 5 & ! 6 & ! # & ' "! 5

� 7 "% # ' 4 8 #/ , 6 "( '&:9 4 * & ( . % ! . $ & *0/ %

� ; 7 -1 # � 3 �! , % ( ' 84 4 ! 5 #�& & * % �% � 3 3 '& 3 ' � #/

� </ 6 & #/ # ' 5 5/ '/ ,4 * �( . $ & */ %

� = & % #�> 8 � ' �! # "! ! 5

Page 21: Botnets by John Kristoff

� � � �� �� ��� � �� ��� �� � ��� �� � �� �� � � � ��� � � � �� � �

� � � � � � � � �

� �! "�# $% & % "�' (*)+ , -. ) & & ) - /+ ) " ) . ) $ '10 / )+ "'

2 - "%43 ' / ) ) (% -5 (% $ " # + ' - 6 , �7 8 . 9 # . :;'

2 < -5 + # ' ' - 6 # 5 + # ' ' (% $ " # + '

2 8 = 8% $ " # + / )+ " >? 7 @A B 7 / )+ " CD

2 . E. (% $ " # + % -5 0 F $ . : 9 ) $ # '

2 G 9 " + # H ) , / # + & % " "% -5 " ) I IJ @J D

2 ? % ' "+ % F , "% ) -0 + # / $% . "% ) - - 6 - H. ' "

Page 22: Botnets by John Kristoff

� � � �� �� ��� � �� ��� �� � ��� �� � �� �� � � � ��� � � � �� � �

� � � � � � �

2 � "! #$ % &�' () # & *' +, $ - . $ % &$ ( /10 $ $ ( . ) % 2! &$ $ ,3

2 show ip cache flow

2 +, $ -54 &$ $ ,!

2 6 & &07 8 8 - - -:9! 0 , % &' (' ;9 % ' & 8! - 8 + , $ -4 &$ $ ,! 8

2 ! ' ' < ; = ) * % 2! + , $ -4 &$ $ ,! . ) , %> , "! & 0 $ ! &7

2 ?1@ A BC"D E FHGI G GI J GI K�L AM D D C"D E KI M F FC A

2 % + ;HN . 0

2 6 & &07 8 8 % + ;HN . 0 9! $ N ( # ' +$ (> ' 9 % ' & 8

Page 23: Botnets by John Kristoff

� � � �� �� ��� � �� ��� �� � ��� �� � �� �� � � � ��� � � � �� � �

� � � � �

2 �! " #%$ &(' ) $ * +, - . " / $ 0 / "1 2$ $ 354 65 0 *54 0 )

7 8 9: *5; 0$ < < <= +, - ) $ ' " , / >4 ,@? "4 $ 6 , A > )

7 B / "1 , 4 ) ' 0 A4 $ . ' , $ /DC * 4 ) $ / " 2$ / " * 2 0 > ); 2 A4

7 B / "1 , 4 ) ' 0 A4 $ . ' , $ /DC * 4 ) $ / " 2$ / "FE ) 3 0$ +, - )

7 B G ) A ' ; , 4 * - / $ 3 ' " 04 2 A 3 2 6 , 4 ) 0 H B 8 )

7 8I 8: +, - )

Page 24: Botnets by John Kristoff

� � � �� �� ��� � �� ��� �� � ��� �� � �� �� � � � ��� � � � �� � �

� � �

7 �� !" ! #$&% ' ( � )�* $ ! ) * ( % (+ " * " * -, . /, % 0&1

7 2 * ) '% ( / ) ( � # # -3 �" ) 4% ( 65 � ) % , 73 (* 8 ) 1 3 4 * ! * 1

7 9% ) 0% " , );: 4" , )�* (1 �, 8 0 $ �3 / 4% $ * $ 1 )1

Page 25: Botnets by John Kristoff

� � � �� �� ��� � �� ��� �� � ��� �� � �� �� � � � ��� � � � �� � �

� � � � �

ipseccmd -w REG -p botcatcher -r TCP445 -f 0:=*:445:TCP -n BLOCK

ipseccmd -w REG -p botcatcher -r TCP135 -f 0:=*:135:TCP -n BLOCK

ipseccmd -w REG -p botcatcher -r ICMP -f 0:=*::ICMP -n BLOCK

ipseccmd -w REG -p botcatcher -r HTTP -f *=0:80:TCP -n BLOCK

ipseccmd -w REG -p botcatcher -x

Page 26: Botnets by John Kristoff

� � � �� �� ��� � �� ��� �� � ��� �� � �� �� � � � ��� � � � �� � �

� � � � � �

7 "! #$ % & ' %( ) * ! +, - . ! /

0 1 , . * . / # -�! 2 ! / -, 2 - $ )3 - + % , 4 3 , / 5 , 5 4 . / 3

0 whois -h whois.cymru.com help

0 6 * ! 2 7 . / # 8 '9 ) ! + - : : :;

Page 27: Botnets by John Kristoff

� � � �� �� ��� � �� ��� �� � ��� �� � �� �� � � � ��� � � � �� � �

� � � � � � � � � �

0 !#" $ $ %'& ( ) *,+ $& - $ . ) $ . / -0 + & . 1 . ) 2 2 0 -3 3 4& ) 5 -

0 6 27 - 68 9 $0 ) : : % . %3 0 /<; $ / 5 % . => ? 4 @A 4 BA 4 CA 3 - .3 D

0 E 9 !'F + 0 $ > > @ + & %& 2 + G3 + : $ -& 3 " ( ( -3 $3 * + $

0 H E ! + & + 2 2 F + 0 $3 + : $ -& ) * ) 2 3 % ( &

0 9 + 5 5 + & . 1 . )& 2 3 -0I )& $ 3 $0 %& ( 3

0 -KJ ( J J ) 2I 3 . )& 7 3 )3 3 L 2<M L 2<M L 2<M = LON P ) N Q R DM

Page 28: Botnets by John Kristoff

� � � �� �� ��� � �� ��� �� � ��� �� � �� �� � � � ��� � � � �� � �

� � � �

0 �! "# $ % &�' ( ") * *+ ( + ( ") &# ) , " -+ ' ,/.

0 0 ) 21 34 5 6+ . ' ( ") * *+ ( + ( ") &# ) ,

7 38 9 : ' &<; ) # =.

7 >? . &# ? 6A@ &' ( ") &# ) , , ' # .

7 , &' # + &? 9' . &) > 0 B C) # ") &# ) , , ' # ( ? . ") 9' # $

7 D) & ' & - @ &' # ( ' C' . ' + ( ") @ &' # . &# ? =' .

Page 29: Botnets by John Kristoff

� � � �� �� ��� � �� ��� �� � ��� �� � �� �� � � � ��� � � � �� � �

� � � � �

7 � � �!" �# � �%$ & ' &" # ( ' # " " ! & �# ) * +" # )-, ! &

7 $ , . , /10" # / ' # )-2 32 4 . '2 5 �$76 0" � � . &6 " 8 � � # . 5"

7 9: ; � )-< ' # &

7 $ , . 8 ! " =, ' # 0 ' # ( > > & � 0 . &6 " �# 0 0 , 5# ,

7 ? > @ , =" ! � 0 , ! &

7 $ , . &" " 0 , # & , /A , 0 &6 ! " =, ! 06 " 8 � � ' # +" & 0 ' ( � 0"

7 B �2 C , / $ , . C � +" , # " 0 C ' # ( ' # 2 , < < , #ED D D

7 C, & 0 & , # , . ! # " 0 & �! " � 0 0 �2 5 ' # ( $ , . F

Page 30: Botnets by John Kristoff

� � � �� �� ��� � �� ��� �� � ��� �� � �� �� � � � ��� � � � �� ��

7 ��� � ! " " # # #%$ &' ()* $ &+ ( ", ) -. -/ ��0 � 1 + / . "

7 ��� � ! " " # # #%$ � 1 2$ - - $ -� �43 $ & � "65 7 7 + . 80 9 "

7 ��� � ! " " # # #%$ . - &* ) 1� - $ + ): " ) -. -/ �0 � 1 + / . ". - & 1 "

7 ;� ! " " ;� =< -/ : $ & 1 . &+ $ &+ ( " &+ / . " 1 . ". - &* ) 1 � ' "

7 > ?@ -� 0 / 7 A AB+ C ( 1� 1: 0 � 1 + / ;+ ) D C , .

7 E + + 2 ;+ ) F , @ C* ( ( 1� GH H I

7 J0 � -. � ?) -/ 7 . 1 / > + � / -� .

7 > + 0 3 K E: -)ML N 1 8 -) � -0 7 ) -. -/ �0 � 1 + / GH H I

Page 31: Botnets by John Kristoff

� � � �� �� ��� � �� ��� �� � ��� �� � �� �� � � � ��� � � � �� ��

� � � � � � � � �

!" #%$ " &' ( ) * +,$ -. ( / ) 0 12 ( 3 * ) 1

465 '87 ! & 9" # : 4 97 ; & ( " &< 5 ' = 4 5 ' 7 ' > ? ( > >@ : &

?A ! & 9CB < 9' = ? < ! ( ; " = 4 & : ; ( 46" '87 " < !" 7 >5 @

< ! 9 4 $ D 4 5E " D & ! ; >5 9 &' = ! 46' < : < ! < :FA " &"

Page 32: Botnets by John Kristoff

� � � �� �� ��� � �� ��� �� � ��� �� � �� �� � � � ��� � � � �� � �

� � �

� �! " #!$ % &(' � $ " )* ' ' +, -* % " +/. , * ' 0 +' ' + %

, 1 0* ' 2 $ , & , "' $ , ' 3 1 0 + 2* 4 + $ 2* , ' %* 3 3 + %

$ , 5 ' � + % + $ % + � , 5 % + 5 " * # ' �* " $ , 5 " * # 0* ' "

6 5!7 $ , 2 + 5 2 8 2 4 &' & ) $ ' &* , ' + 2 �9, &;: + " , + + 5 + 5