Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
Scribd Logo
Upload

Welcome to Scribd!

  • 13 views

    MODULE - 6 Trojan, Backdoor, Virus and Countermeasure

    Uploaded by

    Vallenshia Vaezera Uaatjo

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    MODULE - 6 Trojan, Backdoor, Virus and Countermeasure

    Uploaded by

    Vallenshia Vaezera Uaatjo
    13 views11 pages

    Original Title

    MODULE_6 Trojan, Backdoor, Virus and Countermeasure

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    13 views11 pages

    MODULE - 6 Trojan, Backdoor, Virus and Countermeasure

    Uploaded by

    Vallenshia Vaezera Uaatjo

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    of 11

    MODULE- 06: Trojan, Backdoor &Virus & Countermeasures

    Objective of the Module


    objective of this Module is to understand about Trojan, Backdoor and Viruses, Suggesting &
    Implementing Countermeasures

    Trojan, Backdoor &Virus

    What is Trojan?

    A Trojan is a program that is usually appears to be something useful but when it is


    executed, it installs malicious programs on your computer, having back door capabilities. A
    Trojan is used to gain backdoor access to a user's system. Trojans are used to create a
    backdoor on victim’s computer that gives attacker to access to the victim’s machine.

    A Trojan consist of spy ware program and other programs that: monitor traffic and
    keystrokes; create a backdoor into the system for the hacker's use; alter log files; attack other
    machines on the network; and alter existing system tools to escape detection

    A Trojan exists for a variety of operating systems, such as Microsoft Windows, Linux,
    and Solaris.

    What is Backdoor?

    A backdoor is an unauthorized entry or way to get access to a computer system it is


    setup by an attacker (malicious user) into a computer system to facilitate unauthorized access
    to the system. Backdoors are created using a Trojan program on a system to facilitate illegal
    remote access. Using a backdoor an attacker can gain access to a computer remotely and
    can take basic control (i.e. for Linux root access, for Windows, Administrator or Admin access)
    of a computer system, without the system's owner’s permission

    What is Virus?
    A virus is a self-replicating program that can copy itself and infect a computer without
    the permission /knowledge of the owner. The insertion of the virus into a program or file is
    termed as infection. It attaches itself to a program or file enabling it to spread from one
    computer to another, leaving infections as it travels. Most of the viruses attach to executable
    files and their malicious operation begins when you run or open the executable file

    Virus developers can have several reasons for creating and spreading viruses. Viruses have
    been created as research projects, to attack the software of companies, and to distribute some
    messages.

    NIELIT, Gorakhpur | Trojan, Backdoor & Virus 1


    A Scenario For Trojan, Backdoor & Virus
    Scenario
    Mr. ABC is a technical support executive in IT Technologies. The company uses
    an intranet based Mail and Web server for intra office communications. Mr. XYZ is senior manager in
    the same organization and is reporting officer of Mr. ABC.
    Now Mr. ABC sends an email to his manager Mr. XYZ containing aTrojan program to
    create a backdoor to obtain all the information of manager’s system.
    For this a scenario has been designed to show how Mr. ABC installs the Trojan program
    on manager’s system and takeover the complete control of Manager‘s system.
    The steps listed in the lab manual shows how Mr. ABC could configure a Trojan program
    and send it to Mr. XYZ to take control of manager‘s system.

    Hands on Lab for Trojan, Backdoor & Virus

    Tools Used
    ProRat (Program for creating a Trojan application)

    ProRat is a Windows based backdoor trojan horse, more commonly known as a RAT (Remote
    Administration Tool). As with other trojan horses it uses a client and server. ProRat opens a port
    on the computer which allows the client to perform numerous operations on the server (the
    machine being controlled). ProRat is known for its server to be almost impossible to remove
    without updated antivirus software.

    Machine Details for this Lab


    Sr.no Machine IP Address User Login Password
    .
    1 CentOS 6.4 (Mail server) 10.0.0.13 root 12345678
    2 Windows7 (Attacker) 10.0.0.12 nielit 123
    3 Win-7 clone (Victim) 10.0.0.15 nielit 123

    NIELIT, Gorakhpur | Trojan, Backdoor & Virus 2


    Hands on Lab

    Creating And Performing Backdoor Intrusion With The Help Of Trojan


    Program

    Following steps would be used to create the trojan application using "ProRat" tool

    1. From "Windows7" (10.0.0.12) desktop and browse to "prorat_v1.9" folder

    2. Run "ProRat" application as administrator.

    3. Create ProRat Server application to be used as "trojan", by navigating through "Create->


    Create ProRat Server (342 kbayt)” as shown below.

    NIELIT, Gorakhpur | Trojan, Backdoor & Virus 3


    4. Click on “General Settings” button and fill the following information with default settings:
    ▪ Server Port : "5110" [Specify port on which trojan will listen to request]
    ▪ Server Password: "12345678"[Specify password to be used to connect the trojan
    application running on victim machine]
    ▪ victim Name: "victim" [Specify generic name for this application]

    5. Now click on " Server Extensions " button and select the "Server Extension(Has icon
    support)" to specify the file extension of trojan server application along with its icon.

    6. Now click on "Server Icon" and select a appropriate icon image for trojan application .
    7. Click on "Create Server" to create the trojan application with file name "server.exe" would be
    created. Minimize the Prorat window.

    NIELIT, Gorakhpur | Trojan, Backdoor & Virus 4


    8. Now browse to prorat directory(Desktop/ProRat/run/) where a file with name"server.exe"
    would be created .This file would be sent by malicious user to victim
    (bankmanager@cordial.com).

    Following steps would be used by maliciuos user to send the created


    trojan application through e-mail to the victim

    9. From Windows7(10.0.0.12) machine, browse to "http://10.0.0.13" [a web based mail service


    to be used for send e-mail] .

    10. Login to e-mail service using following credentials


    User: client1@test.com
    Password: 12345678
    Now compose a mail for victim user ,in this scenario the trojan application “server.exe”
    would be sent to "bankmanager@cordial.com”[e-mail id of victim user] .Attach the
    "server.exe" file and send the e-mail message as shown below

    NIELIT, Gorakhpur | Trojan, Backdoor & Virus 5


    Following steps would be used by victim user to download trojan application sent by
    malicious user through e-mail

    11. As a victim user, Switch to "Win-clone" (10.0.0.15) machine and open the mail service by
    browsing ""http://myserver.domain.com" as shown below:

    12. Login to e-mail service using following credentials


    Username : bankmanager@cordial.com
    Password : 12345678

    13. Now check the mail sent by user "client1@test.com" ,and download the attached file
    “server.exe” as shown below.

    NIELIT, Gorakhpur | Trojan, Backdoor & Virus 6


    14. Now the victim user would try to execute the downloaded file which is saved in "Downloads"
    folder. Now click on downloaded file "server.exe". By clicking this malicious file, the
    "server.exe" trojan application would install on the victim's machine without the permission
    of user.

    Following steps would be used by malicious user to make connection to victim's


    machine using trojan application and thus take complete control over the target
    machine.

    15. As a malicious user ,switch to Windows7 (10.0.0.12) and execute ProRat application to
    connect the target machine with following IP address and Port No:
    IP Address:10.0.0.15 [IP Address of win-7 i.e. victim's machine]
    Port No: 5110 [Specify Port no. on which the trojan is running]

    16. Enter password "12345678" as specified in previous step and click on "OK" button.

    17. Now click on run and click on notepad, again click on Run as following.

    NIELIT, Gorakhpur | Trojan, Backdoor & Virus 7


    18. Switch to Win-clone (10.0.0.15) and notepad would be appear.

    Outcomes
    In this lab the participant has performed the following:

    ▪ Created a backdoor application using ProRat tool on behalf of attacker.


    ▪ Sent the file containing a backdoor application via e-mail as attacker.
    ▪ Download and installed the backdoor application on victim machine.
    ▪ Connected to victim machine using ProRat application as attacker.
    ▪ Attacker gains complete control over Victim Machine.

    NIELIT, Gorakhpur | Trojan, Backdoor & Virus 8


    Implementing the countermeasure to create a secured environment

    The following steps would be performed by user on Windows7(10.0.0.15)to set up


    firewall.

    19. Switch to the Windows7(10.0.0.15)machine open the “Control Panel” and click on Windows
    Firewall.

    20. Click on Restore Defaults

    21. Click on Yes button. Firewall is now enabled on Win-clone (10.0.0.15) machine.

    NIELIT, Gorakhpur | Trojan, Backdoor & Virus 9


    22. Switch to Windows7(10.0..12)Machine and connect again by clicking on Connect button on
    Prorat.

    23. But this time it will not prompt for the password as it cannot connect to client side agent
    because firewall on Win-Clone (10.0.0.15)machine is now blocking access.

    NIELIT, Gorakhpur | Trojan, Backdoor & Virus 10


    Lab Outcomes
    In this lab the participant has done the following:

    • Enabled Firewall on Victim's machine to disable untrusted services.


    • The connection to Backdoor application failed after enabling firewall as a
    countermeasure.

    Suggested More Countermeasures

    1. Always use Anti-Virus software on machine and regularly update the Anti Virus software
    to be able to detect the presence of infection.
    ProRat server usually detected as Trojan.Dropper.Prorat.DZ.29, Dropped:
    Backdoor.Prorat.DZ

    NIELIT, Gorakhpur | Trojan, Backdoor & Virus 11

    You might also like