Hacker technology: hacker intrusion methods, attack implementation and follow-up work

Hacker technology: hacker intrusion methods, attack implementation and follow-up work

Source: Late fantasy century time: 12:10:00

(Rising: Understanding hacker attack methods can effectively prevent hackers. This article only applies to learning and research .)

Network security is essentially information security on the network. Broadly speaking, all technologies and theories related to the confidentiality, integrity, availability, authenticity and controllability of information on the network are the fields of network security research. Ensuring the information security of the network system is the goal of Network Security. Information security includes two aspects: Information Storage Security and Information Transmission Security. Information Storage Security refers to the security of information in the static storage state, such as whether the information will be called without authorization. Information Transmission security refers to information security during dynamic transmission. To ensure the transmission security of network information, we have the following problems:

(1) Monitoring of Network Information
(2) Counterfeit user identities
(3) Network Information tampering
(4) deny the sent information
(5) resend the information

　　Common Intrusion methods include:

1. Password intrusion

Password intrusion refers to the use of some software to unlock obtained but encrypted password documents, however, many hackers have adopted a large number of programs that can bypass or shield password protection. Programs that can unlock or shield password protection are often called "crack ". Because of the spread of these software, it is sometimes quite simple to intrude into computer network systems. Generally, it is a good method for beginners to understand the internal structure of the system.

2. Trojan Horse

When talking about Trojan horses, it is not hard for anyone who knows the story to understand, the most typical method may be to attach a program that can help hackers complete a specific action to a normal program of a legal user, and the program code of the legal user has been changed. Once the user triggers the program, the hacker command code that is attached to the program is activated at the same time, which can often complete the tasks specified by the hacker. This intrusion method requires hackers to have good programming experience and must change the code and have certain permissions, so it is difficult to master. But because of its complexity, it is difficult for general system administrators to find out.

3. Listening Method

This is a very practical but risky hacker intrusion method, but there are still many hackers who intrude into the system to use this method. It is called the "art is brave.

Communication between network nodes or workstation is achieved through the transfer of information flows. When there is no hub in a network, data transmission does not specify a specific direction, each network node or workstation is an interface. This is like a node saying, "Hi! Which of you is the workstation for sending messages. "

At this time, all the system interfaces receive this message. Once a workstation says, "Hi! That's me. please upload the data. "The connection will be completed immediately.

At present, there are a lot of sniffing software on the network. Using these software, you can easily listen to data, or even include password files. Some services directly use Plaintext transmission in transmission files, this is also very dangerous.

4. E-Mail technology

Using email and trojan programs is a method that hackers often use and works very effectively. Average users, even network administrators, are too weak in awareness of network security, this gives many hackers a chance.

5. Virus Technology
As a hacker, such use should be shameful, but you can learn that, after all, it is also an attack method. It can be used at special times and in special places.

6. Hiding Technology

General steps and examples of Network Attacks

　　Attack preparation stage

The first thing to note is that there are two sources of intruders. One is that internal personnel use their own job opportunities and permissions to obtain permissions that should not be obtained and conduct attacks. The other is intrusion by external personnel, including remote intrusion and network node access intrusion. This section focuses on remote attacks.

Network attacks are a systematic task. The main workflow is to collect intelligence, remote attacks, remote logon, and obtain the permissions of common users and Super Users, leave a backdoor to clear logs. The main content includes target analysis, document retrieval, password cracking, log clearing, and other technologies.

1. Determine the target of the attack

Before launching a complete attack, an attacker must first determine the target of the attack, that is, the consequences to the other party. Common attacks aim at destruction and intrusion. A destructive attack only damages the attack target so that it cannot work normally, rather than arbitrarily controlling the operation of the target system. To achieve the purpose of destructive attacks, the main means is denial of service (Denial of Service ). Another common attack aims to intrude into the attack target. This attack requires certain permissions to control the attack target. Such attacks are more common and more threatening than destructive attacks. Once a hacker obtains the administrator privilege of the target, the hacker can perform any action on the server, including destructive attacks. Such attacks are generally carried out by exploiting vulnerabilities in the server operating system, application software, or network protocols. Of course, another cause of this attack is password leakage. Attackers can obtain the password of the server user by making guesses or using brute-force statements, and then access the server like the real administrator.

2. Information Collection

In addition to determining the target of an attack, the primary task before the attack is to collect as much information as possible about the target. The information mainly includes the type and version of the target operating system, the services provided by the target, the types and versions of each server program, and the related social information.

To attack a machine, you must first determine what operating system is running on it, because the system vulnerabilities on different types of operating systems are very different, therefore, the attack methods are completely different, and even different versions of the same operating system have different system vulnerabilities. To determine the operating system of a server, we generally rely on experience. Some servers may expose some service information to the operating system. For example, when we connect to a machine through telnet, if

Unix (r) System V Release 4.0
Login:

Then, based on experience, we can determine that the operating system running on this machine is Sun OS 5.5 or 5.5.l. However, it is inaccurate to determine the operating system type, because some website administrators intentionally change the display information to confuse attackers, resulting in an illusion.

There is another method that is not very effective, such as querying DNS host information (not very reliable) to see the type of the applied machine and operating system when registering the domain name, alternatively, you can use a social engineering approach to obtain and query through the SNMP public groups open to some hosts.

Another relatively accurate method is to use the TCP/IP stack in the network operating system as a special "fingerprint" to determine the true identity of the system. Because different operating systems have different implementation details on the underlying network protocol. You can remotely send a special package to the target and then use the returned package to determine the operating system type. For example, send a fin package (or any package without ACK or SYN flag) to the target host and wait for a response. Many systems, such as Windows, bsdi, Cisco, HP/UX, and Irix, return a reset. By sending a SYN packet, it contains a TCP header with no defined TCP flag. In Linux, the response package will contain this undefined mark, while in some other systems, the connection will be closed after receiving the SYN + bogu package. Or, you can use the method that matches the initialization sequence length template with a specific operating system. It can be used to classify many systems. For example, the earlier UNIX system is 64 K in length, and the length of some new Unix systems is a random increase. The other is to check the Window Length in the returned package. This technique uniquely determines the Window Length Based on the different initialization window sizes of each operating system. Many tools are implemented using this technology, including Nmap, checkos, and queso.

It is equally important to know which services the target provides and the types and versions of various daemon services, because known vulnerabilities are generally for a service. The service provided here refers to the general situation that we usually mention, for example, Telnet at port 23, FTP at port 21, WWW at Port 80 or port 8080, website management allows you to modify the port number listened to by the Service as needed. The software that provides the same service on different servers can also be different. We call this software daemon. For example, the same FTP service can be used to provide wuftp, ProFTP, ncftp and many other types of daemon. Determining the daemon type also helps Hackers break through the website by exploiting system vulnerabilities.

In addition, the system information to be obtained is some social information that is irrelevant to the computer itself, such as the name and size of the company to which the website belongs, the living habits of the network administrator, and the telephone number. This information seems to have nothing to do with attacking a website. In fact, many hackers use this information to break the website. For example, some website administrators use their own phone numbers as system passwords. If they have mastered the phone number, they can collect information by hand, you can also use a tool to complete information collection, which is called a scanner. The advantage of using a scanner to collect information is that it is fast and can scan multiple targets at a time.

　Attack implementation phase

1. Get Permissions

When enough information is collected, attackers will begin to launch attacks. As a destructive attack, you only need to use tools to launch attacks. As a disruptive attack, you often need to use the collected information to find its system vulnerabilities, and then use the vulnerabilities to obtain certain permissions. Sometimes the general user's permissions are enough to modify the home page, but as a complete attack, the highest permissions of the system are to be obtained. This is not only for a certain purpose, more importantly, it proves the capabilities of attackers, which is also in line with the pursuit of hackers.

Vulnerabilities that can be exploited by attackers include not only system software design security vulnerabilities, but also vulnerabilities caused by improper management configuration. Not long ago, the home page of Apache, the most popular WWW server provider on the Internet, was cracked by hackers. The powered by Apache pattern on its home page (feather-like figure) changed to the powered by Microsoft BackOffice pattern. The attacker successfully obtained the highest permission by exploiting some improper configuration of the webserver database by the Administrator.

Of course, the success examples of most attacks still take advantage of system software vulnerabilities. The main cause of software vulnerabilities is the lack of security awareness of programmers who compile the software. When an attacker makes an abnormal call request to the software, the buffer overflow or illegal access to the file may occur. Among them, buffer overflow attacks are the most common. According to statistics, more than 80% of successful attacks use the buffer overflow vulnerability to obtain illegal permissions. Buffer overflow will be explained in detail in later chapters.

As a hacker or a network administrator, you must master as many system vulnerabilities as possible. Hackers need to use it to perform attacks, while administrators need to take different defense measures based on different vulnerabilities. For the latest and most up-to-date vulnerability information, visit websites such as rootshell (www.rootshell.com), packetstorm (packetstorm.securify.com), and securityfocus (www.securityfocus.com.

2. Permission Expansion

System vulnerabilities can be divided into remote vulnerabilities and local vulnerabilities. Remote Vulnerabilities mean that hackers can directly exploit these vulnerabilities on other machines to launch attacks and obtain certain permissions. This type of vulnerability is quite threatening, and hackers' attacks generally start from remote vulnerabilities. However, a remote vulnerability may not necessarily obtain the highest permission, but is usually the permission of a common user. In this way, Hackers often cannot do what they want. In this case, you need to cooperate with local vulnerabilities to expand the obtained permissions, usually to the administrator privilege of the system.

Only after obtaining the highest administrator permission can you perform such tasks as network listening and cleaning traces. To expand the permissions, you can not only use the obtained permissions to execute programs that exploit local vulnerabilities on the system, but also put some Trojans and other spoofing programs to obtain the administrator password, this type of Trojan is used locally to obtain the highest permissions, and cannot be remotely controlled. For example, if a hacker has obtained the account and logon permissions of an ordinary user on a machine, then he can place a false su program on the machine. Once a hacker places a false su program, when a real legal user logs on, the system runs Su and enters the password, the root password will be recorded, the next time a hacker logs on again, he can use Su to change to root.

Aftermath of attacks

1. Log System Overview

If an attacker leaves the system immediately after the attack and does not do any harm, his whereabouts will be quickly discovered by the system administrator, because all network operating systems generally provide the logging function, records the actions that occur on the system. Therefore, for the sake of concealment, hackers usually erase the traces they leave in logs. To learn how hackers can erase traces, you must first understand the log structure and working methods of common operating systems. UNIX log files are usually placed in the following locations, slightly changed according to different operating systems

/Usr/ADM -- Unix of earlier versions.
The new/var/adm version uses this location.
/Varflort some versions of Solaris, Linux BSD, and Free BSD use this location.
/Etc, most UNIX versions put utmp here, and some UNIX versions also put wtmp here, which is also the location of syslog. conf.

The following files may vary depending on your directory:

Acct or pacct-A Command record used by each user.
Accesslog is mainly used to run the ncsa http server on the server. This record file records the websites that have been connected to your server.
Aculo saves the allocated modems records.
Lastlog records the recent login records and the initial destination of each user, and sometimes the records of the login which the last failed login is recorded.
Loginlog 1 records some abnormal l0gin records.
Messages -- records the records output to the system console. Other information is generated by syslog.
Security records some examples of attempts to enter the restricted range using the UCP system.
Sulog records Records that use the su command.
Utmp records all users currently logged on to the system. This file is constantly changing as the user enters and leaves the system.
Utmpx and utmp extensions.
Wtmp records user logon and exit events.
Use the syslogd daemon to obtain the most important syslog log files.

2. Hide traces

After obtaining the highest administrator privilege, attackers can modify the files on the system (only for conventional UNIX systems), including log files. Therefore, if hackers want to hide their traces, the log is modified. The simplest way is to delete the log file. However, this avoids the system administrator from tracking himself by IP address, but it also clearly tells the administrator, the system has been infiltrated. Therefore, the most common method is to modify only the part of the log file. The specific details of the modification method vary according to different operating systems. There are many programs with such functions on the network, such as zap and wipe, the main method is to clear the information of a user in a log file such as utmp, wtmp, lastlog, and pacct, so that when you use commands such as W, WHO, and last to view the log file, hide the user information.

The Administrator should take some measures to prevent the log system from being modified by hackers, such as using a printer to record network log information in real time. However, this method also has drawbacks. Once a hacker understands your practice, he will keep writing useless information to the log, so that the printer will keep printing the log until all the paper is used up. Therefore, the better way to avoid log modification is to send all log files to a safer host, that is, use loghost. Even so, the possibility of log modification cannot be completely avoided, because since hackers can attack this host, they are also likely to attack loghost.

It is not enough to modify logs, because there is always a leak in the hundred secrets. Even if you think you have modified all the logs, there will still be some clues. For example, if some backdoor programs are installed, they may be detected by the Administrator. Therefore, hackers can further hide traces by replacing some system programs. This kind of hacker program used to replace normal system programs is called rootkit, which can be found on some hacker websites. The more common ones are linuxrootkit, which has now developed to version 5.0. It can replace a series of important system programs such as LS, PS, netstat, and inetd. After LS is replaced, the specified file can be hidden, the Administrator cannot view these files when using the LS command to hide himself.

3. Backdoor

Generally, hackers access the system more than once after attacking the system. To facilitate the next access to the system, hackers will leave a backdoor. The Trojan Horse is the best example of a backdoor. There are many methods for retaining backdoors in Unix. The following describes several common backdoors for the network administrator to take precautions.

<1> password cracking Backdoor
This is the earliest and oldest method used by intruders. It can not only access Unix machines, but also create backdoors by cracking passwords. This is the account with weak password cracking. In the future, even if the administrator blocks the current account of the intruder, these new accounts may still be the backdoor of the new intrusion. In most cases, intruders find accounts that do not use weak passwords, and it is difficult to change the passwords. If the Administrator finds an account with a weak password, he or she will not find any account with the changed password. Therefore, it is difficult for the Administrator to determine which account to seal up.

<2> rhosts ++ Backdoor
On Unix machines connected to the Internet, services such as RSH and rlogin use simple authentication methods based on the host names in the rhosts file. You can easily change the settings without a password. An attacker can input "++" to the rhosts file of a user that can be accessed, and then allow anyone to enter the account without a password. Especially when the home directory is shared externally through NFS, intruders are more enthusiastic about this. These accounts are also the Backdoors that intruders intrude into again. Many people prefer to use RSH because it usually lacks the log capability. many administrators often check "++". Therefore, intruders usually set host names and user names for another account on the internet, making it difficult to detect such attacks.

<3> checksum and timestamp Backdoor
In the early days, many intruders replaced binary files with their own Trojan program. The system administrator uses the timestamp and the system checksum program to identify whether a binary file has been changed, such as the sum program in UNIX. Intruders have developed new technologies to synchronize the timestamps of trojan files with the original files. It is implemented as follows: first, the system clock is allocated back to the original file time, and then the time of the Trojan file is adjusted to the system time. Once the binary Trojan file is precisely synchronized with the original one, the system time can be set back to the current time. The sum program is based on CRC verification, which is easy to cheat. Intruders have designed a program that can adjust Trojan's checksum to the checksum of the original file. MD5 is recommended by most people. Currently, no one can cheat the algorithms used by MD5.

<4> login Backdoor
In UNIX, the login program is usually used to verify passwords of Telnet users. intruders get login. the original code of C is modified so that it checks the backdoor password before comparing the input and storage passwords. If you press the backdoor password, it ignores the password set by the Administrator to drive you into the system. This allows intruders to access any account or even root. Because the backdoor password generates an access before the user logs on and is logged to utmp and wtmp, the attacker can log on to the shell without exposing the account. After the Administrator notices this backdoor, he uses the "strings" command to search for the login program for text information. In many cases, the backdoor password is exposed. Intruders can encrypt or better hide passwords to invalidate strings commands. Therefore, more administrators use MD5 checksum to detect such backdoors.

<5> telnetd Backdoor
When the user telnet to the system, the inetd service listening port accepts the connection and then passes it to in. telnetd, which runs login. some intruders know that the Administrator will check whether login has been modified, and then begin to modify in. telnetd. in. telnetd has some internal inspection of user information, such as the terminal used by the user. the typical terminal setting is xterm or vt100. intruders can do this backdoor. When the terminal is set to "letmein", a shell is generated without any verification. intruders have created a backdoor for some services to generate a shell for the connection from a specific source port.

<6> service Backdoors
Almost all network services have been backdoor by intruders. Finger, RSH, rexec, rlogin, FTP, and even inetd. Some are the shells connected to a TCP port, and access can be obtained through the backdoor password. These programs sometimes use the thorn □? UCP does not need such services, or is added to inetd. conf as a new service. The Administrator should pay attention to the services that are running and verify the original service program with MD5.

<7> cronjob Backdoor
Cronjob on UNIX can schedule the running of specific programs according to the schedule. Intruders can join the backdoor shell program to run the program between 1 and 2, so they can access the program one hour every night. You can also view valid programs that are frequently run in cronjob and add backdoors.

<8> database Backdoor
Almost all UNIX systems use shared libraries. Shared libraries are used to reuse the same functions to reduce code length. Some intruders provide backdoors in functions such as crypt. C and _ crypt. C; programs such as login. c call crypt (). A shell is generated when a backdoor password is used. Therefore, even if the administrator uses MD5 to check the login program, a backdoor function can still be generated, and many administrators do not check whether the library has been backdoor. For many intruders, there is a problem: Some administrators perform MD5 verification on everything and there is a way for intruders to backdoor open () and file access functions. The backdoor function reads the original file but executes the trojan backdoor program. So when MD5 reads these files, the checksum is normal, but when the system is running, it will execute the trojan version, even if the trojan library itself can also escape the MD5 verification, for the administrator, there is a way to find the backdoor, that is, to statically compile and connect to the MD5 verification program and then run it. The static Connection Program does not use the trojan shared library.

<9> Kernel Backdoor
The kernel is the core of UNIX work. The method used for library escape MD5 verification is also applicable to the kernel level, and many static Connections cannot be identified. A good backdoor kernel is the most difficult to be searched by administrators. Fortunately, the backdoor program in the kernel is not readily available and everyone knows how widely it actually spreads.

<10> file system backdoor
Intruders need to store their goods or data on the server and cannot be found by administrators. Articles on intruders often include exploit script tools, backdoor sets, Sniffer logs, and email backups, original Code, etc! Sometimes to prevent administrators from discovering such large files, intruders need to fix "ls", "Du", "fsck" to conceal specific directories and files at a very low level, intruders exploit this vulnerability to cut out a part of the hard disk in a proprietary format, which is expressed as a bad sector. Therefore, intruders can only use special tools to access these hidden files. For common administrators, it is difficult to find the file system in these "Bad Sectors", and it does exist.

<11> boot Backdoor
In the PC world, many virus hiding and root zone, and virus killing software is to check whether the root zone is changed. In UNIX, most administrators do not check the software in the root zone, so some intruders leave some backdoors in the root zone.

<12> process backdoor hiding
Intruders usually want to conceal the programs they run. Such programs are generally password cracking programs and listening programs (sniffer). There are many ways to achieve this. Here, they are more common: modify Your argv [] When writing a program to make it look like another process name. You can rename the sniffer program to be similar to in. Syslog and then execute it. Therefore, when the Administrator uses "Ps" to check the running process, the standard service name appears. You can modify the library function so that "Ps" cannot display all processes. You can embed a backdoor or program into the interrupt driver so that it will not appear in the progress table. A backdoor example using this technology is:

Amod.tar.gz:
Http://star.niimm.spb.su /~ Maillist/bugtraq.1/0777.html network access. These network access backdoors sometimes allow intruders to access through the firewall. There are many web Backdoor programs that allow intruders to establish a certain terminal slogan and can be accessed without using common services. because this is a pass through a non-standard network port, the Administrator may ignore the footprint of intruders. this type of backdoor usually uses TCP, UDP, and ICMP, but may also be other types of packets.

<14> TCP shell Backdoor
Intruders may establish these TCP shell backdoors on top TCP ports that are not blocked by the firewall. in many cases, they use passwords to protect them from shell access immediately after the Administrator connects. the administrator can use the netstat command to view the current connection status. The ports are listening and the current connection is in the long-running status. generally, these backdoors allow intruders to bypass TCP Wrapper Technology. these backdoors can be placed on SMTP ports, and many firewalls allow e-mail access.

<15> UDP shell Backdoor
The Administrator often pays attention to the TCP connection and observes its strange situation. The UDP shell backdoor does not have such a connection, so netstat cannot display the access traces of intruders, many firewalls are set to allow access to UDP packets similar to DNS. Generally, intruders place the UDP shell on this port to allow access through the firewall.

<16> ICMP shell Backdoor
Ping is one of the general methods of detecting machine activity status by sending and accepting ICMP packets. Many firewalls allow the outside to ping its internal machines. Intruders can put data into the ping ICMP packet to form a shell channel between the ping machines. The Administrator may notice the ping packet storm, however, apart from checking the data in the package, the attacker will not expose the data.

<17> encrypted connection
The Administrator may establish an sniffer to try to access data. However, when an intruder encrypts the webshell, it is impossible to determine the transmission content between the two machines.