Hacker common sniffer Analysis in Linux environment-Linux Enterprise Application-Linux server application information. The following is a detailed description. This article analyzes in detail several sniffing devices that hackers often use in Linux, which are often planted on victim servers after being infiltrated by intruders. These sniffing devices have different characteristics. Some are simple to capture user names and passwords, while others are very powerful to record all network data streams. This article will analyze the following sniffer types:
Linsniffer is a simple and practical sniffer. Its main feature is to capture the user name and password, which is outstanding in this regard.
?? By Mike Edulla
?? Condition: C and IP header file
?? Configuration File: None
?? Location: http://agape.trilidun.org/hack/network-sniffers/linsnifferc
?? Security history: None
Note: It is easy to use. However, lnsniffer requires a complete IP header file, including the header files that are often stored in/usr/include/net and/usr/include/netinet. Before compilation, ensure that the PATH variable contains/usr/include.
Use the following command to compile lnsniffer:
?? $ Cc linsniffer. c-o linsniffer
To run linsniffer, run the following command:
?? $ Linsniffer
After the startup, linsniffer will create an empty file: tcp. log to store the sniffing result.
In the test, I created a user named hapless with the password "unaware. Then, use this user to log on to the Linux server and perform some common user operations. The following is an ftp process:
GPS $ ftp 192.168.0.2
?? Connected to 192.168.0.2.
?? 220 linux.test.net FTP server Wed Aug 19 02:55:52 MST 1998) ready.
?? Name (192.168.0.2: root): hapless
?? 331 Password required for hapless.
?? Password:
?? 230 User hapless logged in.
?? Remote system type is UNIX.
?? Using binary mode to transfer files.
?? Ftp> ls-al
?? 200 PORT command successful.
?? 150 Opening ASCII mode data connection for/bin/ls.
?? Total 14
?? Drwxrwxr-x 4 hapless 1024 May 20 19:35.
?? Drwxr-xr-x 6 root 1024 May 20 ..
?? -Rw-r -- 1 hapless 96 May 20 19:56. bash_history
?? -Rw-r -- 1 hapless 49 Nov 25 1997. bash_logout
?? -Rw-r -- 1 hapless 913 Nov 24 1997. bashrc
?? -Rw-r -- 1 hapless 650 Nov 24 1997. cshrc
?? -Rw-r -- 1 hapless 111 Nov 3 1997. inputrc
?? -Rwxr-xr-x 1 hapless 186 Sep 1 1998. kshrc
?? -Rw-r -- 1 hapless 392 Jan 7 1998. login
?? -Rw-r -- 1 hapless 51 Nov 25 1997. logout
?? -Rw-r -- 1 hapless 341 Oct 13 1997. profile
?? -Rwxr-xr-x 1 hapless 182 Sep 1 1998. profile. ksh
?? Drwxr-xr-x 2 hapless 1024 May 14 12:16. seyon
?? Drwxr-xr-x 3 hapless 1024 May 14 12:15 lg
?? 226 Transfer complete.
?? Ftp> ls
?? 200 PORT command successful.
?? 150 Opening ASCII mode data connection for/bin/ls.
?? Total 14
?? Drwxrwxr-x 4 hapless 1024 May 20 19:35.
?? Drwxr-xr-x 6 root 1024 May 20 ..
?? -Rw-r -- 1 hapless 96 May 20 19:56. bash_history
?? -Rw-r -- 1 hapless 49 Nov 25 1997. bash_logout
?? -Rw-r -- 1 hapless 913 Nov 24 1997. bashrc
?? -Rw-r -- 1 hapless 650 Nov 24 1997. cshrc
?? -Rw-r -- 1 hapless 111 Nov 3 1997. inputrc
?? -Rwxr-xr-x 1 hapless 186 Sep 1 1998. kshrc
?? -Rw-r -- 1 hapless 392 Jan 7 1998. login
?? -Rw-r -- 1 hapless 51 Nov 25 1997. logout
?? -Rw-r -- 1 hapless 341 Oct 13 1997. profile
?? -Rwxr-xr-x 1 hapless 182 Sep 1 1998. profile. ksh
?? Drwxr-xr-x 2 hapless 1024 May 14 12:16. seyon
?? Drwxr-xr-x 3 hapless 1024 May 14 12:15 lg
?? 226 Transfer complete.
?? Ftp> ls-F
?? 200 PORT command successful.
?? 150 Opening ASCII mode data connection for/bin/ls.
?? Total 14
?? Drwxrwxr-x 4 hapless 1024 May 20 19:35 ./
?? Drwxr-xr-x 6 root 1024 May 20 ../
?? Rw-r -- 1 hapless 96 May 20 :56. bash_history
?? -Rw-r -- 1 hapless 49 Nov 25 1997. bash_logout
?? -Rw-r -- 1 hapless 913 Nov 24 1997. bashrc
?? -Rw-r -- 1 hapless 650 Nov 24 1997. cshrc
?? -Rw-r -- 1 hapless 111 Nov 3 1997. inputrc
?? -Rwxr-xr-x 1 hapless 186 Sep 1 1998. kshrc *
?? -Rw-r -- 1 hapless 392 Jan 7 1998. login
?? -Rw-r -- 1 hapless 51 Nov 25 1997. logout
?? -Rw-r -- 1 hapless 341 Oct 13 1997. profile
?? -Rwxr-xr-x 1 hapless 182 Sep 1 1998. profile. ksh *
?? Drwxr-xr-x 2 hapless 1024 May 14 12:16. seyon/
?? Drwxr-xr-x 3 hapless 1024 May 14 12:15 lg/
?? 226 Transfer complete.
?? Ftp> cd lg
?? 250 CWD command successful.
?? Ftp> ls-F
?? 200 PORT command successful.
?? 150 Opening ASCII mode data connection for/bin/ls.
?? Total 8
?? Drwxr-xr-x 3 hapless 1024 May 14 ./
?? Drwxrwxr-x 4 hapless 1024 May 20 :35 ../
?? Rw-r -- 1 hapless 70 Aug 22 1998 lg3_colors
?? -Rw-r -- 1 hapless 629 Aug 22 1998 lg3_prefs
?? -Rw-r -- 1 hapless 728 Aug 22 1998 lg3_soundPref
?? -Rw-r -- 1 hapless 2024 Aug 22 1998 lg3_startup
?? Drwxr-xr-x 2 hapless 1024 May 14 12:15 lg_layouts/
?? 226 Transfer complete.
?? Ftp> cd lg_layouts
?? 250 CWD command successful.
This is a typical user operation process. Now let's look at the sniffing result generated by linsniffer:
?? GPS => linux.test.net [21]
?? USER hapless
?? PASS unaware
?? SYST
?? PORT 4,192
?? LIST-al
?? PORT 4,193
?? LIST
?? PORT 4,194
?? LIST-F
?? CWD lg
?? PORT 4,195
?? LIST-F
The output content is intuitive. First, it records the FTP connection from GPS to Linux host:
?? GPS => linux.test.net [21]
Then, linsniffer captures the hapless user name and password.
?? USER hapless
?? PASS unaware
Finally, linsniffer records every command used by hapless:
?? SYST
?? PORT 4,192
?? LIST-al
?? PORT 4,193
?? LIST
?? PORT 4,194
?? LIST-F
?? CWD lg
?? PORT 4,195
?? LIST-F
The output results are very brief and suitable for eavesdropping on passwords and recording common activities. However, it is not suitable for more complex analysis. At this time, you may need linux_sniffe.
3. linux_sniffer
Linux_sniffer provides more complex test results.
?? Author: loq
?? Requirements: C and IP header files
?? Configuration File: None
?? Location: http://www.ryanspc.com/sniffers/linux_sniffer.c.
?? Security history: None
Note: linux_sniffer is easy to use, but a full IP header file is required.
Run the following command to compile linux_sniffer:
?? $ Cc linux_sniffer.c-o linuxsniff
The following is a telnet session, which is also recorded by linux_sniffer:
?? GPS 2 # telnet 192.168.0.1
?? Connected to 192.168.0.1.
?? Login: hapless
?? Password:
?? [Hapless @ linux2 hapless] $ w
?? 19:55:29 up 58 min, 4 users, load average: 0.00, 0.00, 0.00
?? User tty from login @ IDLE JCPU PCPU WHAT
?? Root tty1 pm 27.00 s 0.17 s 0.06 s-bash
?? Root tty2 pm 0.24 s 0.01 s linuxsniff
?? Root tty3 pm 0.17 s 0.07 s-bash
?? Hapless ttyp0 GPS pm 1.00 s 0.26 s 0.04 s w
?? [Hapless @ linux2 hapless] $ who
?? Root tty1 May 20 :44
?? Root tty2 May 20 19: 46
?? Root tty3 May 20 :44
?? Hapless ttyp0 May 20 19: 55 (GPS)
?? [Hapless @ linux2 hapless] $ finger-l
?? Login: root Name: root
?? Directory:/root Shell:/bin/bash
?? On since Thu May 20 :44 (PDT) on tty1 35 seconds idle
?? On since Thu May 20 :46 (PDT) on tty2 2 minutes 4 seconds idle
?? On since Thu May 20 :44 (PDT) on tty3 10 minutes 51 seconds idle
?? No mail.
?? No Plan.
?? Login: hapless Name: Caldera OpenLinux User
?? Directory:/home/hapless Shell:/bin/bash
?? On since Thu May 20 :55 (PDT) on ttyp0 from GPS
?? No mail.
?? No Plan.
This is also a typical logon process: User Logon, detection of which users are logged on, and so on. Linux_sniffer records additional address data, but also records some important data. First, it records the connection:
The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion;
products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the
content of the page makes you feel confusing, please write us an email, we will handle the problem
within 5 days after receiving your email.
If you find any instances of plagiarism from the community, please send an email to:
info-contact@alibabacloud.com
and provide relevant evidence. A staff member will contact you within 5 working days.
