WINDOWS system backdoor instance 1

Sniffing and spoofing, the most dangerous Backdoor

Attackers can steal the Administrator's password by installing a sniffer tool on the host instead of creating a new account after controlling the host. Because such backdoors do not create new accounts, but log on to the system using the administrator password obtained by sniffing, they are extremely concealed, if administrators do not have high security awareness and lack sufficient security skills, they cannot find them at all.

1) install the sniffer Tool

Attackers can upload or download the corresponding sniffer tool to the server and install it. It should be noted that these sniffing tools are generally small in size and have a single function, but they are often made into driving forms, so they are extremely concealed and difficult to find and should not be cleared.

2) Get the Administrator Password

The sniffing tool monitors the system. When the Administrator logs on to the server, the password is stolen. Then, the sniffing tool saves the administrator password to a txt file. After the attacker logs on to the server for the next time, he can open the txt file to obtain the administrator password. After that, he can log on to the server directly using a valid Administrator account instead of creating a new account. If the server is a Web, attackers will place the txt file in a web directory, and then they can browse and view the file locally. Figure 1)

3) Preventive measures

Attackers can exploit the backdoor to log on to the system as a normal administrator account. Therefore, it is difficult to find out. However, any intrusion may leave clues, we can enable the "Audit Policy" in the Group Policy to record the user's logon status, and then use the Event Viewer to check whether there is illegal logon with a suspicious time. However, a clever attacker can delete or modify system logs. Therefore, the most thorough measure is to clear the sniffing tool installed in the system and change the administrator password.