PC Technician - Viruses and Virus info

The video to your left talks about rootkits. Now this type of infection is one of the most insidious kinds of virus (actually it behaves more like a parasite). Part of the problem is that the virus is invisible to the operating system (e.g. Windows) making it very hard to detect. The hacker can design it with malicious code that can almost do anything which includes installing a keylogger program which captures keystokes and sends this info back to the hacker. This info may contain your name, SS number, credit card number, passwords, etc.. I wish I had a deep understanding of the rootkit - then I would have it return a time bomb to the hacker to destroy his/her computer - like erase his hard drive. I will attempt to figure all this out in the future. By the way the boot sector must contain a two byte signiture (0x55 and 0xAA) and if is missing or corrupt - the computer will not boot. There is some hope to stopping rootkits and that is an improved BIOS which will prevent any modifications to the first sector of the hard drive.

By the way the presenter uses a program called "back track 5" it is for linux machines but I found a link HERE which will allow you to run backtrack on windows. I'll get back to you soon. If you have Linux instead of windows then obviously select the Linux distributions.

I am back, with 3 of my nine lives lost forever. And here is what to do next.

1. Download VirtualBox 5.2.8 from the virtual box site given above and click download button, on next screen choose host, in my case I selected "windows hosts". You should click on run to install this package. Just click on through with the defaults.The install program may put on the task bar (flashing) and open it and click your approval to continue. Eventualy you will then click finish ( click on the after install box to also start up VirtualBox (VB) ). Also download the Virtual Box Extension Pack as you may need it. Save this file to your hard drive.

2. Now that you have VB running you will need to get the Backtrack program HERE as an iso file and download it. Rmember to select the correct verision to match your computer i.e. 32 bit or 64 bit. You also have a choice between KDE and GNOME - these are the graphical interface if you run X Window. I downloaded both KDE and Gnome and put mine into a folder (I called it vms) on the C: drive. So now you have to save the download Backtrack and save it into the folder "vms". This way I can have 2 graphical versions which are stored in the "vms" folder on my hardrive. Now go to VB and click on new button and name the virtual machine "backtrack" (in my case I named them backtrack-KDE and backtrack-GNOME ). Now select a type and a version. I picked "other" and "other/ unknown". Now select a memory size (ram), I selected a value in the green area - if you make it too big you will take away too much memory from the host system ( i.e. Windows ), and will give problems when VB tries to run. On the next screen choose "create a virtual hard disk" and click create. Now select a hard disk file type - I selected VDI - then click next. The next screen I choose "Dynamically allocate" then next,I gave a file size of 10 GB. and clicked "create". At this point the VB should show your virtual disk. Now click on green arrow start button. A window should open and you have to give the host (the .iso file) drive. Remember I put this file into the "vms" folder and you will click on the tiny folder to navigate to your iso file. Click on open and you should see the name of the iso file in the box. Then click start. Backtrack should start and it does on my son's computer but on my computer it only shows the backtrack logo and a lot of gibberish but then I got a prompt which took a while. The prompt looks like this "root@bt: # ". I then typed in ifconfig and it showed me the results of this command (see left hand side). I then decided to download an iso file for a version of Ubuntu and added this to my virtual machine so now I would have both Backtrack and Ubuntu available (just like my son's computer). But, lo and behold the virtual Ubuntu doesn't work and I will get back soon with (hopefully ) a solution as you may get a similar problem. Oh by the way, it dawned on me that BackTrack is just a process running in a Linux enironment. I used to know command prompt mode for unix(linux) but that was many many years ago. I will try to catch up with this former knowledge.

See you soon, that is, if I don't slit my throat.

Well I am back, I think the problem with getting the Ubuntu linux to run on my computer is because I don't have enough memory (3 GB) but it runs on my son's machine because he has 8 GB of memory. So, I am stuck because I really can't allocate more memory as it would slow my Windows environment. I got a new computer ( a laptop with 8 GB of memory ) and will see if Ubuntu will run on it. I'll let you know.

But, first I would like to talk about the rootkit virus. The fisrt thing we should look at is how a computer works at the microchip level i.e., the CPU. Then we can look at how a rootkit works to exploit what is called a buffer overflow attack. You can read all about it HERE. Or, I will try to give a less detailed analysis (I hope), as my last encounter with assembly language was over 40 years ago when I wrote code for the 8087 cpu - the co-processor for the 8088 chip. The 8087 chip was a floating point processor.Anyway, the CPU is composed of three main parts; the Control Unit (controls the input/output devices),The arithmetic Logic Unit, and the Immediate Access Store ( the memory available for programs and data ). This last unit use what is called resgisters to load your program into RAM memory. There are 8 registers in a X86 Processor which allows your program to build 6 segments which are stored in memory from high memory to low memory. the top segment is called the "Stack" and the last segment is called the program (and data) code. In a X86 processor the three registers that we will be concerned with are the ESP, EBP and EIP. The ESP regiser (Extended Stack Pointer ) marks the top of the Stack. The EBP ( Extended Base Pointer) which points to base of the Stack. And the EIP (Extended Instruction Pointer) which points to the address of the next instruction of your code to be executed. This register always points to an address in the "Program Code" memory. The stack is configured as a LIFO (Last in First out) data structure. So, smarty pants what does all this mean. If you execute code that pushes an address onto the stack, called "push" in assembly language it is placed at the top. If you perform three push commands like push 1, push 2, push 3, then when you want to retrieve these values then your code could say pop, pop, pop, (to retrieve 3 addresses from the stack - assembly command) which means you want to retrieve the addresses 3 successive times, then the addresses would be returned in reverse order - 3,2,1.

So now let's get into exploiting the Buffer Overflow. It seems there are 3 ways that stand between you and a successful buffer overflow attack. If you don't know where the EIP is located then you cannot construct an attack. The second problem is finding out the ESP address and this is difficult because this value is constantly changing and can be captured only when a buffer overflow happens. The first problem is resolved easily ( oh yeah - easy for you - difficult for me). The second problem is a lot more difficult as it involves the use of a Disassembler/Debugger. One such program is called Immunity. You can use a language such as python to write a pycommand for Immunity. A second method uses pydbg ( python debugger library ) to analyze an exception condition and print the register values. (What???). The third problem is difficult and tedious. The main idea is to send a string of characters from (0x00 to 0xff) and to use pydbg and monitor the results. When a bad character is encounted e.g. a line feed, a carriage return, etc. the target progam will stop just before the bad charater. You continue to do this until all bad characters are found. This is tedium epitomized.

One last item, you have to know a priori which applications have a buffer flow vulnerabilty. You would need a disassembler to look for functions known for their vulnerability. The use of fuzzers ( whatever this is) to cause the target applicaion to crash and then analyze the results ( Yeah sure ! ). Okay enough of this now we will examine an example of exploitation. You can find this HERE I am not going to give a summary for this as it involves downloading of tools to help you. ---> to be continued

Back again. I carefully followed the Rootkit video above and finally caught on what he was trying to do. The first part he was just demonstrating that his sacrifical computer (Windows XP) with a plain vanilla OS. So he opened MS (Sysinternals) and ran a program which I tought was a rootkit (the bad guy) but instead it was a Rookit Cleanser. My Sysinternals suite did not show this program. By the way the Rootkit Cleanser is no longer used - it has been replaced by a newer version (look for it on google). His cleanser was started and didn't find any rootkits as it shouldn't with newly setup XP computer. So he wanted to double check and he downloaded a copy Of BlackLight to make sure. Both these programs showed no problems. Now for the exploit part. When looking at his video and Backtrack 5 - I saw two icons on the left side which were the actual rootkit viruses - he was planning to use to upload to the target machine. I am not sure where he got them as I tried to download these but haven't found them yet - so I will continue to look for them (not important to me as all I want to do is gain entrance to one of my computers on my network). Anyway, the next step is to use the nmap program which reveals all active ip addresses (over a range of 20 nodes) on his network (local LAN). He found two open computers which includes his XP machine. So this will be his target machine (192.168.159.136). I tried to run nmap with the same options as his, but my nmap program objected to the the -T5 option (as his video was made in 2012). Now I had to read all about nmap - UGH! I would rather watch grass grow instead. Now we can now run a program which will search out every port (for a given ip address - in this case 192.168.59,136) that is open for a vulnerablity attack. This uses every type of brute force method to make this determination. By the way the program is in the directory /pentest/exploits/fasttrack and is called fast-track.py. if you are in the fasttrack directory you can execute the program (obviously a python program) by typing ./fast-track.py -i (note the ./ in front of the name ). Well I tried this with no luck. This program starts an interactive session with a prompt of msf - and I just happened to notice that the database it required can't be found - while the rootkit author shows a DB of "postgresql" and my session shows that the DB is called sqlite3. So if the DB can't be found this is not going to work. Actually, these two DB I described above are (to be precise) database drivers. Now I have to track down two things - which driver is needed and how to insert it into fast-track.py. So back to the google merry-go-round, with gallantry and intrepidity. --> to be continued.

Back again. Now ready to make an attack on my network. Now execute /pentest/exploits/fasttrack/fast-track.py -i and you should get the screen shot in fig. 1 (see left hand side). Select option 2 . The next screen should prompt you with some piggy-back commands in Metasploit. Note: you can select a single ip address of the target or a range of ip's to search all computers on your LAN. I used a single ip address, because if you select a range this will take a really long time. I then typed in a single argument (eg) -PN 192.168.1.100 and got a prompt to select either Bind or Reverse. I selected number 1 but got a message that there was no active or invalid driver specified (see fig.2). So obviously, this was not going to work. By the way fasttrack program spawned another proccess called msf (a forked child process) which then said that all jobs were stopped. Now what? I then took a guess that maybe if I just started the msf process by itself I could enter the commands manually. I did try the suggested fixes but this just dragged me down a sinkhole as you need to get all dependencies for this to work. So I started "msfconsole" which took me to the msf> prompt but first stop the fast-track.py program with "quit" and number "12" to completly exit fast-track. Once msfconsole started I got the msf> prompt. Now type in "db_driver". It now displays the active driver, mine was postgresql. Now type in "db_driver postgresql". You should get message "using database driver postgresql". Now type in

db_nmap (ip) address

I then typed in

db_nmap 192.168.1.100 (my sacrifical computer).

Now we need to start the autopwn command, this is what I typed

"db_autopwn -p -t -e -b (ip address of attacked compuer )"

and now it started a long running process looking for unprotected ports for the given ip address. The process started and now after several hours it still hasn't finished (?). (in my case 192.168.1.100). As I watched the attack, I noticed it was trying other ip addresses ( not sure why) and trying to find an unprotected port, and it sends a lot of launched modules for each port ( brute force attack ?). Well it has been at least 6 hours now and the autopwn process is still running, YIKES??.

Continued on page 2