Showing posts with label Hacking. Show all posts
Ares - Python Botnet and Backdoor
Ares is made of two main programs:
Command and control server, which is a Web interface for managing agents and agent programs, that runs on compromised hosts and ensures communication with CNC
Web interfaces can be run on servers running Python. You need to install the cherrypy package. The client is a Python program intended to be compiled as a win32 executable using PyInstaller. it depends on the request, pythoncom, pyhook python modules and PIL (Python Imaging Library).
currently supporting :
- Remote cmd.exe shell
- Persistence
- File upload / Download
- Screenshot
- Key Logging
Installation Server :
To install a server, first create a sqlite databe
cd server/
python db_init.py
if it's not installed, install the cherrypy python package.
then discharge the server with the command:
python server.py
By default, the server listens on http: // localhost: 8080
agent
the agent can be launched as a python script, but it is ultimately intended to be compiled as a win32 executable using PyInstaller.
First, install all dependencies:
requests
pythoncom
pyhook
PILL
then configure agen /setting.py according to your needs:
ERVER_URL = URL of the CNC http server
BOT_ID = name (unique) of bot, leave blank to use hostname
DEBUG = must debug message to be printed to stdout?
IDLE_TIME = time of inactivity before going in standby mode (Agents check CNC for commands much more frequently when standby).
REQUEST INTERVAL = interval between each query to CNC when active
Finaly, use PyInstaller to compile the agent into a single exe file:
cd client /
PyInstaller --onefile -
noconsole agent.py
Tag :
Hacking,
how to turn off other people's computers via CMD
Hi, how are you ? ^ _ ^ This time nisa love Tutorial Turning Off Other People's Computers Through Chess ^ _ ^ Okay, let's just say right now: * 1. First enter Run, how do you click Windows + R on your Kmu keyboard 2. Next type cmd and select Ok or press Enter, 3. When the cmd black screen appears, then type the net veiw -a command or you can also type net view, if added -a command all SSIDs to be more complete with details 4. You will see a list of computer or laptop users who are both using wifi access with you on the CMD display 5. Next select one of the computer_name you want to turn off and then write the command ping computer_name without the double slash reverse \\ 6. For example the name of the computer is \\ Danto2017 then type ping Danto2017 and press enter, you can see the IP of the other person's computer. 7. Next to the CMD you type shutdown - will appear in the Remote Shutdown Dialog dialog box, select Add 8. Enter the victim's IP address, see step 6, select the Restart or Shutdown option you want, change the Display Warning For time span to 5 seconds 9. Add comments if you want for example "Your computer will we turn off, the server is in the process of repair. Thank you" 10. Then to turn off the other person's computer, press OK For the sake of how to turn off other people's computers through CMD that you can use to disconnect other people's wifi connections from your computer, don't forget to share this hacking article huh ^ _ ^ Hopefully Helpful: *
SYN flooding attack
In a SYN flood attack, the client will flood the server with many TCP SYN packets. Each TCP SYN packet sent causes the server to respond with a TCP SYN ACK packet. The server (recipient) will continue to log (create a backlog queue) to wait for TCP ACK responses from clients sending TCP SYN packets. The backlog queue is certainly limited & is usually small in memory. When the backlog queue is full, the system will not respond to other TCP SYN packets that enter in its simple language the system looks blank / hangs. Unfortunately, the TCP SYN ACK packet that enters the backlog queue will only be removed from the backlog when there is a time out of the TCP timer indicating there are no responses from the sending client. Usually this TCP internal timer is set quite long.
The key to SYN attacks is to flood the server with TCP SYN packets using chaotic source IP addresses. As a result, because the source IP address does not exist, obviously no TCP ACK will be sent as responds from TCP SYN ACK packet responses. In this way, the server will look like a blank and does not process responses in a long time. Various computer vendors have now added defense to this SYN attack & firewall programmers also guarantee that their firewalls do not send packets with chaotic source IP addresses.
And in this SYN attack the attacker will send a large amount of SYN data and will be sent to the ports on the existing host with an invalid SYN data address or contents, so the host or computer that receives the data packet becomes confused and sending a SYN ACK data packet that has no purpose here results in losing a lot of SYN data in the router and causing the router to crash because it waits for a reply from the computer inside the SYN address the first time.
1. Open the terminal or CTRL + ALT + T
2. Then type the command sudo apt-get install hping3
3. Wait for the process to finish.
4. To find out the features of hping3, you can see the documentation by typing man hping3 or hping3 -help in the terminal.
To do a syn flood, we use hping3 that was installed before. Here's how to do syn flood.
1. Open the terminal.
2. Type the command hping3 -I wlan0 -c 1000000 --faster -S 10.10.10.1
information :
-I = shows the interface used to join the network
-c = cont packet to be sent, in a big sense the packet to be sent is 1000000 bytes
- faster = the speed of the 1000 data that will be sent in the network
-S = source or destination that will be sent this flooding packet
Prevention:
blocking null packages
iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
-A = add rulles ..
-p = protocol
farewall takes all incoming packets that are marked with the ALL NONE flag and then Drop it. This pattern of attack uses this to try and see how we configure VPN and find out weaknesses
and next to reject the SYN attack
iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
SYN-Flood-Attacks means the attack opens a new connection but with empty packages (ie. SYN, ACK,).
iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP