427 Botnet fm qxd

www.syngress.com
Advanced Ourmon Techniques • Chapter 9
331
427_Botnet_09.qxd 1/8/07 4:45 PM Page 331

---

In this third example, we show how to use the Unix script command to
create a log of any 
ngrep 
output.This allows you to leave the computer
without worrying about interesting information scrolling off the screen.
Script
records all output in a file called 
typescript 
by default in the local directory.
Control-D
is end of file, which terminates the 
script
session.
Script 
can take an
argument like 
serverip.log
so that you can choose the filename for logging and
avoid the default filename 
typescript
.
So, what might we see? Given our first example, you could see something
like this:
T 192.168.1.1:1036 -> 10.0.0.1:7007 [AP]
PRIVMSG ##xploit :.e.(1.0b) ( tftpd.m.d.l ) ....
File sent to 192.168.1.
70, executing C:\WINDOWS\System32\winPE.exe on remote machine...
T 192.168.1.1:1036 -> 10.0.0.1:7007 [AP]
PRIVMSG ##xploit :.e.(1.0b) ( ftp.m.d.l ) ....
File sent to 192.168.1.70
, executing C:\WINDOWS\System32\winPE.exe on remote machine...
If you have any doubts about this you could always search the Internet for
winPE.exe
. In that case, you will find
http://www.sophos.com/security/analyses/w32rbotajl.html to make for
interesting reading.
Ngrep
is telling us that TCP is being used (T) and that packets are going
from 192.168.1.1 at port 1036 to the remote (botnet server!) 10.0.0.1 at port
7007.The channel name is 
#xploit
and the message is rather alarming.
Apparently a new system has just been exploited, and some file named win
PE.exe has been downloaded to it.
Ngrep
is a fine tool and can be used to watch current targets or used with
previously stored tcpdump format information.
On the other hand, one might find something suspicious in a previous
ourmon IRC summarization (see Table 9.3).