427 Botnet fm qxd

www.syngress.com
Using Sandbox Tools for Botnets • Chapter 10
379
427_Botnet_10.qxd 1/9/07 3:06 PM Page 379

---

notification would be reported.Therefore, it might be necessary to use the
parameter 
SHOW_QUANTITIES_IN_REPORT
. If this attribute is enabled,
the quantities for each contained notification are included into the analysis
report as well. In that case a (badly implemented) DOS attack would look like
one of these:
remoteport="80" protocol="Unknown" connectionestablished="1"
socket="1228" quantity="324"/>
remoteport="123" connectionestablished="0" socket="3444" quantity="432"/>
A lot of malware installs backdoors on the infected host such that its oper-
ator (or whomever) is able to connect to this host remotely.The power of
such backdoors ranges from simply enabling remote access to the local file
system or giving a simple command shell to the attacker to offering a com-
plete graphical interface. Remote access to the file system can easily be set up
by creating a new share:



Malware could also try to escalate the security privileges of existing users
such that a regular login can be used for much more powerful operations than
it was intended to:
commandline="net localgroup administrators ftpuser /add"/>
commandline="net localgroup administratoren ftpuser /add"/>
commandline="net localgroup administradores ftpuser /add"/>
commandline="net localgroup administrateures ftpuser /add"/>
Real
backdoors bind themselves to a network port and implement com-
plete servers. Evidence for such activity can be found in the section 

tions_listening>
: