427 Botnet fm qxd

What Does a Botnet Do? 
A botnet is a collection of networked computers.They can do anything you
can imagine doing with a collection of networked computers.The next few
topics describe some of the uses of botnets that have been documented to
date.
Recruit Others
The most basic thing each botclient does is to recruit other potential bot-
clients.The botclient may scan for candidate systems. Rbot, for example,
exploits Windows shares in password guessing or brute force attacks so its
botclients scan for other systems that have ports 139 or 445 open, using tools
like smbscan.exe, ntscan.exe, or scan500.exe. It also used the net command
(net view /DOMAIN and net view /DOMAIN:<
domain name
>) to list
NetBIOS names of potential candidate clients.
www.syngress.com
42
Chapter 2 • Botnets Overview
427_Botnet_02.qxd 1/9/07 9:49 AM Page 42

---

The botclient may be equipped to sniff network traffic for passwords.The
clients use small, specialized password grabbers that collect only enough of the
traffic to grab the username and password data.They may harvest encrypted
forms of passwords in the SAM cache using a program like pwdump2, 3, or 4
and use SAM password crackers like Lopht Crack to break them. For some
encrypted password data, they reformat the password data into a UNIX-like
password file and send it to another, presumably faster, computer to brute
force.
When the botherder discovers a botclient that uses encrypted traffic to a
server, he or she may include a tool, such as Cain and Abel, to perform man-
in-the-middle (MITM) attacks as part of the payload. In the MITM attack
(see Figure 2.2), the botclient convinces other computers on its subnet that it
is actually the default gateway through Arp cache poisoning, and then relays
any data it receives to the actual gateway.
Figure 2.2
Arp Cache Poisoning for MITM Attacks