Covering your tracks and installing backdoors, 2 2
also known as digging in deep. 3 3
So at this point we've performed our reconnaissance. 4 4
We've scanned and enumerated. 5 5
We've gained our access. 6 6
We've escalated our privileges. 7 7
We've maintained our access, and moved laterally, 8 8
and now we want to make sure we're in here for the long haul 9 9
How do we make sure we don't get caught? 10 10
Well, this is where we have to cover our tracks 11 11
and place some backdoors. 12 12
So what does that really mean? 13 13
Well, covering our tracks and installing backdoors 14 14
means we're gonna erase the evidence. 15 15
We're gonna modify the evidence. 16 16
We're gonna disable logging. 17 17
We can clear log files. 18 18
We can hide log files and folders. 19 19
We can install rootkits and backdoors, 20 20
and we can even set up call back times, 21 21
so the machines call us back at certain times of the day, 22 22
instead of maintaining a persistent connection, 23 23
all of the time. 24 24
These are all different ways for us to cover our tracks. 25 25
So, let's talk about erasing the evidence. 26 26
The first thing you want to do, 27 27
is you want to erase any temporary files. 28 28
These would include log files, 29 29
or any droppers that you've put on the system. 30 30
So if I've put on a stage one malware, 31 31
then I want to delete it, 32 32
because now that I've got stage two, 33 33
I don't need stage one anymore. 34 34
If I went into the Windows temporary directory, 35 35
and that's where I've been putting my log files, 36 36
and gathering my information at, 37 37
I want to download that information, 38 38
and then delete those files. 39 39
Anything that I have on the system 40 40
could be found by a system administrator, 41 41
so I want to clean up as much as possible. 42 42
Modifying the evidence. 43 43
So when I modify the evidence, 44 44
I'm gonna change the contents of the log files. 45 45
So I might go into a log file and change it 46 46
so that my IP is not the one that's being shown. 47 47
So the other thing you have to worry about 48 48
is the time on the files. 49 49
So if I have a log file, and I've edited that IP right now, 50 50
then the time modified is going to show up as right now, 51 51
not the last time the system administrator used it. 52 52
So what I can use is the program Timestomp 53 53
as part of Meterpreter to actually change 54 54
that last access time to a time in the past, 55 55
so that it won't look suspicious that I did this today. 56 56
Again, anything that I can do 57 57
to throw those system administrators off 58 58
is gonna be better for me as the attacker. 59 59
The other thing I wanna do, is I can change user identities. 60 60
Instead I wanna change that instead of saying 61 61
user Jason has done this, 62 62
I want to say user Bob has done this. 63 63
Any of those things that can throw the system administrators 64 64
off my scent is always a good thing for me. 65 65
So how do you use Timestomp? 66 66
Well, there's a couple of different ways. 67 67
I talked about the fact 68 68
that Meterpreter has a built-in tool for this, 69 69
but if you're using Linux, Unix, or OSX, 70 70
there's also two other ways you can do this. 71 71
One is you can use touch. 72 72
And what touch does 73 73
is actually updates the time to the current time. 74 74
This is not as useful as using something like Timestomp, 75 75
because it's gonna make it as if we modified 76 76
it right this second, 77 77
which may not be the most covert thing for us to be doing. 78 78
The other thing we can do is use ctime, 79 79
which changes the to a given date and time. 80 80
This is a lot more useful, 81 81
and is essentially what we're doing with Timestomp 82 82
inside of Meterpreter. 83 83
So I can go back and say, 84 84
hey the last time this file was accessed 85 85
was two and a half weeks ago at 1:38 p.m. 86 86
That's what ctime allows you to do. 87 87
Another thing you can do, 88 88
is you can actually turn off logging. 89 89
So let's say I broke into the system right now. 90 90
One of the first things I might want to do, 91 91
is disable logging, go do all my exploitation, 92 92
and then re-enable logging. 93 93
That way, I don't have to go and clean up 94 94
300 different things that I did, 95 95
I only have to clean off the initial getting on the system, 96 96
and the initial getting off the system. 97 97
Auditpol is a command-line tool from the NT Resource Kit. 98 98
This is how you can actually disable logging 99 99
inside of Windows. 100 100
One of the other ways that we can do things 101 101
is we can clear off those log files. 102 102
Now, Winzapper, Evidence Eliminator, Elsave 103 103
these will all erase log files. 104 104
If you're in Linux, a lot of those log files 105 105
are text-based files. 106 106
So you can actually just delete those files. 107 107
Now the problem is, while this does cover your tracks, 108 108
and they won't be able to track it back to you, 109 109
it is very obvious. 110 110
Because system administrators 111 111
are used to looking at log files. 112 112
And if they go to the log files and there is no log file, 113 113
they're going to know they have been hacked. 114 114
And so this is something you only want to do 115 115
if you run out of time and you can't modify those log files, 116 116
that's when you'd go and clear the entire log files. 117 117
Now, the other thing here is that, as an ethical hacker, 118 118
we have no use to do this. 119 119
There's no reason we would ever clear the log files, 120 120
because we're gonna cover up bad guys as well as ourself, 121 121
if we do this. 122 122
So in an ethical hacking event, 123 123
you will not be clearing the log files. 124 124
You may modify them, but you will never clear them. 125 125
So while I'm on the system, 126 126
what are some other ways I can hide myself? 127 127
Well besides disabling log files, 128 128
and deleting log files, and modifying log files, 129 129
I can also hide files and folders. 130 130
So, if I'm using a Linux or a Unix system, 131 131
hidden files are going to start with a dot. 132 132
If you're using Windows, 133 133
we can do things like an alternate data stream. 134 134
And we'll go through this is a lab environment 135 135
to show you how easy it is 136 136
to do an alternate data stream as well. 137 137
Another way you can do this is you can use hidden attributes 138 138
So in Windows you do the plus-h, 139 139
that's going to show it as a hidden file. 140 140
You can also put files into low-traffic areas. 141 141
How often do people go and look at the 142 142
C:\Windows\System32 folder? 143 143
Probably not very often. 144 144
So we can hid some stuff in there if we wanted to. 145 145
The other thing that you can do 146 146
is you can hide things in slack space. 147 147
Slack space is not directly accessible 148 148
by the operating system. 149 149
But there's tools that you can use 150 150
to go and use that empty space on the hard drive, 151 151
and put files there that are then accessible to you, 152 152
and not to the general public. 153 153
Alternate data streams. 154 154
So alternate data streams provide a method 155 155
to hid malware on an NTFS file system. 156 156
So these streams are almost completely hidden, 157 157
the file size won't really increase that much, 158 158
and you'll be able to hide files inside other files. 159 159
And the way you do this, is you're gonna do: 160 160
type, the file you wanna hide, a right caret, 161 161
the file you want to hide it in, colon, 162 162
and then the file you were hiding. 163 163
So, for example, if I was hiding notepad inside of calc, 164 164
I would do type, notepad.exe, right caret calc.exe, 165 165
colon, notepad.exe 166 166
Now when I would run it, I'm just gonna do 167 167
start calc.exe colon notepad.exe. 168 168
Again, I'm running that hidden file, notepad, 169 169
which is hidden inside of calc. 170 170
Now, what does that look like in a real system? 171 171
Well if you notice here on the top, 172 172
I have calc.exe as a 91k file. 173 173
A 91,408 bites is actually how large it is. 174 174
Now I'm gonna hide notepad inside of calc. 175 175
Did it make it go any larger? 176 176
No, it's still 91 hundred 408 bites. 177 177
So, for all intents and purposes, you can't see the fact 178 178
that I have notepad inside of 179 179
calc in the bottom part of the screen. 180 180
But, it is there. 181 181
And if I type start calc.exe colon notepad.exe, 182 182
it will launch a notepad program for us. 183 183
So we talked about hiding in the slack space. 184 184
In Linux we have a program called Bmap. 185 185
And we can use that to hide files in the slack space. 186 186
What exactly is the slack space? 187 187
Well, when you put in a file, on a hard drive, 188 188
a hard drive is actually divided into sectors. 189 189
And there's sometimes extra space. 190 190
We call that the slack space. 191 191
So when the file ends, for instance in the picture here, 192 192
here I have six and a half parts out of eight 193 193
are taken up by that green file. 194 194
That left about one and a half of orange that is empty. 195 195
Now that empty space can actually be used and 196 196
hide files in there. 197 197
The file system won't read it, they won't realize it's there 198 198
But I'll know it's there, as the attacker, 199 199
and I can actually go in and put my files in there 200 200
and use that extra empty space. 201 201
It's a great place to hide. 202 202
It makes it very hard for people to find your stuff. 203 203
Another way we can hide 204 204
is by installing rootkits and backdoors. 205 205
Now, what is a rootkit? 206 206
Rootkits were originally only on Linux, 207 207
but now they're on Windows too. 208 208
Some good examples are FU, Vanquish, Hacker Defender, AFX. 209 209
And what rootkits are, is they actually, will actually 210 210
bind into the operating system themself, and hide themselves 211 211
so that it can actually take over some of the commands. 212 212
So when a system administrator is giving commands, 213 213
it's actually giving commands 214 214
where it thinks to the operating system, but it's not. 215 215
It's giving it to the rootkit, 216 216
who then gives them back false information. 217 217
This allows us to hide and keep ourselves hidden longer. 218 218
Another thing we can do is we can setup backdoors. 219 219
And again, like I talked about before, 220 220
those backdoors can be things like callouts, 221 221
and we can do that with scheduling and timing. 222 222
So, for Windows how do we do that? 223 223
We can use SC, which is managing our services. 224 224
We can start and stop services 225 225
that would start and stop our malware. 226 226
We can use netsh which will modify our Windows firewall 227 227
opening up ports, 228 228
and then we can use at 229 229
which is an automatic time scheduler. 230 230
It will schedule programs to run at certain times. 231 231
So maybe every morning at two a.m. 232 232
I want the Windows system to go 233 233
and do a ping back to my host. 234 234
That tells me that that Windows system 235 235
is still under my control, 236 236
and available for me, if I need it. 237 237
That could be something like a beacon. 238 238
And that's one of the ways that I can use that, 239 239
is so I can know, hey, 240 240
all the systems will call back to me at two a.m. 241 241
I get one ping from them, every 24 hours, 242 242
I know they're still mine. 243 243
And then, if that doesn't come back, 244 244
I know that either the machine is off, 245 245
or that the defenders have found me and cleared my malware. 246 246
Now on Linux, and Unix, and OSX, 247 247
we use things like cronjobs. 248 248
Crontab will set up tasks to run in the future. 249 249
This is like the at command we had in Windows. 250 250
And at also works in Linux and Unix, 251 251
so you can schedule programs to run at certain times, 252 252
just like we did in Windows. 253 253
Again, that's an automated time setup for the future. 254 254
You can have it do anything you want. 255 255
I've set up some at jobs on people where 256 256
at three in the morning, 257 257
it will actually start playing music for them. 258 258
And the reason why we do that is 259 259
it can be used like an alarm clock. 260 260
Or again, as one of those prank things, 261 261
or one of those things to show system administrators, 262 262
hey, I got you, you didn't find me, it's been three weeks, 263 263
so now I'm gonna set off music at three in the morning 264 264
so you'll know that I'm there. 265 265
So there's lots of different ways 266 266
that we can cover our tracks, 267 267
that we can place backdoors as we go through our systems. 268 268
These are just a small quick summary 269 269
of some of the minor ones. 270 270
So now that we've talked about 271 271
some of the ways we can cover our tracks and place backdoors 272 272
we're going to go into our lab environment, 273 273
and we're gonna play with both the alternate data streams 274 274
and the time schedule.