Will You Be My Dropper
Let’s discuss real-world attack scenarios and describe how these concepts translate
into a penetration test.
To initiate a client-side attack,
an attacker often delivers a Trojan,
in the form of a script or document,
to the victim and tricks them into executing it.
Traditional trojans embed an entire payload,
but more complex Dropper trojans
rely on a staged payload
with a Callback function
that connects back to the attack machine
to download the second stage.
Once the code has been delivered,
it may be written to the hard disk or run directly from memory.
Either way, the objective of the code is to create a communication channel
back to the attacker.
The code which is run on the victim’s workstation is known by several,
often synonymous names
including an Implant, Agent, Backdoor, or simply Malware.
Once this code is executed on the client, it must connect to a “Command and control”
or C2, infrastructure in order to communicate back to the attacker.
This code will contain the attacker’s hostname and domain name
or IP address and will leverage an available network protocol
such as HTTP or HTTPS,
which may simulate user activity,
or DNS, which simulates common network activity.
The Metasploit framework simplifies this process.