Hack Security Pro.pdf - Index of

Please note that if this keylogger remains invisible from the list of Windows processes, other tools
dedicated to process monitoring will reveal it to a watchful eye. Please refer to our chapter on
monitoring.
3.Backdoors and rootkits
A) Backdoor applicative
This type of backdoor is generally uploaded on the system by the hacker once he has obtained
access. On both Linux and Windows, it can be an applicative running as a server to bind a shell, or it
can send back this access to the hacker with reverse connection methods. Following this principle, a
simple netcat could do. Of course, the main problem for the hacker with this type of backdoor is that
they are in no way discreet.
To automatically launch a backdoor when starting the system, there are several possibilities:
On Windows:
➢ Installation in the start menu
Each user's start menu is a directory accessible in the personal directory of each user, allowing him to
start an applicative at the start of a system. All that has to be done is to copy any executable in order
to have it automatically launched at boot.
➢ The register base
On Linux:
➢ rcX.d files
All services launched when the system is started are placed in the rc.init directory. They are started
according to a specific runlevel, from 1 to 6. To be activated at the start, a symlink must be created in
the rcX.d file corresponding to the proper runlevel.
RUNLEVEL DETAIL
0 System stopped
1 Starting mono user
2 Starting multi-user without network
3 Starting multi-user with network
4-5 Starting multi-user, Xwindow network
6 Restarting
To placer a backdoor on the system:
#cp backdoor /etc/init.d/
#cd /etc/rc3.d
#ln -s /etc/init.d/rc3.d
The Hackademy DMP -178/209- SYSDREAM