PDF - Xakep Online

ÂçëîìÕÀÊÅÐ\¹39\Ìàðò\2002DDOS - ÍÅÏÎÁÅÄÈÌÀß ÑÈËÀ ZOÌÁÈStalsen (stalsen@mail.ru)< Folder1 >DDOS - íåïîáåäèìàÿñèëà Zoìáè ýòîé ñòàòüå ÿ õî÷ó ðàññêàçàòü òåáå îDistributed Denial of Service (ðàñïðåäåëåííûåàòàêè òèïà Îòêàç â Îáñëóæèâàíèè), ñîêðàùåííîDDOS. Òû íàâåðíÿêà ïîìíèøü èñòîðèþî çàâàëåííûõ ñåðâàêàõ CNN, eBay,Yahoo... Èñïîëüçîâàëàñü òà ñàìàÿ DDOS àòàêà,ïîñòàâèâøàÿ íà êîëåíè ýòè ãèãàíòû ïåðåä16-ëåòíèì ïàðíåì.Ñõåìà àòàêè òàêîâà: Òû ëîìàåøü êàê ìîæíîáîëüøå óäàëåííûõ õîñòîâ, óñòàíàâëèâàåøüíà íèõ äåìîíû DDOS, æäóùèå ñîåäèíåíèÿ, èñïîêîéíî, ñèäÿ ó ñåáÿ äîìà, îäíîéêîìàíäîé çàñòàâëÿåøü èõ âñåõ ðèíóòüñÿâ áîé è çàâàëèâàòü íóæíóþòåáå æåðòâó. Ðåàêöèÿ ïîñëåäóåò íåìåäëåííî.Ê òîìó æå ìîæíî ñïîêîéíîñïóôèòü ñâîé IP'øíèê. È, åñòåñòâåííî,÷åì áîëüøå ó òåáÿ õîñòîâ,òåì áîëüøå ó òåáÿ ñèëû...ÎñóùåñòâëåíèåÊîíå÷íî, äëÿ ýòîãî ñîçäàíû ñïåöèàëüíûåóòèëèòû, îáëåã÷àþùèå òåáåæèçíü. Âîò î íèõ è ïîãîâîðèì...StacheldrahtÍà÷íåì ñ ýòîé ïðîãè. Coded by randomizer in1999. mserv.c - ñîáñòâåííî ñàì ìàñòåðñåðâåð,êîòîðûé ïðè çàïóñêå âåøàåòñÿ â áýêãðàóíä.Æåëàòåëüíî èçìåíèòü íåêîòîðûå äèðåêòèâû,óñòàíîâëåííûå òàì ïî äåôîëòó.Êñòàòè, â client.c òîæå æåëàòåëüíî èçìåíèòüâñå :). Íî ãëàâíîå - âñå ôàéëû äîëæíûáûòü ñîñòûêîâàíû, ò.å. èçìåíåíèÿ âîáîèõ ôàéëàõ íå äîëæíû ïðîòèâîðå÷èòüäðóã äðóãó. td.c - äåìîí DDOS, îñíîâàí íàTFN (îïèñàíà íèæå).Äóìàþ, òû óæå çàïóòàëñÿ ñî âñåìè ìàñòåðñåðâåðàìè,äåìîíàìè, êëèåíòàìè è ò.ä. Ïîïðîáóþðàçúÿñíèòü âñå ïîäðîáíåå.Òû íà õàêíóòîé ìàøèíå óñòàíàâëèâàåøüîáû÷íûé ääîøíûé äåìîí, â äàííîì ñëó÷àåtd, ïðåâðàùàÿ ìàøèíó â Zîìáè (êñòàòè, îíâåøàåòñÿ â áýêãðàóíä ïîä ïñåâäîíèìîìnfsiod). Äåìîíó íóæíî çíàòü èìÿ/èìåíà ìàñòåðñåðâåðà,÷òîáû ïðèíèìàòü îò íåãî êîìàíäû,íó è ïîðò ïðèåìà. Çàïóñêàåì äåìîí... ìàñòåðñåðâåðå òû óêàçûâàåøü àäðåñà õîñòîâZîìáè, ïîðò äëÿ îòïðàâêè è ÏÎÐÒ ÄËßÊÎÍÍÅÊÒÀ ÊËÈÅÍÒÀ. Çàïóñêàåì ìàñòåðñåðâåð(çàïóñêàé ãäå õî÷åøü, íî ëó÷øå íà âçëîìàííîéìàøèíå, äàæå ïîâåðõ äåìîíà). êëèåíòå òû ëèøü ââîäèøü (âñå äåëàåòñÿ,êîíå÷íî, â èñõîäíèêàõ) ïîðò, êîòîðûé ïðîñëóøèâàåòìàñòåðñåðâåð. Íåìíîãî òðóäíîâàòî,íî îñâîèòü ìîæíî :).Èòàê, âñå ñäåëàíî, çàïóñêàåì êëèåíò:#./client / I N S E R T /Ëèíêè íà ñîôò:http://packetstormsecurity.org/distributed/trinoo.tgz- Trinoohttp://packetstormsecurity.org/distributed/tfn2k.tgz- TFN2khttp://packetstorm.widexs.nl/distributed/mstream.txt - Mstreamhttp://packetstormsecurity.org/distributed/stachel.tgz- Stacheldraht[*] stacheldraht [*](c) in 1999 by randomizertrying to connect...connection established.----------------------------enter the passphrase : _#Ââîäè ïàðîëü. Ïî äåôîëòó sicken.entering interactive session.******************************welcome to stacheldraht******************************type .help if you are lamestacheldraht(status: a!1 d!0)>< Âçëîì >20/03\02Âîò, â ïðèíöèïå, è âñå. À äàëüøå íàáèðàéhelp :). Êîìàíä óéìà. Íî ëè÷íî ÿ ñ÷èòàþ ÷òîSTACHELDRAHT - äîâîëüíî çàìîðî÷åííûéDDOS'íûé òóëç :). Íàñòðîåê áîëüøå ÷åì íàäî,óéìà âîçíè ñ èñõîäíèêàìè.  interactivemode íåëüçÿ âñå äåëàòü îäíîé êîìàíäîé, òîåñòü ñíà÷àëà íàäî äîáàâèòü IP æåðòâû, ïîòîìâûáðàòü ìåòîä ôëóäà, ïîòîì íà÷àòü àòàêóè ò.ä. Ê òîìó æå â íåêîòîðûõ âåðñèÿõ/ñèñòåìàõâîçíèêàþò ïðîáëåìû ñ ïàðîëåì. ×òîåñòü ïîëó÷øå? :) ×èòàé íèæå...62 Íüþñû 1 Ôåððóì 2 PC_Zone 3 X-Ñòèëü 4 ÂçëîìTFN2kTribe FloodNet. Íàïèñàí Mixter'îì. Êàê óòâåðæäàåòàâòîð, ýòà ïðîãà áûñòðîäåéñòâóþùàÿè ïðàêòè÷åñêè íåóëîâèìàÿ. Äåéñòâóåòïî òåõíîëîãèè êëèåíò/ñåðâåð. Òû íà óäàëåííûõìàøèíàõ ñ ïðàâàìè ðóòà çàïóñêàåøüñåðâåð, îäèí, âòîðîé,òðåòèé, à êëèåíòîì êîííåêòèøüñÿíà ýòè ñåðâàêè è îòäàåøü êîìàíäû,íàïðèìåð, ôëóäèòüwww.nasa.gov. Íî õâàòèò òåîðèè,ïåðåéäåì ê ïðàêòèêå.Ðàçàðõèâèðóé àðõèâ. Æìè make.Òåáÿ ïîïðîñÿò ââåñòè ïàðîëü.Âñå, ïåðâàÿ ñòàäèÿ çàâåðøåíà.Èòàê, td - ýòî ñîáñòâåííî ñåðâåð.Çàïóñòè åãî íà ñâîåé ìàøèíå,à ïîòîì êëèåíòîì (tfn) îòäàåøüïðèêàç:#./tfn -P tcp -h localhost -i www.ÂÐÀÃ.ru -c 4Protocol: tcpSource IP: randomClient input: single hostCommand: stop floodingPassword verification: #òóò ââîäèøü ñâîé ïàðîëü.×òî, ïàðîëü íåâåðíûé? :) Òîãäà ñêà÷àétfnRECOVERY(http://packetstorm.widexs.nl/distributed/tfn2kpass.c) êîìïèëèðóé åå, çàïóñêàé#./rec è ïîëó÷è ñâîé ïàðîëü. À ìû ïîêà ïðîâåðèìïðîãó â äåéñòâèè.Ñöåíàðèé 1Èòàê, ó òåáÿ åñòü îäíà ìàøèíà [A] ñ óñòàíîâëåííûìtfn ñåðâàêîì. È öåëü - [B]. ×òî ìûäåëàåì? Íàáèðàåì êîìàíäó:./tfn -P tcp -h [A] -i [B] -c 4Òåïåðü ìû ôëóäèì õîñò [B], ÷åðåç õîñò [A](îïöèÿ 4 - UDP Flood), òâîé àäðåñ ïî äåôîëòóçàñïóôåí, íî åãî ìîæíî óêàçàòü, èñïîëüçóÿîïöèþ -S :).