preview

Nt1330 Unit 2 Reaction Paper

Decent Essays
Open Document

In order to let Syringe inject the target process, we create a remote thread in the process, and then the thread loads Serum into itself. Because of the Windows design, we cannot control an existing thread of a process, but we can create a thread in a certain process to do a specific task. We use CreateRemoteThread() [30] to create a thread in the certain process we want to hook. The thread calls the LoadLibraryA() [31] function that loads Serum, so that the process does whatever we want it to do in Serum.
Windows Sockets 2 (Winsock) enables programmers to develop a socket program. The Ws2_32.dll in Windows includes functions for users to handle windows sockets, like create a connection, or send and receive packets.
Serum changes the entry points of the functions of Ws2_32.dll file. We modify the entry points of the functions we want to hook for jumping to our own hack functions and then jumping back to the …show more content…

We need to increase the number of count so that we can send many connections out at the same time. Every count can own their unique ID attaching to each connection, so that they cannot be confused.
We hook the functions of Winsock now. In order to achieve a more comprehensive protection on the victim-side, we will hook the functions of Kernel, like CreateFileA(), WriteFile(), and others that attackers want to use to do some malicious to restrict what attackers can do.
Until now there are still many botnets want to spread themselves. The attacker can launch Distributed Denial of Service (DDoS) through a massive botnet. Honeypot is one of the most efficient tools for detecting a botnet at the present time, but honeypot had been easily detected by botnet [24][25] before. Since we find a way to fix the problem now, we can focus on defending botnet in the future. We want to use DEH to find the C&C server that has not been found and destroy

Get Access
Related
Get Access