GCIH - Book 5
GCIH - Book 5 Backdoor - ANSWER Is a program that allows an attacker to access a system, bypassing security controls, such as user credentials Trojan Horse - ANSWER a program that looks innocuous but is actually sinister Some examples of tools that give an attacker complete control of a system... - ANSWER Poison Ivy, Virtual Network Computing (VNC), Dameware (commercial), sub7 VNC - ANSWER Flexible, cross-platform remote access suite. Some companies use it for legitimate remote administration. Subject to monkey in the middle and buffer overflow attacks. For VNC, you can set up SSH port redirection for TCP port 5900 to establish far more secure VNC session - ANSWER true VNC runs in two modes - ANSWER Active and Listening VNC active mode - ANSWER connects to server listening on a port (TCP 5900 by default) VNC Listen mode - ANSWER waiting for server to send a connection to the client - "Shoveling" GUI. Here it uses TCP 5500 by default WinVNC two modes - ANSWER App mode (shows up in tool tray) Service mode (shows up in service list and in tool tray after reboot) Scareware - ANSWER scaring people into believing their systems are compromised. it is possibly legal in some places Wrappers - ANSWER A tool that integrates a backdoor program into any other program. These are also known as "EXE Binders" or simply "Binders". Examples of this include SaranWrap and EliteWrap Veil - ANSWER an AV bypass tool. Utilizes some Wrapper techniques Examples of packing algorithms - ANSWER UPX, Yoda, Themida, Exe32pack Examples of memory dump tools - ANSWER Mandiant's Memoryze MemoryDD.bat HBGary's fastdump Matthieu Siche's win32dd winpmen FTKimager ManTech's mdd Volatile System's Volatility Framework - ANSWER free, open-source tool that pulls an enormous amount of information from Windows dumps, including network connections, running processes, loaded drives, etc
Geschreven voor
- Instelling
- GCIH
- Vak
- GCIH
Documentinformatie
- Geüpload op
- 28 mei 2023
- Aantal pagina's
- 6
- Geschreven in
- 2022/2023
- Type
- Tentamen (uitwerkingen)
- Bevat
- Vragen en antwoorden
Onderwerpen
-
gcih book 5
-
gcih
-
such as user credentials
-
backdoor answer is a program that allows an attacker to access a system
-
bypassing security controls
