Notice that the address implies that you are on the attacker??™s local computer;
but you are not. We know this because the attacker??™s machine is a Windows
2000 machine and it is not running a Web server, but the target is.
Redirection
617
To verify this, open Internet Explorer and enter the local IP address of the
target machine. You will receive the same screen as the one on the attacker??™s
machine.
*Note:
I cannot stress enough how effective port redirection is and how easy it is
to use. Many times if an attacker can gain access to a compromised computer
on the network that has access to the ???sweet spot??? within the network, a port
redirection is set up to facilitate an easier path back to this ???sweet spot??? at a
later time. The best way to find port redirection is to know exactly what
computer is supposed to have what ports open and routinely validate that
only those ports are in use.
618
Practical Hacking Techniques and Countermeasures
Lab 87: Executing Applications ??“??“ Elitewrap
Executing Hidden Applications: Elitewrap
Prerequisites:
NULL Session
Countermeasures:
Updated antivirus, frequent file verification
Description:
Elitewrap is a command-line application used to ???wrap???
applications within other applications. Elitewrap offers users the option
to hide program execution and execute as many applications as they
desire. This lab will demonstrate how to have a target execute an
application that brings up the Windows calculator and covertly execute
a netcat backdoor listening port to be exploited from another computer.
Pages:
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210