Lab 3: Maintain Remote Access and Hide Malicious Activities

Module 06: System Hacking

Lab 3: Maintain Remote Access and Hide Malicious Activities

Task 2: User System Monitoring and Surveillance using Spytech SpyAgent

Spytech SpyAgent is a powerful piece of computer spy software that allows you to monitor everything users do on a computer—in

complete stealth mode. SpyAgent provides a large array of essential computer monitoring features as well as website, application,

and chat-client blocking, lockdown scheduling, and the remote delivery of logs via email or FTP.

refer to blog

---------------------------------------------------------------------------------------------------------------------------------------

Module 06: System Hacking

Lab 3: Maintain Remote Access and Hide Malicious Activities

Task 3: Hide Files using NTFS Streams

A professional ethical hacker or pen tester must understand how to hide files using NTFS (NT file system or New Technology

File System) streams. NTFS is a file system that stores any file with the help of two data streams, called NTFS data streams,

along with file attributes. The first data stream stores the security descriptor for the file to be stored such as permissions;

the second stores the data within a file. Alternate data streams are another type of named data stream that can be present within

each file.

refer to blog

---------------------------------------------------------------------------------------------------------------------------------------

Module 06: System Hacking

Lab 3: Maintain Remote Access and Hide Malicious Activities

Task 4: Hide Data using White Space Steganography

An attacker knows that many different types of files can hold all sorts of hidden information and that tracking or finding these

files can be an almost impossible task. Therefore, they use stenographic techniques to hide data. This allows them to retrieve

messages from their home base and send back updates without a hint of malicious activity being detected.

These messages can be placed in plain sight, and the servers that supply these files will never know they carry suspicious content.

Finding these messages is like finding the proverbial “needle” in the World Wide Web haystack.

Steganography is the art and science of writing hidden messages in such a way that no one other than the intended recipient knows of

the message’s existence. Steganography is classified based on the cover medium used to hide the file. A professional ethical hacker

or penetration tester must have a sound knowledge of various steganography techniques.

Whitespace steganography is used to conceal messages in ASCII text by adding white spaces to the end of the lines. Because spaces

and tabs are generally not visible in text viewers, the message is effectively hidden from casual observers. If the built-in

encryption is used, the message cannot be read even if it is detected. To perform Whitespace steganography, various steganography

tools such as snow are used. Snow is a program that conceals messages in text files by appending tabs and spaces to the end of

lines, and that extracts hidden messages from files containing them. The user hides the data in the text file by appending

sequences of up to seven spaces, interspersed with tabs.

refer to blog

---------------------------------------------------------------------------------------------------------------------------------------

Module 06: System Hacking

Lab 3: Maintain Remote Access and Hide Malicious Activities

Task 5: Image Steganography using OpenStego

Images are popular cover objects used for steganography. In image steganography, the user hides the information in image files

of different formats such as .PNG, .JPG, or .BMP.

THIS BELOW IS HOT TO PUT HIDDEN TEXT INTO A IMAGE BUT AFTER THE SPACE WILL BE HOW TO GET IT OUT !!!!!!

Z:\CEHv11 Module 06 System Hacking\Steganography Tools\Image Steganography Tools\OpenStego

and double-click Setup-OpenStego-0.7.3.exe.

click the start button or windows key

open steggo should be there to open

click run open steggo

click the 3 dots under the message file box

Navigate to Z:\CEHv11 Module 06 System Hacking\Steganography Tools\Image Steganography Tools\OpenStego

select new text document.txt

enter

click on 3 dots under cover file

select the island.img or whatever image you ware wanting to look at

click on 3 dots for Output Stego File.

navigate to desktop

in the file location just put Stego and hit open

now click hide data in the bottom right corner

this embeds that file into the image

HOW TO EXTRACT THE DATA HIDDEN IN THE IMAGE STEGANOGRAPHY

run OpenStego

go to extract data tab

for the input stego file click the 3 dots

go to the file location in this case on the desktop

Output Folder for Message File. click the 3 dots

select the desktop hit open

click extract data

on the desktop will be a file that contains credit card info that was hidden in the picture

done

---------------------------------------------------------------------------------------------------------------------------------------

Module 06: System Hacking

Lab 3: Maintain Remote Access and Hide Malicious Activities

Task 6: Covert Channels using Covert_TCP

Networks use network access control permissions to permit or deny the traffic flowing through them. Tunneling

is used to bypass the access control rules of firewalls, IDS, IPS, and web proxies to allow certain traffic. Covert

channels can be created by inserting data into the unused fields of protocol headers. There are many unused or misused

fields in TCP or IP over which data can be sent to bypass firewalls.

The Covert_TCP program manipulates the TCP/IP header of the data packets to send a file one byte at a time from any host to

a destination. It can act like a server as well as a client and can be used to hide the data transmitted inside an IP header.

This is useful when bypassing firewalls and sending data with legitimate-looking packets that contain no data for sniffers to analyze.

A professional ethical hacker or pen tester must understand how to carry covert traffic inside the unused fields of

TCP and IP headers.

Here, we will use Covert_TCP to create a covert channel between the two machines.

refer to blog

---------------------------------------------------------------------------------------------------------------------------------------

Lab Scenario

As a professional ethical hacker or pen tester, the next step after gaining access and escalating privileges on the target system is to maintain access for further exploitation on the target system.

Now, you can remotely execute malicious applications such as keyloggers, spyware, backdoors, and other malicious programs to maintain access to the target system. You can hide malicious programs or files using methods such as rootkits, steganography, and NTFS data streams to maintain access to the target system.

Maintaining access will help you identify security flaws in the target system and monitor the employees’ computer activities to check for any violation of company security policy. This will also help predict the effectiveness of additional security measures in strengthening and protecting information resources and systems from attack.

Lab Objectives

User system monitoring and surveillance using Power Spy
User system monitoring and surveillance using Spytech SpyAgent
Hide files using NTFS streams
Hide data using white space steganography
Image steganography using OpenStego
Covert channels using Covert_TCP

Overview of Remote Access and Hiding Malicious Activities

Remote Access: Remote code execution techniques are often performed after initially compromising a system and further expanding access to remote systems present on the target network.

Discussed below are some of the remote code execution techniques:

Exploitation for client execution
Scheduled task
Service execution
Windows Management Instrumentation (WMI)
Windows Remote Management (WinRM)

Hiding Files: Hiding files is the process of hiding malicious programs using methods such as rootkits, NTFS streams, and steganography techniques to prevent the malicious programs from being detected by protective applications such as Antivirus, Anti-malware, and Anti-spyware applications that may be installed on the target system. This helps in maintaining future access to the target system as a hidden malicious file provides direct access to the target system without the victim’s consent.

Task 1: User System Monitoring and Surveillance using Power Spy

Today, employees are given access to a wide array of electronic communication equipment. Email, instant messaging, global positioning systems, telephone systems, and video cameras have given employers new ways to monitor the conduct and performance of their employees. Many employees are provided with a laptop computer and mobile phone that they can take home and use for business outside the workplace. Whether an employee can reasonably expect privacy when using such company-supplied equipment depends, in large part, on the security policy that the employer has put in place and made known to employees.

Employee monitoring allows organizations to monitor employee activities and engagement with workplace-related tasks. An organization using employee monitoring can measure employee productivity and ensure security.

New technologies allow employers to check whether employees are wasting time on recreational websites or sending unprofessional emails. At the same time, organizations should be aware of local laws, so their legitimate business interests do not become an unacceptable invasion of worker privacy. Before deploying an employee monitoring program, you should clarify the terms of the acceptable and unacceptable use of corporate resources during working hours, and develop a comprehensive acceptable use policy (AUP) that staff must agree to.

Power Spy is a computer activity monitoring software that allows you to secretly log all users on a PC while they are unaware. After the software is installed on the PC, you can remotely receive log reports on any device via email or FTP. You can check these reports as soon as you receive them or at any convenient time. You can also directly check logs using the log viewer on the monitored PC.

Here, we will perform user system monitoring and surveillance using Power Spy.

Here, we will use Windows Server 2019 as the host machine and Windows Server 2016 as the target machine. We will first establish a remote connection with the target machine and later install keylogger spyware (Here, Power Spy) to capture the keystrokes and monitor other user activities.

There are several key points to keep in mind:

This lab only works if the target machine is turned ON
You have learned how to escalate privileges in the earlier lab and will use the same technique here to escalate privileges, and then dump the password hashes
On obtaining the hashes, you will use a password-cracking application such as Responder to obtain plain text passwords
Once you have the passwords, establish a Remote Desktop Connection as the attacker; install keylogger tools (such as Power Spy) and leave them in stealth mode
The next task will be to log on to the machine as a legitimate user, and, as the victim, perform user activities as though you are unaware of the application tracking your activities
After completing some activities, you will again establish a Remote Desktop Connection as an attacker, bring the application out of stealth mode, and monitor the activities performed on the machine by the victim (you)

For demonstration purposes, in this task, we are using the user account Jason, with the password qwerty, to establish a Remote Desktop Connection with the target system (Windows Server 2016).

Here, we are using Windows Server 2016 as the target machine, because, in this system, Jason has administrative privileges.

Task 2: User System Monitoring and Surveillance using Spytech SpyAgent

Spytech SpyAgent is a powerful piece of computer spy software that allows you to monitor everything users do on a computer—in complete stealth mode. SpyAgent provides a large array of essential computer monitoring features as well as website, application, and chat-client blocking, lockdown scheduling, and the remote delivery of logs via email or FTP.

Here, we will perform user system monitoring and surveillance using Spytech SpyAgent.

Here, we will use Windows Server 2019 as the host machine and Windows Server 2016 as the target machine. We will first establish a remote connection with the target machine and later install the keylogger spyware (Here, Spyware SpyAgent) to capture keystrokes and monitor the other activities of the user.

Task 3: Hide Files using NTFS Streams

A professional ethical hacker or pen tester must understand how to hide files using NTFS (NT file system or New Technology File System) streams. NTFS is a file system that stores any file with the help of two data streams, called NTFS data streams, along with file attributes. The first data stream stores the security descriptor for the file to be stored such as permissions; the second stores the data within a file. Alternate data streams are another type of named data stream that can be present within each file.

Here, we will use NTFS streams to hide a malicious file on the target system.

Task 4: Hide Data using White Space Steganography

An attacker knows that many different types of files can hold all sorts of hidden information and that tracking or finding these files can be an almost impossible task. Therefore, they use stenographic techniques to hide data. This allows them to retrieve messages from their home base and send back updates without a hint of malicious activity being detected.

These messages can be placed in plain sight, and the servers that supply these files will never know they carry suspicious content. Finding these messages is like finding the proverbial “needle” in the World Wide Web haystack.

Steganography is the art and science of writing hidden messages in such a way that no one other than the intended recipient knows of the message’s existence. Steganography is classified based on the cover medium used to hide the file. A professional ethical hacker or penetration tester must have a sound knowledge of various steganography techniques.

Whitespace steganography is used to conceal messages in ASCII text by adding white spaces to the end of the lines. Because spaces and tabs are generally not visible in text viewers, the message is effectively hidden from casual observers. If the built-in encryption is used, the message cannot be read even if it is detected. To perform Whitespace steganography, various steganography tools such as snow are used. Snow is a program that conceals messages in text files by appending tabs and spaces to the end of lines, and that extracts hidden messages from files containing them. The user hides the data in the text file by appending sequences of up to seven spaces, interspersed with tabs.

Here, we will hide data using the Whitespace steganography tool Snow.

Task 5: Image Steganography using OpenStego

Images are popular cover objects used for steganography. In image steganography, the user hides the information in image files of different formats such as .PNG, .JPG, or .BMP.

OpenStego is an image steganography tool that hides data inside images. It is a Java-based application that supports password-based encryption of data for an additional layer of security. It uses the DES algorithm for data encryption, in conjunction with MD5 hashing to derive the DES key from the password provided.

Here, we will show how text can be hidden inside an image using the OpenStego tool.

Task 6: Covert Channels using Covert_TCP

[

For demonstration purposes, in this task, we will use the Parrot Security machine as the target machine and the Ubuntu machine as the host machine. Here, we will create a covert channel to send a text document from the target machine to the host machine.