1 port - 2 "sockets" - HeapOverflow Computer Security Community & Forums : Heap Overflow.com

HeapOverflow Computer Security Community & Forums : Heap Overflow.com

		HeapOverflow Computer Security Community & Forums : Heap Overflow.com > Computer Security: Discussions > Hacking
1 port - 2 "sockets"

Mark Forums Read

Notices

Welcome to you visitor! This community is mainly dedicated to the computer and security, if you're looking for DFind scanner or others exploits codes you will find them into the Projects section, feel free to start Blogging and remember to always keep an eye and start talking about security Advisories & public Exploits.

Hacking Discuss the art of hacking, your experiences, etc...

1 port - 2 "sockets"

This is a discussion on "1 port - 2 "sockets"" within the Hacking part of the Computer Security: Discussions section; Did you guys have allready done or have codes for this function. The goal is to have a backd00r working on the same port as another allready running process, ie. IIS... Thanks and regards...

Reply

#1 (permalink)

Old

26-10-05

J-A is offline

Junior Member

Join Date: Jun 2005

Posts: 7

Thanks: 0

Thanked 0 Times in 0 Posts

Rep Power: 6

J-A is on a distinguished road

Default

1 port - 2 "sockets"

Did you guys have allready done or have codes for this function.
The goal is to have a backd00r working on the same port as another allready running process, ie. IIS...

Thanks and regards

Reply With Quote

Sponsor

Advertiser

#2 (permalink)

Old

26-10-05

Yog-Sotho is offline

Member

Join Date: Jul 2005

Location: Italy

Posts: 62

Thanks: 0

Thanked 0 Times in 0 Posts

Rep Power: 17

Yog-Sotho is on a distinguished road

Default

Not sure

I'm not sure but if I'm not wrong, it is not possible to make a process using the same port already in use by another process....maybe if the first one is on TCP and the other one is in UDP but again I'm not sure about it.

Forgive me if I just said some bullshit.

Yog

Reply With Quote

#3 (permalink)

Old

27-10-05

J-A is offline

Junior Member

Join Date: Jun 2005

Posts: 7

Thanks: 0

Thanked 0 Times in 0 Posts

Rep Power: 6

J-A is on a distinguished road

Default

well, we can also see this like that:

the backdoor hook the traffic destined to a port used by an application
just like a MITM attack and keep the packets for it if it's backdoor commands or just redirects the traffic to the normal application

Reply With Quote

#4 (permalink)

Old

27-10-05

h3llfyr3 is offline

Junior Member

Join Date: Sep 2005

Posts: 19

Thanks: 0

Thanked 0 Times in 0 Posts

Rep Power: 8

h3llfyr3 is on a distinguished road

Default

From a pure tcp/ip perspective you may only have one TCP and one UDP service listening on a particular port.
It might be possible to rewrite the service and install a new service so when it gets a particular packet is starts a new process listening on a different port but again this is just an idea.
hooking i know nothing of.

Reply With Quote

#5 (permalink)

Old

28-10-05

ZoraX

Guest

Posts: n/a

Default

Quote:

Originally Posted by Yog-Sotho

maybe if the first one is on TCP and the other one is in UDP but again I'm not sure about it.

Thats possible.

Quote:

Originally Posted by J-A

well, we can also see this like that:

the backdoor hook the traffic destined to a port used by an application
just like a MITM attack and keep the packets for it if it's backdoor commands or just redirects the traffic to the normal application

Sounds like a good idea. But i doubt you can make it listen on the same socket.

You have to change port on the original program to something else i guess(if the port is hardcoded you can make a patch), then set up your backdoor listening on the original port, make this backdoor forward the packets to the new port of the original program.

Example:
sshserver(port22) <-> Internet
With backdoor:
sshserver(port666) <-> Backdoor(port22) <-> internet

This should work i guess

post your source when u get it done, can be intresting ;-) Good luck.

Reply With Quote

#6 (permalink)

Old

18-05-06

DxCx is offline

Junior Member

Join Date: May 2006

Posts: 2

Thanks: 0

Thanked 0 Times in 0 Posts

Rep Power: 4

DxCx is on a distinguished road

Default

you can build up con socket, on port, then after you get connection, you random port, bind him to other socket, send him that port, and close connection, then the client connect on that port.

did it long time ago when i built some server

Reply With Quote

#7 (permalink)

Old

31-05-06

LittleHacker LittleHacker is offline

LittleHacker is offline

Junior Member

Join Date: Aug 2005

Posts: 1

Thanks: 0

Thanked 0 Times in 0 Posts

Rep Power: 5

LittleHacker is on a distinguished road

Send a message via Yahoo to LittleHacker

Default

well, it's possible to write backdoor act like a firewall and have a look to data coming to a specific port (and filter it's client data)
maybe it's also possible to do a process injection. in this case backdoor and the service has a same PID.
Hooking API functions of reciving data is another way.

Reply With Quote

#8 (permalink)

Old

24-06-06

revised is offline

Junior Member

Join Date: Dec 2005

Posts: 5

Thanks: 0

Thanked 0 Times in 0 Posts

Rep Power: 5

revised is on a distinguished road

Default

Well in theory you could write up a dll and load it into IIS, where the dll works like a hook for the incomming data, if the data is HTTP based (GET / HEAD and so on) you make sure IIS does the rest. But if the remote user sends Password / HTTP/1.0, which is obviously no HTTP, you could activate a backdoor and open up a port somewhere else or whatever you want to do.

Anyway this is just what you could do in theory, you will need to debug IIS. The reason why people have not done this yet is because its just too much effort, it's easier to write up a new rootkit for the OS instead of writing some sort of "rootkit" for an existing program running on some OS.

Just my 2 cents.

Reply With Quote

Sponsor

Advertiser

Reply

Tags
port, quotsocketsquot

« Disconnecting game servers | How to determine if radmin is running? »

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

Posting Rules
You may not post new threads You may not post replies You may not post attachments You may not edit your posts BB code is On Smilies are On [IMG] code is On HTML code is Off Trackbacks are On Pingbacks are On Refbacks are On

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
VNC_bypauth: linux & windows scanner	class101	0day	94	04-10-08 03:40
M0ded Sdbot w pnp on it :D:D	danix	Hacktools, Bots & Virus	24	05-05-08 19:11
Single Port Scanner in perl	rscience	Private	5	04-02-07 23:44
MS05-051 - msdtc exploit	9 Below Zero	Private	3	20-03-06 12:01

heapoverflow.com - SEOmeter SEO tools

Locations of visitors to this page

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47