Command and Control (C&C) Hacking Infrastructure Part 1 and 2

I thought it would be interesting to explain to you how N map is used by criminal black hat hackers in the real world.

In combination with their hacking infrastructure, which you can see somewhat illustrated here.

This in the middle is the hackers hacking infrastructure, because this is different to how most people use Nmap.

Most people use Nmap, simply ruin it from their laptop, their server, and then just scan.

They have no need for anonymization.

So black hat hackers.

Using Nmap in a different way.

And it's interesting to see what it is that they do.

So let's have a look at this picture here.

Well, we have is our black hat hacker here illustrated by the black hat.

He would normally connect an anonymize to the hacking infrastructure by some sort of anonymizing service.

So that could be John Donovan that could be tore.

It would be most likely to be tor here so we can see our tor client.

We're hopping over our hops.

And then we're onto our hacking infrastructure here, which is the first part, the stable part and the less stable part or the owned and these own service here.

These will be owned by someone else and unbeknownst to them.

They are being used as pivots and proxies to hide the IP addresses of these stable service here.

So we can call the.

The less stable serve as our own servers as part of this hacking infrastructure.

Whenever you don't want to expose your stable servers, you'll pivot through the less stable servers to these own servers.

And these less stable servers are used for when black hat hackers want a fast connection without pivoting.

This is where the blackouts would ruin Nmap from to do the port scanning to scan.

The whole internet for targets as illustrated by these here, or if they picked a specific target, then they could be scanning that target from the less stable owned servers.

And there would be many other hacking tools on the infrastructure, much like what you will find on a pen testing, laptop or pen testing device, like Kali close.

It would have web servers on it for social engineering and fishing attacks and that sort of stuff.

So any serious black hat should be using a hacking infrastructure like this, from which the Nmap scanning is actually done ethical hackers.

Those are do penetration tests for clients who are getting paid.

I've no need for such a hack and infrastructure.

And often just run Nmap.

As I said, from a laptop on something like Kali directly scanning their targets, hackers use Nmap for finding targets.

So, for example, using Nmap to search for vulnerable versions of a piece of software or using Nmap scripts to find an exploit vulnerabilities.

So in this diagram that we'll be hunting around the internet to find things random.

Sometimes a target is chosen in advance by a black hat for maybe financial or political reasons.

They have chosen a specific target.

Then the hacker will use Nmap to find all interesting internet accessible hosts and pores of that organization, that target that they have preselected or once a compromise has been achieved.

So imagine we've compromised.

This network here Nmap is installed on an internal device of a hacked.

Compromised network.

And then from there they will scan internal networks.

So just to reiterate Nmap can be used for finding target.

Once you've found a target, it can be used for scanning those targets.

And then when you actually compromise a target, it can be used for scanning internally three general ways in which the black hat tends to use Nmap.

And of course, Nmap need to be anonymous, as I mentioned, so tor is generally used to connect anonymously to the hacking infrastructure.

So you never even connect to this hacking infrastructure non anonymously in the first place either.

But the reason you want to keep these anonymous too, is because you want to keep them active for as long as possible without the main compromised in terms of their attribution back to you.

And there are a number of reasons why you wouldn't just hack from a Tor exit node.

The Tor exit nodes can be blacklisted.

It can cause suspicion if you're doing some sort of hacking or Nmap scanning from a Tor exit node, and it's also slow.

So you can't do a scan very effectively from an exit node and further down the line, you can't receive connect backs or the shells, which is essential for accessing hack machines.

So the hacking of a short shirt is required for any black hat and is a fundamental piece of the puzzle for success and not getting caught.

If you are a budding criminal hack.

And back to the stable servers.

These are usually bought anonymously with digital currency, like Bitcoin or mailing cash to the provider.

The black hat would never connect to these with a real IP addresses.

I've said, and only through tor or other anonymizing service.

Like John Donovan is good to have stable, reliable service from waste.

The hacking can be done and also to receive those connect back shells and reverse shells.

I mentioned to launch attacks.

And to store pilfer data as well.

So where do they acquire these service from?

Well, there are service for rent.

There are especially resistant to influence and the owners are lenient about what the servers are used for.

And for this reason they're called Bulletproof hosting services or BPH S also another term is offshore hosting.

So in theory, they should be more resistant to pressure from law enforcement.

So the choice of the black hat hacker.

And the owners of these Bulletproof hosting services is off shore services.

Obviously it potentially on trustworthy and most of these servers are used for illegal activity.

Blackouts world, try to use servers in locations, out of the sphere of influence of law enforcement agencies that are local to themselves.

And their targets where possible to limit what law enforcement agencies can investigate.

Lack of jurisdiction is actually a real problem for investigating cyber crimes.

At the moment, black hat searched, the hacker blackout forums and the dark web to find Bulletproof hosting services, many advertise on Russian and Chinese speaking forums only, which makes them difficult to access for.

English speakers only to minimize the chance of attribution and being caught.

The black hat should change the hacking infrastructure per major job that is done.

This reduce the risk of building a paid case of hacks performed by the black hat because they are tied to the hacking infrastructure.

So you change out the hacking infrastructure, periodic.

Per major job, you would have different hacking infrastructure accounts, domain names, Bitcoin addresses, email pseudonyms, and so on the blackhat doesn't want to tie one job with another, as this would increase the number of crimes that would be associated and that they could be convicted of.

And also if it appears that you have a large portfolio of crime, you will become more of a time.

And you will require things like domain name, command and control addresses for tunneling out of networks for guaranteed egress to you will tunnel over DNS.

That's a common way out of a network.

So the hacking servers are highlight to have DNS functionality and for a robust command and control.

The black hat would register a domain name and designate the system running the DNS command and control service software.

As the authoritative DNS server for that domain, this way, our DNS client does not even need to connect directly to the command and control server to receive commands.

Commands will be passed through the DNS ecosystem until they reach an authorized server authorized DNS server, DNS cat 2.

As an example of a client and serve tool to accomplish this task.

So there we go.

We've gone a little bit deeper into the hacking infrastructure, but essentially this is a sort of thing that will be used in combination with Nmap to either find our targets.

Initially, once we have a target to scan the target and then wants to target is compromise.

To scan to identify further interesting hosts and what ports are on there.

But I thought it would just be interesting just to show you how Nmap is used in combination with an infrastructure in the real world, by black hat hackers.