Detecting Backdoors on a System

What You Learned

1. What Is Port and Process Monitoring?

   • Monitoring open ports and active processes can reveal if a backdoor or malicious service is running on the system.

2. How to Identify Suspicious Activity:

   • Look for unexpected open ports or running processes that shouldn’t be there.

   • Use commands to inspect both the network and system processes.

3. Why This Is Important:

   • Backdoors often use specific ports to listen for commands. Detecting these ports and processes is a critical step in securing a compromised system.

Commands Used and Their Purpose

1. Check Open Ports:

   • Command: ss -tuln

     • Purpose: Lists all open ports and the services listening on them.

     • Look for unusual entries, like port 4444, which could indicate a backdoor.

2. Network Scanning with Nmap:

   • Command: nmap [IP_ADDRESS] (e.g., nmap 192.168.111.135)

     • Purpose: Scans the target system to identify open ports and associated services (e.g., FTP, SSH, HTTP).

     • Example output:

       • Port 21 (FTP) is open.

       • Port 22 (SSH) is open.

       • Port 80 (HTTP) is open.

       • Port 4444 (custom/backdoor service) is open.

3. List Active Processes:

   • Command: ps -A | grep [PROCESS_NAME] (e.g., ps -A | grep .sh)

     • Purpose: Lists all active processes and filters them for specific names, like scripts (.sh) or services (e.g., vsftpd).

     • Look for unexpected processes, such as cron2.sh or socat, which might indicate malicious activity.

4. Identify Processes Listening on Ports:

   • Command: ps -A | grep vsftp

     • Purpose: Checks if specific services (like FTP) are actively running.

Key Takeaways

1. Detecting Open Ports:

   • Use tools like ss or nmap to identify open ports and services. Suspicious ports (e.g., 4444) can indicate a backdoor.

2. Monitoring System Processes:

   • Active processes like cron2.sh or unusual instances of socat suggest potential malicious activity.

   • Regularly audit system processes to catch anomalies early.

3. Defensive Measures:

   • Investigate and terminate any suspicious processes or services.

   • Close unnecessary open ports to reduce the system’s attack surface.

   • Maintain a record of expected ports and processes for your system to detect deviations easily.

Key Idea

By combining port monitoring (ss, nmap) with process analysis (ps, grep), you can effectively detect and respond to hidden backdoors or malicious activity on your system. Regular checks and audits are essential to maintain a secure environment.