Running cd00r
- Download the cd00r.c source code and get it to compile for 64 bit linux with debug disabled.
- What are the steps that were required to make that happen?
- Execute the binary
- Why did you have to run as root? This is very important.
- What ethernet interface are you listening on? Why?
- Run "sudo lsof | grep raw"
- What does that show you? Why?
- Set up a nc listener to catch the reverse shell
- Activate the backdoor using nc -z
- Start listening on the right interface in Wireshark and watch what happens.
- What do you see?
- Run srings, ldd, readelf, strace on the file
- What do you find?
- Submit the elf to VirusTotal
- What did VirusTotal detect it as?