4

Between the PHP-as-cgi-bin problem, and shellshock, I've seen 4 or 5 different Perl scripts that, when run, purport to make your machine part of some scary, heinous botnet.

What, specifically, would be the problem if you went through the Perl script, defanged it so that any eval or shell out or TCP or UDP or HTTP flooding or Google "dork" searching is removed, and then ran the script. Generally, the code is not confusing or complex, so I'm confident in my ability to defang.

Will the IDF Unit 8200 or PLA Unit 61398 or the FBI come and kick down my door? If my entry in the botnet doesn't send spam, or DDOS someone or whatever (because I neutered it), am I running afoul of anything?

Improve this question
1
  • Hard to say without analyzing the script completely, but likely opening up more backdoors for future access in case something gets patched, even if you do cut off network access completely for the script. That said if you want to run it, doing so inside a virtual machine with no networking would probably be safe enough. As for the FBI coming to kick down your door, it's unlikely (especially if you cut all network access), but they like to do that anyways, regardless of if you did anything in particular or not, so I can't answer that.
    – user2813274
    Commented Nov 3, 2014 at 3:31

3 Answers 3

Reset to default
7

been there, did that, faced a massive DDOS against my company afterwards. i'd suggest: take the script, setup an aws-instance and run it there.

never ever run that script on a server that could be linked back to any production-system or your company. try to stay anonymous, because you dont know whom you deal with.

Improve this answer
1
  • 1
    Make sure to use a new AWS account, with email address not linked to you. We've had our Amazon account hacked once by clever social engineering. Those Amazon guys are sometimes too helpful.
    – SPRBRN
    Commented Nov 3, 2014 at 10:39
4

I have done something similar, but took different steps to protect myself. My worry was not the authorities, but the people behind the network. I found it absolutely crucial that they would not learn my identitiy, as they surely would not be happy if they detected I had infiltrated their botnet.

To avoid any problems, I installed the linux distribution Tails in a virtual environment (virtualbox, vmware, parallels). This is a distribution that is built to keep the user anonymous by only allowing outbound connections via the Tor network.

In my case, they had a repository of compiled code, and perl code. It seemed like the compiled code were their preferred version, and I ran that.

I did not bother to defuse the botnet client. A mistake? Perhaps, but I were confident that the amount of damage I could do through the Tor network would be pretty low, I choose not to spend time on modifying the code. A greater worry here would be if they used the commands to update the binary, so I chrooted it into a read-only filesystem.

I executed their botnet code using the torify program. Now all TCP connections would be routed through the Tor network, and other outbound connections would be blocked by the firewall implemented in the Tails distribution.

Good luck to you!

Improve this answer
2
  • 1
    I wouldn't do that now. The payloads are malicious enough to try to actively drop firewall configs (since they are in the running OS itself (tails) and not in the hypervisor network config), plus torify can be escaped (access raw device, send packets that are not caught by socksification, etc...)
    – Phil L.
    Commented Jul 18, 2019 at 10:34
  • @PhilL. For Tails, it requires root to bypass the firewall. Of course, malware can sometimes get root, but if it can't, then it can't bypass Tor. It's not a transparent proxy, but rather a egress whitelist composed exclusively of the Tor SOCKS port.
    – forest
    Commented Apr 7, 2022 at 22:21
2

A bot net is usually associated with malicious behavior (e.g. the people running the botnet may use your computer as part of a distributed denial of service attack against an organization). I see a lot of dangers in doing this, and think it would be a very bad idea unless you have a great reason to do it (e.g. study the bot net to develop countermeasures, or try to take down the owners of the botnet). Dangers I see include the following:

  • You might not totally "defang" the code, and it could still be used by the people running the botnet for their malicious purposes.
  • You risk exposing any sensitive data on your computer to the people running the botnet.
  • You might risk the "wrath of law enforcement" depending on the country / laws in your country, and what your intentions are. Explaining your intentions to non-technical law enforcement agents could be problematic as well.
  • You might risk the "wrath of the botnet" owners as pointed out by the answer from "that guy over there."
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .