Tôi biết rằng họ đang xem cổng 80 vì không quét Whisker của tôi đã thành công ở hai cổng SSL cung cấp rất nhiều thông tin. Hãy xem, đó là vẻ đẹp của SSL: Nó ẩn những điều từ không thể nhìn thấy vào các dòng dữ liệu, bởi vì các dòng dữ liệu được mã hóa. Mà không phải là đáng yêu? | 44 Chapter 2 The Worm Turns I hacked in a lame TFTP server à la Nimda to get the file to move. Windows networking is going to break half the time. Actually I stole a bunch of tricks from Nimda for the TFTP server and I even have it attaching the fixer as a resource to the remote tool so you need to run only a single .exe file give it some IPs and away it goes. It s not a full worm but it s darn close. More like a botnet. Heh yeah that s going to get some unauthorized use. It wouldn t take much to make it a real worm. All I would have to do is make it TFTP all of itself instead of just the fixer part. Maybe make it pick a random IP to try for fixing. I should try it. I would be doing the world a huge would be cool the first real in-the-wild anti-worm to go with the first real 0-day worm. It s not like they ve ever caught a worm author. Oh wait there was the Melissa guy but he was an idiot. After about another 30 minutes my code is fully capable of self-propulsion. I think so anyway. I haven t tried that part s not much new code. I already know the TFTP part works. It s hard to mess up a plain random IP generator. If I got it wrong it won t go anywhere and it won t matter. Random IP generators suck worm I spent all night looking at wouldn t have been anywhere near as cool if it didn t have the 0-day and the delegated spread. Man I m s no way I m going to stay up much longer and try to replicate the address-split method in my code. Selfmodifying code is a bitch to read but it s even worse to write especially in straight C which is what I ve been using so far. Heh if I wanted to be really evil I should make it parse the Web logs to find infected boxes. I think Microsoft even has some API for reading the logs easily. All I would have to do is look for a URL with and grab the client IP. Actually that wouldn t work by itself. It would eventually run out or just keep beating the same boxes unless I had a way to tail .
