Member Avatar for s.w.a

hello, how are you all
please i need a help
i read sooo much about that but i am not satisfied yet, because i am not reach to what i exactly want to know
i want to know what are the abilities of the attacker in the computers he compromise?
in other words, what are the port he use (rigestered or ephemeral), and does he can see and control other ports in the compromised computer?
for example if he send a request to a web site that require user interaction, can he reply to it or not?
or for another example could he solve the random code that appeare as a request in some pages?
please if any one can answer me or lead me to a useful link, i will be very Grateful

best regards
and thank you in advance

  • 3 Contributors
  • 6 Replies
  • 124 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by skilly

Dani AI

Generated

Short practical answer for , building on points from and :

An attacker who can run code on a compromised machine can operate in three different ways: (1) originate outbound connections from that host, (2) run services/listeners on any port, and (3) relay or modify traffic that passes through the host. Which of those they can do depends on the level of privilege they have (regular user vs. administrator/root) and the network setup (behind NAT, ISP filtering, etc.).

About ports and the TCP three‑way handshake: when your machine starts an outgoing TCP connection it uses a local ephemeral port as the source and completes the SYN/SYN‑ACK/ACK exchange itself. The IANA assigned port ranges separate well-known (0–1023), registered (1024–49151) and dynamic/ephemeral (49152–65535) ports; the OS chooses an ephemeral port for outbound flows (IANA RFCs, RFC 6335). If the attacker tells the compromised host to connect to remote:3000, that host will complete the handshake from its ephemeral port. To accept incoming connections on local port 3000 there must be a process listening there — an attacker can create one.

IP spoofing and DoS: forging a TCP source IP is normally impractical for establishing a reliable TCP session because the handshake requires returning traffic to the forged address. Spoofing is feasible for stateless UDP packets and is commonly used in reflection/amplification attacks; ISP egress filtering (BCP 38 / RFC 2827) reduces this risk (RFC 2827, Cloudflare explainer on spoofing/amplification).

How interactive pages/CAPTCHAs get handled: malware can automate browsers, inject into the browser to submit forms, steal session cookies, or forward a challenge to a remote human solver service. For defenses and cleanup: isolate the machine, capture forensic logs if needed, check network connections and autoruns (Process Explorer / Autoruns), change passwords from a clean device, and reimage the OS if compromise is confirmed. See NIST SP 800-61 for incident response guidance () and OWASP notes on CAPTCHA bypass techniques ().

Recommended Answers

All 6 Replies

Member Avatar for rubberman

Once a system is compromised and an attacker has admin access to your system, there is literally nothing they cannot do. As for what you call "random code", I think you refer to what we know as Captchas. They can certainly mirror or redirect your web pages and then "solve" the question. If this were a banking application, for example, it would allow them to access your bank account, and $$, while appearing to be you for all intents and purposes.

Member Avatar for s.w.a

thank you very much for your answer
and yes thanks

Captchas

this what i mean
ok, let say that the attacker want to use my computer to start attack from it and he don't want me to know does he can
for example, he want to start a denial of service attack using my computer he need to make my computer to spoof another ip address from mine. does he success without i am knowing?

They can certainly mirror or redirect your web pages and then "solve" the question.

and sorry i cannot exactly know what you mean by this, do you mean he can answer the Captchas by him self!!?

best regards and thank you very much in advance for any help

Edited by s.w.a because: n/a
Member Avatar for skilly

usually, if your computer is a zombie, you are not the target.

Member Avatar for skilly

i also wanted to add that if, you are truly worried, there is steps you can take to de-zombify....such as erasing your computer, etc.

Member Avatar for s.w.a

thanks for you answer
i need to understand how he can do it please
i know that there is a channel he can use in the IRC and t is the port 6666
all this was from reading, but i need a butter imagin
let say he send the commands to me through the port 6666, how he can answer the 3-way handshakins in port 3000 for example???
thank you in advance for any help
best regards

Member Avatar for skilly

usually it is all automated. they are not actually sitting by a screen, snooping through your computer. Zombies are used mostly for ping of death. the master sends out a command to all known zombies(millions) and this command activates a file that resides on the zombie machine(probably a cookie or bit torrent program). the file is what executes commands directly, sending out pings.
i actually do not know any more than that. and i actually do not know all the details, but i hope i have helped out a bit.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.