Hi, how to detect if a bot is offline/stopped in a php botnet?
Using a WindowsShutdownEvent doesn't work
It sounds like you have no idea what you are doing, so I suggest that you backtrack and learn the fundamental technology concepts behind this.
You need to understand the relationship between a server and client (and what they even are) before you can program ANY type of networking software effectively. Botnets are no different, although I do not endorse creating them.
AFAIK, Windows shutdown is not even a concept in PHP. PHP is meant to be cross platform, so other than file access methods that look like ANSI C, there's not so much you can do to the actual system.
Another key concept is that the environments that the server and client will run in can be vastly different. For one thing, I don't think they're even in the same league, as PHP code can't be compiled and run as a virus.
Anyways, what I'm trying to say is, learn what you are doing before you ask. The answer to this question is simple if you use sockets and a simple timed ping.
Store info about bot when it connects.
If it stops connecting, it's dead or offline.
Plain and simple.
DO NOT DEAL WITH THIS MEMBER
Apr 22, 2016 07:16 PM
(This post was last modified: Apr 22, 2016 07:21 PM by log dot zip.)
(Apr 20, 2016 02:59 AM)SIM-1725686 Wrote: It sounds like you have no idea what you are doing, so I suggest that you backtrack and learn the fundamental technology concepts behind this.
You need to understand the relationship between a server and client (and what they even are) before you can program ANY type of networking software effectively. Botnets are no different, although I do not endorse creating them.
AFAIK, Windows shutdown is not even a concept in PHP. PHP is meant to be cross platform, so other than file access methods that look like ANSI C, there's not so much you can do to the actual system.
Another key concept is that the environments that the server and client will run in can be vastly different. For one thing, I don't think they're even in the same league, as PHP code can't be compiled and run as a virus.
Anyways, what I'm trying to say is, learn what you are doing before you ask. The answer to this question is simple if you use sockets and a simple timed ping.
lmao, you're just as clueless as OP
@OP so I'm assuming your problem is that your client is written in a .NET language, and that your server is PHP. PHP has no way to send packets to the client, it can merely respond when the client sends packets to the server. A common solution is just to have a set timer and mark the bot as offline if there is no activity recorded from that machine for x amount of minutes.
A ping will give no indication of the individual status of the machine, as pings are responded to by the router, and not by the machine
(Apr 22, 2016 07:16 PM)log dot zip Wrote: lmao, you're just as clueless as OP
@OP so I'm assuming your problem is that your client is written in a .NET language, and that your server is PHP. PHP has no way to send packets to the client, it can merely respond when the client sends packets to the server. A common solution is just to have a set timer and mark the bot as offline if there is no activity recorded from that machine for x amount of minutes.
A ping will give no indication of the individual status of the machine, as pings are responded to by the router, and not by the machine
So basically, you repeated what I said. Idk how that makes me "clueless," but...
regiostech Wrote:Anyways, what I'm trying to say is, learn what you are doing before you ask. The answer to this question is simple if you use sockets and a simple timed ping.
Anyways, OP, hope you have your answer now.
(Apr 22, 2016 07:16 PM)log dot zip Wrote: lmao, you're just as clueless as OP
@OP so I'm assuming your problem is that your client is written in a .NET language, and that your server is PHP. PHP has no way to send packets to the client, it can merely respond when the client sends packets to the server. A common solution is just to have a set timer and mark the bot as offline if there is no activity recorded from that machine for x amount of minutes.
A ping will give no indication of the individual status of the machine, as pings are responded to by the router, and not by the machine
And you're even more clueless that the guy you called clueless for calling the OP clueless.
http://php.net/manual/en/book.sockets.php
@OP, sorry if I came off as sounding harsh when I said you had no idea what you are doing.
However, you definitely need to learn how sockets work for this type of thing. Without it, you really will have no idea what you are doing.
DO NOT DEAL WITH THIS MEMBER
Gentleman,
The core fundamental is very basic, there is no reason to argue.
Here is a very basic overview of a HTTP Botnet Concept
Basic HTTP Design Overview
-Bot Sends web request to php script every x seconds/minutes/hours/days that is configured for.
In this requests typically it will send stats on system it is installed on and check for pending cmds.
Typical Send Stats in Request
-Hwid (Hardware ID of Some Sort of Unique System Identifier)
-Installed OS
-Processor Architecture
-System Name, Location, and OS Version
-Service Packs Installed
-System Idle Time
-Bot Build Version
-Status of Last Cmd Request
Note: Web Request can be a post/get request. Most bots use post for this and include a unique identifier
that needs to be present in the request header (most times as a UserAgent string) or the request will be
dropped, for the purposes of filtering out webrequests from other sources.
As typical the PHP (Server Side) script will return any pending cmd requests along with a cmd expiration, and log most recent requests to determine how many bots are active and online
timestamp to avoid running really old cmds, or executing them many times.
The bot typically will absorb these cmds into a list in memory or a local file as a hash to avoid processing
these cmds more than once.
-(Gate Script) PHP or ASP or HTML or Whatever Server side code you have in place.
Typically will authenticate and receive requests from bot and respond with any pending cmds.
-C&C Server Side Code
*Provides developer with (typically) a web interface for issuing cmds to bot. Which can either populate a mysql cmd database or write cmds to a server side file that will be read and issued back to server side gate script.
Both the bot, c&c and server side gate script can be customized to do many things
The bot can have embedded logic to self install, protect its process from termination, inject threads into native process to keep its process alive, spread itself to other pcs, bot indirectly and directly(requiring exploits and 0 days), using file shares, lan shares, p2p archive infections, and messenger programs.
Bots can also mine bitcoins, send spam, and steal credentials and keystrokes.
The Gate or Server side script, can authenticate actual bots from the traffic of other requests, and absorb any data collected by bot and stored server side.
I hope this helps, from a broad simplified perspective as to the inner workings of a basic http bot.
|
