1
1
00:00:00,007 --> 00:00:02,490
"Nonstandard Port Usage."
2
2
00:00:02,490 --> 00:00:03,750
Now, before we can start talking
3
3
00:00:03,750 --> 00:00:05,490
about nonstandard port usage,
4
4
00:00:05,490 --> 00:00:07,620
we have to know what is a port.
5
5
00:00:07,620 --> 00:00:09,720
Well, the Internet Assigned Numbers Authority
6
6
00:00:09,720 --> 00:00:12,510
or IANA maintains a list of well-known
7
7
00:00:12,510 --> 00:00:16,080
and registered TCP and UDP port mappings.
8
8
00:00:16,080 --> 00:00:17,640
Now, each of these ports are basically
9
9
00:00:17,640 --> 00:00:19,080
an opening on a computer.
10
10
00:00:19,080 --> 00:00:20,250
Now, they're logical openings
11
11
00:00:20,250 --> 00:00:22,110
but essentially they work as a door.
12
12
00:00:22,110 --> 00:00:23,850
For instance, if you live in an apartment building
13
13
00:00:23,850 --> 00:00:26,160
you all have the exact same address.
14
14
00:00:26,160 --> 00:00:28,620
You might be living at 123 Main Street.
15
15
00:00:28,620 --> 00:00:30,570
Well, that apartment building address
16
16
00:00:30,570 --> 00:00:33,120
is just like the IP address on your computer.
17
17
00:00:33,120 --> 00:00:34,350
That gets you to the computer,
18
18
00:00:34,350 --> 00:00:36,450
but it doesn't tell you what service is running
19
19
00:00:36,450 --> 00:00:37,980
on each individual room.
20
20
00:00:37,980 --> 00:00:40,140
Just like if you go to the 123 Main Street
21
21
00:00:40,140 --> 00:00:43,260
and you see an apartment building that has 500 apartments,
22
22
00:00:43,260 --> 00:00:46,350
how do you know which of those 500 apartments I live in?
23
23
00:00:46,350 --> 00:00:49,170
Well, you'd have to know my door number or port number.
24
24
00:00:49,170 --> 00:00:51,120
And that's what we're going to talk about here.
25
25
00:00:51,120 --> 00:00:53,250
Now, when we talk about a well-known port,
26
26
00:00:53,250 --> 00:00:56,670
these are ports between zero and 1023.
27
27
00:00:56,670 --> 00:00:59,430
Anytime you find a port between zero and 1023,
28
28
00:00:59,430 --> 00:01:03,570
these are considered well-known ports under the IANA system.
29
29
00:01:03,570 --> 00:01:04,710
Now on the second half,
30
30
00:01:04,710 --> 00:01:07,080
we have what's called registered ports.
31
31
00:01:07,080 --> 00:01:11,850
These are ports 1024 to 49151.
32
32
00:01:11,850 --> 00:01:16,620
Now, if you go from ports 1,024 to 49,151,
33
33
00:01:16,620 --> 00:01:19,920
anything in this range is considered a registered port.
34
34
00:01:19,920 --> 00:01:21,330
Now, anytime you get above that
35
35
00:01:21,330 --> 00:01:23,370
you start getting into dynamic ports,
36
36
00:01:23,370 --> 00:01:28,370
these are ports 49,152 all the way up to 65,535.
37
37
00:01:30,690 --> 00:01:33,960
Anything in this range is considered a dynamic port.
38
38
00:01:33,960 --> 00:01:36,000
Now, these are just three categories of ports
39
39
00:01:36,000 --> 00:01:38,370
but they are important for you to understand.
40
40
00:01:38,370 --> 00:01:39,203
Now, when you're dealing
41
41
00:01:39,203 --> 00:01:41,250
with a legitimate application server,
42
42
00:01:41,250 --> 00:01:42,300
these things are going to use
43
43
00:01:42,300 --> 00:01:45,240
well-known and registered ports by default.
44
44
00:01:45,240 --> 00:01:49,050
So something underneath 49,152.
45
45
00:01:49,050 --> 00:01:51,810
Now that's still a ton of ports out there.
46
46
00:01:51,810 --> 00:01:54,390
Do you have to memorize all of those? Of course not.
47
47
00:01:54,390 --> 00:01:56,700
But there are about 40 that you will need to know,
48
48
00:01:56,700 --> 00:01:59,400
and we'll cover that in the next two lessons.
49
49
00:01:59,400 --> 00:02:01,260
Now, let's take an example here.
50
50
00:02:01,260 --> 00:02:03,660
You probably have used an internet site before.
51
51
00:02:03,660 --> 00:02:05,610
For example, if you're watching this video,
52
52
00:02:05,610 --> 00:02:06,930
you had to go into your web browser
53
53
00:02:06,930 --> 00:02:08,010
and type in a domain name,
54
54
00:02:08,010 --> 00:02:10,710
like diontraining.com to access it.
55
55
00:02:10,710 --> 00:02:14,490
Now, if you're using it over HTTP, this is unsecure,
56
56
00:02:14,490 --> 00:02:16,170
so it's using port 80.
57
57
00:02:16,170 --> 00:02:18,420
If you want to get to my secure web server,
58
58
00:02:18,420 --> 00:02:23,420
you would type in https://diontraining.com and hit enter.
59
59
00:02:23,670 --> 00:02:25,920
That would operate over port 443
60
60
00:02:25,920 --> 00:02:27,150
and create an encrypted tunnel
61
61
00:02:27,150 --> 00:02:29,640
between your client and my server.
62
62
00:02:29,640 --> 00:02:31,320
That's the way these ports work.
63
63
00:02:31,320 --> 00:02:33,750
You're still going to the exact same server.
64
64
00:02:33,750 --> 00:02:36,450
The only difference is which service is going to answer up,
65
65
00:02:36,450 --> 00:02:40,980
is it going to be unencrypted port 80, or encrypted port 443?
66
66
00:02:40,980 --> 00:02:42,720
And using that will help you determine
67
67
00:02:42,720 --> 00:02:44,850
which part of the server, which function,
68
68
00:02:44,850 --> 00:02:47,370
which service is going to answer that request.
69
69
00:02:47,370 --> 00:02:50,550
Now, there is no definitive list or comprehensive list
70
70
00:02:50,550 --> 00:02:53,250
of all of the different ports used by malware.
71
71
00:02:53,250 --> 00:02:55,530
If I'm going to use something like a web server,
72
72
00:02:55,530 --> 00:02:58,650
that may operate on port 80, but it doesn't have to.
73
73
00:02:58,650 --> 00:03:00,570
And so every malware writer can decide
74
74
00:03:00,570 --> 00:03:02,340
what ports they want to use.
75
75
00:03:02,340 --> 00:03:03,420
And because they're not known
76
76
00:03:03,420 --> 00:03:05,430
for documenting all of their port usage
77
77
00:03:05,430 --> 00:03:07,410
with a central authority like IANA,
78
78
00:03:07,410 --> 00:03:09,540
they can really just use any port they want.
79
79
00:03:09,540 --> 00:03:10,920
So what might be an indicator
80
80
00:03:10,920 --> 00:03:12,600
that a piece of malware is running on a port
81
81
00:03:12,600 --> 00:03:14,760
instead of an authorized application?
82
82
00:03:14,760 --> 00:03:18,000
Well, for one, if you see an open dynamic port on a machine,
83
83
00:03:18,000 --> 00:03:21,300
something being the 49,152 range,
84
84
00:03:21,300 --> 00:03:24,360
all the way up to 65,535 range,
85
85
00:03:24,360 --> 00:03:26,640
and it appears to be constantly open on a host,
86
86
00:03:26,640 --> 00:03:28,680
this could indicate a malicious traffic channel
87
87
00:03:28,680 --> 00:03:30,270
because this isn't common.
88
88
00:03:30,270 --> 00:03:31,740
These ports up in this range
89
89
00:03:31,740 --> 00:03:33,570
are usually open for a short period of time,
90
90
00:03:33,570 --> 00:03:35,190
used and then closed.
91
91
00:03:35,190 --> 00:03:36,330
And so if you see one that's open
92
92
00:03:36,330 --> 00:03:39,600
for long, long, long periods like days or weeks,
93
93
00:03:39,600 --> 00:03:41,190
that could be an indication that somebody has running
94
94
00:03:41,190 --> 00:03:44,010
some kind of a malicious server in that range.
95
95
00:03:44,010 --> 00:03:45,810
Now, another thing that might tip you off
96
96
00:03:45,810 --> 00:03:48,030
that there is something going on here with malware,
97
97
00:03:48,030 --> 00:03:50,460
is that you start seeing non-standard port usage,
98
98
00:03:50,460 --> 00:03:52,500
which is what the title of this lesson was.
99
99
00:03:52,500 --> 00:03:55,350
Now, a non-standard port is when you see communications
100
100
00:03:55,350 --> 00:03:57,360
of a TCP/IP application.
101
101
00:03:57,360 --> 00:03:59,670
For instance, HTTP, which is web.
102
102
00:03:59,670 --> 00:04:01,650
Or FTP, which is file transfer .
103
103
00:04:01,650 --> 00:04:04,080
Or DNS, which is domain name system.
104
104
00:04:04,080 --> 00:04:06,120
If you see any of this stuff happening over a port
105
105
00:04:06,120 --> 00:04:07,500
that is not the well-known
106
106
00:04:07,500 --> 00:04:09,900
or registered port established for that protocol,
107
107
00:04:09,900 --> 00:04:11,850
this would be a non-standard port.
108
108
00:04:11,850 --> 00:04:13,710
So I just used the example of web.
109
109
00:04:13,710 --> 00:04:16,470
Web is HTTP, that's port 80.
110
110
00:04:16,470 --> 00:04:19,380
If I was running that over port 153, for instance,
111
111
00:04:19,380 --> 00:04:22,110
not port 80, that would be a non-standard port.
112
112
00:04:22,110 --> 00:04:23,760
There's nothing wrong with doing that
113
113
00:04:23,760 --> 00:04:26,100
but it is something that should flag as suspicious
114
114
00:04:26,100 --> 00:04:28,290
and something you want to investigate.
115
115
00:04:28,290 --> 00:04:30,270
Now, the first IoC we want to talk about here
116
116
00:04:30,270 --> 00:04:32,400
is the use of a non-standard port
117
117
00:04:32,400 --> 00:04:34,110
when a well-known or registered port
118
118
00:04:34,110 --> 00:04:36,780
is already established for that purpose.
119
119
00:04:36,780 --> 00:04:40,290
For example, malware might use a non-standard port
120
120
00:04:40,290 --> 00:04:43,320
other than port 53 for DNS traffic.
121
121
00:04:43,320 --> 00:04:47,070
So if I start sending DNS traffic over port 80, or port 20,
122
122
00:04:47,070 --> 00:04:50,460
or port 63, or any number that is not 53,
123
123
00:04:50,460 --> 00:04:52,650
that is considered non-standard.
124
124
00:04:52,650 --> 00:04:54,720
Now, another indicator of compromise you might see,
125
125
00:04:54,720 --> 00:04:58,140
is if you start finding mismatched port/application traffic
126
126
00:04:58,140 --> 00:05:00,150
where non-standard traffic is communicated
127
127
00:05:00,150 --> 00:05:02,850
over a well-known or registered ports.
128
128
00:05:02,850 --> 00:05:05,880
So if I start taking some non-standard traffic,
129
129
00:05:05,880 --> 00:05:08,880
and I start putting it over web port, port 80,
130
130
00:05:08,880 --> 00:05:10,410
that is a well-known port,
131
131
00:05:10,410 --> 00:05:12,450
and I'm not using web traffic over port 80,
132
132
00:05:12,450 --> 00:05:14,190
that again, is something that is a mismatch
133
133
00:05:14,190 --> 00:05:16,500
and that should flag you as something to investigate.
134
134
00:05:16,500 --> 00:05:19,350
So what are some mitigations against this?
135
135
00:05:19,350 --> 00:05:22,260
Now, the first mitigation is to configure your firewalls
136
136
00:05:22,260 --> 00:05:24,870
to only allow whitelisted ports to communicate
137
137
00:05:24,870 --> 00:05:27,360
on the ingress and egress interfaces.
138
138
00:05:27,360 --> 00:05:28,980
So if you're using something
139
139
00:05:28,980 --> 00:05:30,930
like an application layer firewall,
140
140
00:05:30,930 --> 00:05:33,540
it can detect what application is being sent out.
141
141
00:05:33,540 --> 00:05:34,830
If I'm trying to send web traffic
142
142
00:05:34,830 --> 00:05:37,680
on something other than port 80 or port 443,
143
143
00:05:37,680 --> 00:05:38,640
it can block it.
144
144
00:05:38,640 --> 00:05:40,080
If I'm trying to receive web traffic
145
145
00:05:40,080 --> 00:05:43,020
on something other than port 80 or port 443,
146
146
00:05:43,020 --> 00:05:43,890
it can block it.
147
147
00:05:43,890 --> 00:05:45,720
That's what we're talking about here with this mitigation.
148
148
00:05:45,720 --> 00:05:46,770
Our second mitigation
149
149
00:05:46,770 --> 00:05:48,870
is to have good configuration management.
150
150
00:05:48,870 --> 00:05:51,390
And if we can have our configuration documentation,
151
151
00:05:51,390 --> 00:05:52,950
showing us which server ports
152
152
00:05:52,950 --> 00:05:54,930
are allowed on any given host type,
153
153
00:05:54,930 --> 00:05:57,510
that allows us to then configure host-based firewalls
154
154
00:05:57,510 --> 00:05:59,220
and other prevention mechanisms
155
155
00:05:59,220 --> 00:06:00,900
from allowing non-standard things
156
156
00:06:00,900 --> 00:06:02,520
to be run on those systems.
157
157
00:06:02,520 --> 00:06:04,380
For example, if I just built a web server
158
158
00:06:04,380 --> 00:06:08,220
and I said "For this server, I should only run ports 80,
159
159
00:06:08,220 --> 00:06:10,470
ports 443, and ports 22."
160
160
00:06:10,470 --> 00:06:11,580
Because I need to be able to
161
161
00:06:11,580 --> 00:06:14,370
log in through SSH to configure that web server.
162
162
00:06:14,370 --> 00:06:16,110
Anything else is going to be blocked.
163
163
00:06:16,110 --> 00:06:17,640
And that way we can configure that host
164
164
00:06:17,640 --> 00:06:19,020
in a more secure manner.
165
165
00:06:19,020 --> 00:06:21,480
Our third mitigation is to configure detection rules
166
166
00:06:21,480 --> 00:06:24,660
to detect mismatch protocol usage over a standard port.
167
167
00:06:24,660 --> 00:06:27,180
So again, we're going to look at all of our standard ports
168
168
00:06:27,180 --> 00:06:32,180
port 21, 22, 23, 25, 53, 80, things like that.
169
169
00:06:32,430 --> 00:06:35,040
And if we start seeing things that don't match those ports,
170
170
00:06:35,040 --> 00:06:37,740
we are going to flag those in our detection system
171
171
00:06:37,740 --> 00:06:39,960
and that way our analysts can look into it further.
172
172
00:06:39,960 --> 00:06:42,030
So I think at this point we have a good idea
173
173
00:06:42,030 --> 00:06:44,520
of this non-standard port concept,
174
174
00:06:44,520 --> 00:06:47,130
but one of the things that is often used by attackers
175
175
00:06:47,130 --> 00:06:48,930
is the ability to get a remote shell
176
176
00:06:48,930 --> 00:06:50,700
and then communicate that over some kind of,
177
177
00:06:50,700 --> 00:06:52,530
standard or non-standard port.
178
178
00:06:52,530 --> 00:06:54,120
Now, this is important because an attacker
179
179
00:06:54,120 --> 00:06:56,130
is going to attempt to get remote access,
180
180
00:06:56,130 --> 00:06:59,340
so they can start running commands on a victimized system.
181
181
00:06:59,340 --> 00:07:01,170
And there's two ways they can do this.
182
182
00:07:01,170 --> 00:07:02,910
The first is what's known as a shell.
183
183
00:07:02,910 --> 00:07:05,490
Now, a shell is when an attacker opens a listening port
184
184
00:07:05,490 --> 00:07:08,280
that exposes the command prompt on the local host
185
185
00:07:08,280 --> 00:07:10,980
and connects to that port from a remote host.
186
186
00:07:10,980 --> 00:07:13,680
The reverse of this is what's known as a reverse shell.
187
187
00:07:13,680 --> 00:07:15,690
This is when an attacker opens a listening port
188
188
00:07:15,690 --> 00:07:18,570
on the remote host and causes the infected host
189
189
00:07:18,570 --> 00:07:20,370
to go and reach out and connect to it.
190
190
00:07:20,370 --> 00:07:22,860
Now, the reason why reverse shells are popular
191
191
00:07:22,860 --> 00:07:24,240
is because a lot of times,
192
192
00:07:24,240 --> 00:07:26,370
the host is going to be behind a firewall,
193
193
00:07:26,370 --> 00:07:27,660
and if it's behind a firewall
194
194
00:07:27,660 --> 00:07:29,190
and you open a listening port on it,
195
195
00:07:29,190 --> 00:07:30,810
well, the remote host can't get to it
196
196
00:07:30,810 --> 00:07:32,610
because the firewall will block them
197
197
00:07:32,610 --> 00:07:34,890
coming from the internet into the organization.
198
198
00:07:34,890 --> 00:07:37,860
But a reverse shell is used to exploit organizations
199
199
00:07:37,860 --> 00:07:39,690
that haven't configured outbound traffic
200
200
00:07:39,690 --> 00:07:41,100
filtering at the firewall,
201
201
00:07:41,100 --> 00:07:43,380
because a lot of firewalls have a policy set up
202
202
00:07:43,380 --> 00:07:46,650
that if somebody on the inside requests to open the port
203
203
00:07:46,650 --> 00:07:48,600
to go out, it will allow that.
204
204
00:07:48,600 --> 00:07:50,280
And so in the case of reverse shell,
205
205
00:07:50,280 --> 00:07:53,370
the listener is set up on the attacker's machine.
206
206
00:07:53,370 --> 00:07:54,690
And so when you're making the connection,
207
207
00:07:54,690 --> 00:07:56,790
you're going from the internal network,
208
208
00:07:56,790 --> 00:07:59,130
opening the port to request the information
209
209
00:07:59,130 --> 00:08:00,570
of that remote server.
210
210
00:08:00,570 --> 00:08:03,360
Once you've opened that door, the attacker can then get in.
211
211
00:08:03,360 --> 00:08:05,790
That's why reverse shells are very popular.
212
212
00:08:05,790 --> 00:08:06,900
So you may be wondering,
213
213
00:08:06,900 --> 00:08:08,880
how do you create a shell or reverse shell?
214
214
00:08:08,880 --> 00:08:10,440
What does an attacker do?
215
215
00:08:10,440 --> 00:08:11,940
Well, normally they're going to use a program,
216
216
00:08:11,940 --> 00:08:13,410
like a Remote Access Trojan,
217
217
00:08:13,410 --> 00:08:17,070
or they can do it manually using something like Netcat.
218
218
00:08:17,070 --> 00:08:18,990
Netcat, also known as nc
219
219
00:08:18,990 --> 00:08:20,880
because that's the command line tool,
220
220
00:08:20,880 --> 00:08:23,520
is a utility for reading and writing raw data
221
221
00:08:23,520 --> 00:08:25,650
over a network connection that's often used
222
222
00:08:25,650 --> 00:08:27,810
as a listener for remote shells.
223
223
00:08:27,810 --> 00:08:31,260
So if I wanted to set up a regular shell on a victim system,
224
224
00:08:31,260 --> 00:08:35,566
I can do that by simply typing in nc -l for listening,
225
225
00:08:35,566 --> 00:08:39,451
p for port, 443, the port I want to listen on,
226
226
00:08:39,451 --> 00:08:44,280
e for execute, and cmd.exe the command line.
227
227
00:08:44,280 --> 00:08:46,260
So what this is saying is netcat,
228
228
00:08:46,260 --> 00:08:50,370
set up a listener on port 443 and execute the command,
229
229
00:08:50,370 --> 00:08:53,040
cmd.exe whenever somebody connects to it.
230
230
00:08:53,040 --> 00:08:54,540
Very simple command.
231
231
00:08:54,540 --> 00:08:57,750
Now, on my machine, if I want to connect to that listener,
232
232
00:08:57,750 --> 00:09:01,320
I would simply type in netcat 10.1.0.1
233
233
00:09:01,320 --> 00:09:03,150
or the IP address I'm trying to connect to,
234
234
00:09:03,150 --> 00:09:05,100
and the port number, 443.
235
235
00:09:05,100 --> 00:09:06,240
If I hit enter,
236
236
00:09:06,240 --> 00:09:09,480
I should get back a C prompt on that machine,
237
237
00:09:09,480 --> 00:09:12,210
so I'm at the command prompt on the remote machine now.
238
238
00:09:12,210 --> 00:09:14,730
That's the way we can connect to these things using a shell.
239
239
00:09:14,730 --> 00:09:16,890
Now again, you can connect these in either way.
240
240
00:09:16,890 --> 00:09:19,020
It can either be a shell or reverse shell.
241
241
00:09:19,020 --> 00:09:21,900
It just depends on where the listener's being set up.
242
242
00:09:21,900 --> 00:09:23,370
If the listener was being set up
243
243
00:09:23,370 --> 00:09:26,220
inside the network on the victim, it's a shell.
244
244
00:09:26,220 --> 00:09:28,740
If the listener's being set up on the attacker's machine
245
245
00:09:28,740 --> 00:09:31,470
and making the victim connect to them,
246
246
00:09:31,470 --> 00:09:33,330
that's a reverse shell.
247
247
00:09:33,330 --> 00:09:35,640
Now, netcat can also be used with scripting
248
248
00:09:35,640 --> 00:09:38,550
or redirection to be able to send and receive files.
249
249
00:09:38,550 --> 00:09:41,130
And so we're actually going to go back a couple of sections
250
250
00:09:41,130 --> 00:09:42,540
and bring back some of our scripting,
251
251
00:09:42,540 --> 00:09:44,640
and some of our concepts that we talked about.
252
252
00:09:44,640 --> 00:09:47,550
For instance, if I set up a listener to receive a file,
253
253
00:09:47,550 --> 00:09:52,050
I'm going to use netcat -l for listener, -p for report.
254
254
00:09:52,050 --> 00:09:54,210
Let's say we're going to use port 53 on DNS,
255
255
00:09:54,210 --> 00:09:56,490
again, a non-standard report for our use here.
256
256
00:09:56,490 --> 00:09:59,010
And then, we want to pipe that information into a file.
257
257
00:09:59,010 --> 00:10:01,560
So anything that netcat receives over port 53
258
258
00:10:01,560 --> 00:10:03,360
as it's listening is going to be dropped
259
259
00:10:03,360 --> 00:10:06,030
into this database.sql file.
260
260
00:10:06,030 --> 00:10:07,380
Now again, this is non-standard
261
261
00:10:07,380 --> 00:10:10,320
because we're dealing with a SQL, which is database file,
262
262
00:10:10,320 --> 00:10:12,810
but we're dealing with port 53, which is DNS, right?
263
263
00:10:12,810 --> 00:10:15,240
So this might be something your system could flag.
264
264
00:10:15,240 --> 00:10:17,400
Now, if I want to send that file to the listener,
265
265
00:10:17,400 --> 00:10:18,600
what am I going to use?
266
266
00:10:18,600 --> 00:10:20,070
Well, I'm going to use the type command,
267
267
00:10:20,070 --> 00:10:22,680
which basically says, "Print this file to the screen.
268
268
00:10:22,680 --> 00:10:25,470
And the file I want to print is database.sql."
269
269
00:10:25,470 --> 00:10:28,140
Now, instead of just typing it to the screen though,
270
270
00:10:28,140 --> 00:10:29,460
I'm going to use a pipe,
271
271
00:10:29,460 --> 00:10:31,500
and by piping it, I can take the data
272
272
00:10:31,500 --> 00:10:33,360
and send it to the next command.
273
273
00:10:33,360 --> 00:10:34,710
So instead of pushing it to the screen,
274
274
00:10:34,710 --> 00:10:36,540
I'm actually pushing it to netcat.
275
275
00:10:36,540 --> 00:10:38,550
And netcat is going to send this to the listening IP,
276
276
00:10:38,550 --> 00:10:41,490
which in this case says 10.1.0.21,
277
277
00:10:41,490 --> 00:10:43,320
and it's going to receive it on whatever port
278
278
00:10:43,320 --> 00:10:44,310
we have the listener set up on.
279
279
00:10:44,310 --> 00:10:46,080
In this case, port 53.
280
280
00:10:46,080 --> 00:10:49,410
So take this database and push it to the netcat listener.
281
281
00:10:49,410 --> 00:10:51,030
And then the last command we just had,
282
282
00:10:51,030 --> 00:10:53,130
we had the listener set up to receive
283
283
00:10:53,130 --> 00:10:54,990
and whatever it received it pushed it into a file
284
284
00:10:54,990 --> 00:10:56,580
called database.sql.
285
285
00:10:56,580 --> 00:10:58,920
So we effectively have transferred this file.
286
286
00:10:58,920 --> 00:10:59,790
So as you can see,
287
287
00:10:59,790 --> 00:11:01,890
an attacker can use these non-standard ports
288
288
00:11:01,890 --> 00:11:03,540
to start sending data around.
289
289
00:11:03,540 --> 00:11:05,640
Because most systems will allow traffic out
290
290
00:11:05,640 --> 00:11:08,880
on port 80, or 443, or port 53,
291
291
00:11:08,880 --> 00:11:10,470
because you need that to run your business
292
292
00:11:10,470 --> 00:11:12,660
to access the web and DNS.
293
293
00:11:12,660 --> 00:11:14,520
But an attacker can also use those
294
294
00:11:14,520 --> 00:11:17,370
to send out information to some server they've set up,
295
295
00:11:17,370 --> 00:11:19,560
like netcat, that will listen on those ports,
296
296
00:11:19,560 --> 00:11:21,510
even if they're not running DNS or web.