Create Malware Lab Winter 2024 Blog Post

data/blog/Malware Lab Winter 2024 Blog Post

@@ -0,0 +1,71 @@
+---
+title: Malware Lab Winter 2024
+authors: [Dylan Truong, Jason Jiang, Emma Lin, Yashica Prasad, Hunter Kang]
+category: Projects
+description: Lab focused on creating malware payloads
+---
+
+<img src="https://www.csoonline.com/wp-content/uploads/2023/06/security_risk_assessment_analysis_vulnerability_danger_thinkstock_902893076-100750007-orig.jpg?quality=50&strip=all&w=1024" alt="blog image" />
+
+
+
+
+
+
+
+
+
+In this lab, we delved into how malware is able to attack our systems, and how to even develop our own, from developing phishing emails to writing scripts to execute malicious code on a system.
+
+
+
+
+
+
+## INITIAL FOOTHOLD 
+Although most forms of Malware can be easily avoided if users are cautious of their device usage, the wide variety of methods in which malware can infect a device, has allowed frequent infections of devices globally. The more common types of malware infection include phishing emails, websites offering free services, download button spam, and fake software installment.
+
+In this lab, we created our own phishing emails to infect the unwary user. With the recent advancements in AI, we were able to utilize chatGPT to develop a basic template for such an email. Then, with some simple code, we succesfully delivered the emails with HTML and python.
+
+
+
+
+
+
+## PRIVILEGE ESCALATION 
+
+Privilege Escalation is the process of gaining higher permissions from the user. While there are many ways to obtain this, the method we chose was to directly ask the user for permission. This was done through the use of the sudo command, which would be activated when our 'victim' would download our file to run from the previous phishing attacks. 
+
+## PERSISTANCE 
+
+Persistence is the ability of malware to maintain its presence and control over a compromised system over an extended period. Persistent malware allows the attacker to continue to gather up do date information and thus the ability to sustain the attack.
+We implemented persistence in our malware through Cron, a time-based task scheduling system in Unix-like operating systems where users can schedule tasks to run at specific times known as “cron jobs”. We used a cron job that periodically runs a script that steals a target’s information
+#### Types of Persistence
+* **Timed**: scheduled tasks
+* **Hooks**: restart tasks, shell profile scripts, etc
+* **Integration**: kernel-level modifications, binary replacement, bios firmware hijacking, AD infection etc
+
+
+## FINAL PAYLOAD
+
+The final payload depends on what the attacker decides to do with the information they are able to access and gain. Different people have different motives when they attack. Some examples include selling the information, deleting or modifying the user's information and files, installing adware or malware, injecting viruses, usin ransomware, or even mining cryptocurrency. 
+
+In our case, we chose to install a keylogger onto the computer after sending the data off the machine. 
+
+![github](https://hackmd.io/_uploads/HywkMWT66.png)
+
+This was the keylogger we made attempts to install onto the machine we infected. 
+![keylogger](https://hackmd.io/_uploads/rkAZf-pTp.png)
+
+There are also choices to brute-force test the passwords to get into the machines. 
+![password cracker](https://hackmd.io/_uploads/rykMGZTpT.png)
+
+
+## ROADBLOCKS 
+
+### Graphics Servers
+Certain actions like calling a webbrowser or downloading the keylogger seem to fail because the root user does not provide an acceptable graphics server to the programs.
+
+### Executable Bundling
+pyinstaller, the program we used to turn the python script into a single executable, makes dealing with paths like the path to the python script inside the bundle more complicated to determine. We also did not have time to figure out why the executable only worked the specific location it was created in.
+