恶意代码分析-使用apataDNS+inetsim模拟网络环境

准备工作

虚拟机安装:

Win7

Ubuntu

apateDNS 密码:wplo

inetsim 密码:ghla

客户端Win7需要做的工作

安装apateDNS

服务器端Ubuntu需要做的工作

下载inetsim,解压后将文件夹拷贝到Ubuntu系统。在 inetsim-1.2.5/cnf 下,将原本的配置文件 inetsim.conf 重名为任意不同于此的文件名(使其失效)。创建新的配置文件inetsim.conf ,并在其中写入(且将下列内容中的 xx.xx.xx.xx 替换为自己Ubuntu系统的IP地址):

#############################################################
#
# INetSim configuration file
#
#############################################################


#############################################################
# Main configuration
#############################################################

#########################################
# start_service
#
# The services to start
#
# Syntax: start_service 
#
# Default: none
#
# Available service names are:
# dns, http, smtp, pop3, tftp, ftp, ntp, time_tcp,
# time_udp, daytime_tcp, daytime_udp, echo_tcp,
# echo_udp, discard_tcp, discard_udp, quotd_tcp,
# quotd_udp, chargen_tcp, chargen_udp, finger,
# ident, syslog, dummy_tcp, dummy_udp, smtps, pop3s,
# ftps, irc, https
#
start_service dns
start_service http
start_service https
start_service smtp
start_service smtps
start_service pop3
start_service pop3s
start_service ftp
start_service ftps
start_service tftp
start_service irc
start_service ntp
start_service finger
start_service ident
start_service syslog
start_service time_tcp
start_service time_udp
start_service daytime_tcp
start_service daytime_udp
start_service echo_tcp
start_service echo_udp
start_service discard_tcp
start_service discard_udp
start_service quotd_tcp
start_service quotd_udp
start_service chargen_tcp
start_service chargen_udp
start_service dummy_tcp
start_service dummy_udp


#########################################
# service_bind_address
#
# IP address to bind services to
#
# Syntax: service_bind_address 
#
# Default: 127.0.0.1
#
service_bind_address    xx.xx.xx.xx


#########################################
# service_run_as_user
#
# User to run services
#
# Syntax: service_run_as_user 
#
# Default: nobody
#
#service_run_as_user    inetsim


#########################################
# service_max_childs
#
# Maximum number of child processes (parallel connections)
# for each service
#
# Syntax: service_max_childs [1..30]
#
# Default: 10
#
#service_max_childs 15


#########################################
# service_timeout
#
# If a client does not send any data for the number of seconds
# given here, the corresponding connection will be closed.
#
# Syntax: service_timeout [1..600]
#
# Default: 120
#
#service_timeout    60


#########################################
# create_reports
#
# Create report with a summary of connections
# for the session on shutdown
#
# Syntax: create_reports [yes|no]
#
# Default: yes
#
#create_reports     no


#########################################
# report_language
#
# Set language for reports
# Note: Currently only languages 'en' and 'de' are supported
#
# Syntax: report_language 
#
# Default: en
#
#report_language    de


#############################################################
# Faketime
#############################################################

#########################################
# faketime_init_delta
#
# Initial number of seconds (positive or negative)
# relative to current date/time for fake time used by all services 
#
# Syntax: faketime_init_delta 
#
# Default: 0  (use current date/time) 
#
#faketime_init_delta    1000


#########################################
# faketime_auto_delay
#
# Number of seconds to wait before incrementing fake time
# by value specified with 'faketime_auto_increment'.
# Setting to '0' disables this option.
#
# Syntax: faketime_auto_delay [0..86400]
#
# Default: 0  (disabled)
#
#faketime_auto_delay    1000


#########################################
# faketime_auto_increment
#
# Number of seconds by which fake time is incremented at
# regular intervals specified by 'faketime_auto_delay'.
# This option only takes effect if 'faketime_auto_delay'
# is enabled (not set to '0').
#
# Syntax: faketime_auto_increment [-31536000..31536000]
#
# Default: 3600
#
#faketime_auto_increment    86400


#############################################################
# Service DNS
#############################################################

#########################################
# dns_bind_port
#
# Port number to bind DNS service to
#
# Syntax: dns_bind_port 
#
# Default: 53
#
#dns_bind_port      53


#########################################
# dns_default_ip
#
# Default IP address to return with DNS replies
#
# Syntax: dns_default_ip 
#
# Default: 127.0.0.1
#
dns_default_ip      xx.xx.xx.xx


#########################################
# dns_default_hostname
#
# Default hostname to return with DNS replies
#
# Syntax: dns_default_hostname 
#
# Default: www
#
#dns_default_hostname       somehost


#########################################
# dns_default_domainname
#
# Default domain name to return with DNS replies
#
# Syntax: dns_default_domainname 
#
# Default: inetsim.org
#
#dns_default_domainname     some.domain


#########################################
# dns_static
#
# Static mappings for DNS
#
# Syntax: dns_static  
#
# Default: none
#
#dns_static www.foo.com 10.10.10.10
#dns_static ns1.foo.com 10.70.50.30
#dns_static ftp.bar.net 10.10.20.30


#########################################
# dns_version
#
# DNS version
#
# Syntax: dns_version 
#
# Default: "INetSim DNS Server"
#
#dns_version "9.2.4"


#############################################################
# Service HTTP
#############################################################

#########################################
# http_bind_port
#
# Port number to bind HTTP service to
#
# Syntax: http_bind_port 
#
# Default: 80
#
#http_bind_port     80


#########################################
# http_version
#
# Version string to return in HTTP replies
#
# Syntax: http_version 
#
# Default: "INetSim HTTP server"
#
#http_version       "Microsoft-IIS/4.0"


#########################################
# http_fakemode
#
# Turn HTTP fake mode on or off
#
# Syntax: http_fakemode [yes|no]
#
# Default: yes
#
#http_fakemode      no


#########################################
# http_fakefile
#
# Fake files returned in fake mode based on the file extension
# in the HTTP request.
# The fake files must be placed in /http/fakefiles
#
# Syntax: http_fakefile   
#
# Default: none
#
http_fakefile       txt sample.txt  text/plain
http_fakefile       htm sample.html text/html
http_fakefile       html    sample.html text/html
http_fakefile       php sample.html text/html
http_fakefile       gif sample.gif  image/gif
http_fakefile       jpg sample.jpg  image/jpeg
http_fakefile       jpeg    sample.jpg  image/jpeg
http_fakefile       png sample.png  image/png
http_fakefile       bmp sample.bmp  image/x-ms-bmp
http_fakefile       ico favicon.ico image/x-icon
http_fakefile       exe sample_gui.exe  x-msdos-program
http_fakefile       com sample_gui.exe  x-msdos-program


#########################################
# http_default_fakefile
#
# The default fake file returned in fake mode if the file extension
# in the HTTP request does not match any of the extensions
# defined above.
#
# The default fake file must be placed in /http/fakefiles
#
# Syntax: http_default_fakefile  
#
# Default: none
#
http_default_fakefile   sample.html text/html


#########################################
# http_static_fakefile
#
# Fake files returned in fake mode based on static path.
# The fake files must be placed in /http/fakefiles
#
# Syntax: http_static_fakefile   
#
# Default: none
#
#http_static_fakefile   /path/          sample_gui.exe  x-msdos-program
#http_static_fakefile   /path/to/file.exe   sample_gui.exe  x-msdos-program


#############################################################
# Service HTTPS
#############################################################

#########################################
# https_bind_port
#
# Port number to bind HTTPS service to
#
# Syntax: https_bind_port 
#
# Default: 443
#
#https_bind_port        443


#########################################
# https_version
#
# Version string to return in HTTPS replies
#
# Syntax: https_version 
#
# Default: "INetSim HTTPs server"
#
#https_version      "Microsoft-IIS/4.0"


#########################################
# https_fakemode
#
# Turn HTTPS fake mode on or off
#
# Syntax: https_fakemode [yes|no]
#
# Default: yes
#
#https_fakemode     no


#########################################
# https_fakefile
#
# Fake files returned in fake mode based on the file extension
# in the HTTPS request.
# The fake files must be placed in /http/fakefiles
#
# Syntax: https_fakefile   
#
# Default: none
#
https_fakefile      txt sample.txt  text/plain
https_fakefile      htm sample.html text/html
https_fakefile      html    sample.html text/html
https_fakefile      php sample.html text/html
https_fakefile      gif sample.gif  image/gif
https_fakefile      jpg sample.jpg  image/jpeg
https_fakefile      jpeg    sample.jpg  image/jpeg
https_fakefile      png sample.png  image/png
https_fakefile      bmp sample.bmp  image/x-ms-bmp
https_fakefile      ico favicon.ico image/x-icon
https_fakefile      exe sample_gui.exe  x-msdos-program
https_fakefile      com sample_gui.exe  x-msdos-program


#########################################
# https_default_fakefile
#
# The default fake file returned in fake mode if the file extension
# in the HTTPS request does not match any of the extensions
# defined above.
#
# The default fake file must be placed in /http/fakefiles
#
# Syntax: https_default_fakefile  
#
# Default: none
#
https_default_fakefile  sample.html text/html


#########################################
# https_static_fakefile
#
# Fake files returned in fake mode based on static path.
# The fake files must be placed in /http/fakefiles
#
# Syntax: https_static_fakefile   
#
# Default: none
#
#https_static_fakefile  /path/          sample_gui.exe  x-msdos-program
#https_static_fakefile  /path/to/file.exe   sample_gui.exe  x-msdos-program


#########################################
# https_ssl_keyfile
#
# Name of the SSL private key PEM file.
# The key MUST NOT be encrypted!
#
# The file must be placed in /certs/
#
# Syntax: https_ssl_keyfile 
#
# Default: default_key.pem
#
#https_ssl_keyfile  https_key.pem


#########################################
# https_ssl_certfile
#
# Name of the SSL certificate file.
#
# The file must be placed in /certs/
#
# Syntax: https_ssl_certfile 
#
# Default: default_cert.pem
#
#https_ssl_certfile https_cert.pem


#########################################
# https_ssl_dhfile
#
# Name of the Diffie-Hellman parameter PEM file.
#
# The file must be placed in /certs/
#
# Syntax: https_ssl_dhfile 
#
# Default: none
#
#https_ssl_dhfile   https_dh1024.pem


#############################################################
# Service SMTP
#############################################################

#########################################
# smtp_bind_port
#
# Port number to bind SMTP service to
#
# Syntax: smtp_bind_port 
#
# Default: 25
#
#smtp_bind_port     25


#########################################
# smtp_fqdn_hostname
#
# The FQDN hostname used for SMTP
#
# Syntax: smtp_fqdn_hostname 
#
# Default: mail.inetsim.org
#
#smtp_fqdn_hostname foo.bar.org


#########################################
# smtp_banner
#
# The banner string used in SMTP greeting message
#
# Syntax: smtp_banner 
#
# Default: "INetSim Mail Service ready."
#
#smtp_banner        "SMTP Mailer ready."


#########################################
# smtp_helo_required
#
# Client has to send HELO/EHLO before any other command
#
# Syntax: smtp_helo_required [yes|no]
#
# Default: no
#
#smtp_helo_required yes


#########################################
# smtp_extended_smtp
#
# Turn support for extended smtp (ESMTP) on or off
#
# Syntax: smtp_extended_smtp [yes|no]
#
# Default: yes
#
#smtp_extended_smtp no


#########################################
# smtp_service_extension
#
# SMTP service extensions offered to client.
# For more information, see
# 
#
# Syntax: smtp_service_extension 
#
# Supported extensions and parameters:
# VRFY
# EXPN
# HELP
# 8BITMIME
# SIZE          # one optional parameter
# ENHANCEDSTATUSCODES
# AUTH          # one or more of [PLAIN LOGIN ANONYMOUS CRAM-MD5 CRAM-SHA1]
# DSN
# SEND
# SAML
# SOML
# TURN
# ETRN
# ATRN
# VERP
# MTRK
# CHUNKING
# STARTTLS
# DELIVERBY     # one optional parameter
# SUBMITTER
# CHECKPOINT
# BINARYMIME
# NO-SOLICITING     # one optional parameter
# FUTURERELEASE     # two required parameters
#
# Default: none
#
smtp_service_extension      VRFY
smtp_service_extension      EXPN
smtp_service_extension      HELP
smtp_service_extension      8BITMIME
smtp_service_extension      SIZE 102400000
smtp_service_extension      ENHANCEDSTATUSCODES
smtp_service_extension      AUTH PLAIN LOGIN ANONYMOUS CRAM-MD5 CRAM-SHA1
smtp_service_extension      DSN
smtp_service_extension      ETRN
smtp_service_extension      STARTTLS
#


#########################################
# smtp_auth_reversibleonly
#
# Only offer authentication mechanisms which allow reversing
# the authentication information sent by a client
# to clear text username/password.
# This option only takes effect if 'smtp_extended_smtp' is
# enabled and 'smtp_service_extension AUTH' is configured.
#
# Syntax: smtp_auth_reversibleonly [yes|no]
#
# Default: no
#
#smtp_auth_reversibleonly   yes


#########################################
# smtp_auth_required
#
# Force the client to authenticate.
# This option only takes effect if 'smtp_extended_smtp' is
# enabled and 'smtp_service_extension AUTH' is configured.
#
# Syntax: smtp_auth_required [yes|no]
#
# Default: no
#
#smtp_auth_required yes


#########################################
# smtp_ssl_keyfile
#
# Name of the SSL private key PEM file.
# The key MUST NOT be encrypted!
#
# This option only takes effect if 'smtp_extended_smtp' is
# enabled and 'smtp_service_extension STARTTLS' is configured.
#
# The file must be placed in /certs/
#
# Note: If no key file is specified, the extension STARTTLS
# will be disabled.
#
# Syntax: smtp_ssl_keyfile 
#
# Default: default_key.pem
#
#smtp_ssl_keyfile   smtp_key.pem


#########################################
# smtp_ssl_certfile
#
# Name of the SSL certificate PEM file.
#
# This option only takes effect if 'smtp_extended_smtp' is
# enabled and 'smtp_service_extension STARTTLS' is configured.
#
# The file must be placed in /certs/
#
# Note: If no cert file is specified, the extension STARTTLS
# will be disabled.
#
# Syntax: smtp_ssl_certfile 
#
# Default: default_cert.pem
#
#smtp_ssl_certfile  smtp_cert.pem


#########################################
# smtp_ssl_dhfile
#
# Name of the Diffie-Hellman parameter PEM file.
#
# The file must be placed in /certs/
#
# Syntax: smtp_ssl_dhfile 
#
# Default: none
#
#smtp_ssl_dhfile    smtp_dh1024.pem



#############################################################
# Service SMTPS
#############################################################

#########################################
# smtps_bind_port
#
# Port number to bind SMTPS service to
#
# Syntax: smtps_bind_port 
#
# Default: 465
#
#smtps_bind_port    465


#########################################
# smtps_fqdn_hostname
#
# The FQDN hostname used for SMTPS
#
# Syntax: smtps_fqdn_hostname 
#
# Default: mail.inetsim.org
#
#smtps_fqdn_hostname    foo.bar.org


#########################################
# smtps_banner
#
# The banner string used in SMTPS greeting message
#
# Syntax: smtps_banner 
#
# Default: "INetSim Mail Service ready."
#
#smtps_banner       "SMTPS Mailer ready."


#########################################
# smtps_helo_required
#
# Client has to send HELO/EHLO before any other command
#
# Syntax: smtps_helo_required [yes|no]
#
# Default: no
#
#smtps_helo_required    yes


#########################################
# smtps_extended_smtp
#
# Turn support for extended smtp (ESMTP) on or off
#
# Syntax: smtps_extended_smtp [yes|no]
#
# Default: yes
#
#smtps_extended_smtp    no


#########################################
# smtps_service_extension
#
# SMTP service extensions offered to client.
# For more information, see
# 
#
# Syntax: smtp_service_extension 
#
# Supported extensions and parameters:
# VRFY
# EXPN
# HELP
# 8BITMIME
# SIZE          # one optional parameter
# ENHANCEDSTATUSCODES
# AUTH          # one or more of [PLAIN LOGIN ANONYMOUS CRAM-MD5 CRAM-SHA1]
# DSN
# SEND
# SAML
# SOML
# TURN
# ETRN
# ATRN
# VERP
# MTRK
# CHUNKING
# DELIVERBY     # one optional parameter
# SUBMITTER
# CHECKPOINT
# BINARYMIME
# NO-SOLICITING     # one optional parameter
# FUTURERELEASE     # two required parameters
#
# Default: none
#
smtps_service_extension     VRFY
smtps_service_extension     EXPN
smtps_service_extension     HELP
smtps_service_extension     8BITMIME
smtps_service_extension     SIZE 102400000
smtps_service_extension     ENHANCEDSTATUSCODES
smtps_service_extension     AUTH PLAIN LOGIN ANONYMOUS CRAM-MD5 CRAM-SHA1
smtps_service_extension     DSN
smtps_service_extension     ETRN
#


#########################################
# smtps_auth_reversibleonly
#
# Only offer authentication mechanisms which allow reversing
# the authentication information sent by a client
# to clear text username/password.
# This option only takes effect if 'smtps_extended_smtp' is
# enabled and 'smtps_service_extension AUTH' is configured.
#
# Syntax: smtps_auth_reversibleonly [yes|no]
#
# Default: no
#
#smtps_auth_reversibleonly  yes


#########################################
# smtps_auth_required
#
# Force the client to authenticate.
# This option only takes effect if 'smtps_extended_smtp' is
# enabled and 'smtp_service_extension AUTH' is configured.
#
# Syntax: smtps_auth_required [yes|no]
#
# Default: no
#
#smtps_auth_required    yes


#########################################
# smtps_ssl_keyfile
#
# Name of the SSL private key PEM file.
# The key MUST NOT be encrypted!
#
# The file must be placed in /certs/
#
# Syntax: smtps_ssl_keyfile 
#
# Default: default_key.pem
#
#smtps_ssl_keyfile  smtps_key.pem


#########################################
# smtps_ssl_certfile
#
# Name of the SSL certificate PEM file.
#
# The file must be placed in /certs/
#
# Syntax: smtps_ssl_certfile 
#
# Default: default_cert.pem
#
#smtps_ssl_certfile smtps_cert.pem


#########################################
# smtps_ssl_dhfile
#
# Name of the Diffie-Hellman parameter PEM file.
#
# The file must be placed in /certs/
#
# Syntax: smtps_ssl_dhfile 
#
# Default: none
#
#smtps_ssl_dhfile   smtps_dh1024.pem


#############################################################
# Service POP3
#############################################################

#########################################
# pop3_bind_port
#
# Port number to bind POP3 service to
#
# Syntax: pop3_bind_port 
#
# Default: 110
#
#pop3_bind_port     110


#########################################
# pop3_banner
#
# The banner string used in POP3 greeting message
#
# Syntax: pop3_banner 
#
# Default: "INetSim POP3 Server ready"
#
#pop3_banner        "POP3 Server ready"


#########################################
# pop3_hostname
#
# The hostname used in POP3 greeting message
#
# Syntax: pop3_hostname 
#
# Default: pop3host
#
#pop3_hostname      pop3server


#########################################
# pop3_mbox_maxmails
#
# Maximum number of e-mails to select from supplied mbox files
# for creation of random POP3 mailbox
#
# Syntax: pop3_mbox_maxmails 
#
# Default: 10
#
#pop3_mbox_maxmails 20


#########################################
# pop3_mbox_reread
#
# Re-read supplied mbox files if POP3 service was inactive
# for  seconds
#
# Syntax: pop3_mbox_reread 
#
# Default: 180
#
#pop3_mbox_reread   300


#########################################
# pop3_mbox_rebuild
#
# Rebuild random POP3 mailbox if POP3 service was inactive
# for  seconds
#
# Syntax: pop3_mbox_rebuild 
#
# Default: 60
#
#pop3_mbox_rebuild  120


#########################################
# pop3_enable_apop
#
# Turn APOP on or off
#
# Syntax: pop3_enable_apop [yes|no]
#
# Default: yes
#
#pop3_enable_apop   no


#########################################
# pop3_auth_reversibleonly
#
# Only offer authentication mechanisms which allow reversing
# the authentication information sent by a client
# to clear text username/password
#
# Syntax: pop3_auth_reversibleonly [yes|no]
#
# Default: no
#
#pop3_auth_reversibleonly   yes


#########################################
# pop3_enable_capabilities
#
# Turn support for pop3 capabilities on or off
#
# Syntax: pop3_enable_capabilities [yes|no]
#
# Default: yes
#
#pop3_enable_capabilities   no


#########################################
# pop3_capability
#
# POP3 capabilities offered to client.
# For more information, see
# 
#
# Syntax: pop3_capability 
#
# Supported capabilities and parameters:
# TOP
# USER
# UIDL
# SASL          # one or more of [PLAIN LOGIN ANONYMOUS CRAM-MD5 CRAM-SHA1]
# RESP-CODES
# EXPIRE        # one required parameter and one optional parameter
# LOGIN-DELAY       # one required parameter and one optional parameter
# IMPLEMENTATION    # one required parameter
# AUTH-RESP-CODE
# STLS
#
# Default: none
#
pop3_capability     TOP
pop3_capability     USER
pop3_capability     SASL PLAIN LOGIN ANONYMOUS CRAM-MD5 CRAM-SHA1
pop3_capability     UIDL
pop3_capability     IMPLEMENTATION "INetSim POP3 server"
pop3_capability     STLS
#


#########################################
# pop3_ssl_keyfile
#
# Name of the SSL private key PEM file.
# The key MUST NOT be encrypted!
#
# This option only takes effect if 'pop3_enable_capabilities' is
# true and 'pop3_capability STLS' is configured.
#
# The file must be placed in /certs/
#
# Note: If no key file is specified, capability STLS will be disabled.
#
# Syntax: pop3_ssl_keyfile 
#
# Default: default_key.pem
#
#pop3_ssl_keyfile   pop3_key.pem


#########################################
# pop3_ssl_certfile
#
# Name of the SSL certificate PEM file.
#
# This option only takes effect if 'pop3_enable_capabilities' is
# true and 'pop3_capability STLS' is configured.
#
# The file must be placed in /certs/
#
# Note: If no cert file is specified, capability STLS will be disabled.
#
# Syntax: pop3_ssl_certfile 
#
# Default: default_cert.pem
#
#pop3_ssl_certfile  pop3_cert.pem


#########################################
# pop3_ssl_dhfile
#
# Name of the Diffie-Hellman parameter PEM file.
#
# The file must be placed in /certs/
#
# Syntax: pop3_ssl_dhfile 
#
# Default: none
#
#pop3_ssl_dhfile    pop3_dh1024.pem


#############################################################
# Service POP3S
#############################################################

#########################################
# pop3s_bind_port
#
# Port number to bind POP3S service to
#
# Syntax: pop3s_bind_port 
#
# Default: 995
#
#pop3s_bind_port        995


#########################################
# pop3s_banner
#
# The banner string used in POP3 greeting message
#
# Syntax: pop3s_banner 
#
# Default: "INetSim POP3 Server ready"
#
#pop3s_banner       "POP3 Server ready"


#########################################
# pop3s_hostname
#
# The hostname used in POP3 greeting message
#
# Syntax: pop3s_hostname 
#
# Default: pop3host
#
#pop3s_hostname     pop3server


#########################################
# pop3s_mbox_maxmails
#
# Maximum number of e-mails to select from supplied mbox files
# for creation of random POP3 mailbox
#
# Syntax: pop3s_mbox_maxmails 
#
# Default: 10
#
#pop3s_mbox_maxmails    20


#########################################
# pop3s_mbox_reread
#
# Re-read supplied mbox files if POP3S service was inactive
# for  seconds
#
# Syntax: pop3s_mbox_reread 
#
# Default: 180
#
#pop3s_mbox_reread  300


#########################################
# pop3s_mbox_rebuild
#
# Rebuild random POP3 mailbox if POP3S service was inactive
# for  seconds
#
# Syntax: pop3s_mbox_rebuild 
#
# Default: 60
#
#pop3s_mbox_rebuild 120


#########################################
# pop3s_enable_apop
#
# Turn APOP on or off
#
# Syntax: pop3s_enable_apop [yes|no]
#
# Default: yes
#
#pop3s_enable_apop  no


#########################################
# pop3s_auth_reversibleonly
#
# Only offer authentication mechanisms which allow reversing
# the authentication information sent by a client
# to clear text username/password
#
# Syntax: pop3s_auth_reversibleonly [yes|no]
#
# Default: no
#
#pop3s_auth_reversibleonly  yes


#########################################
# pop3s_enable_capabilities
#
# Turn support for pop3 capabilities on or off
#
# Syntax: pop3s_enable_capabilities [yes|no]
#
# Default: yes
#
#pop3s_enable_capabilities  no


#########################################
# pop3s_capability
#
# POP3 capabilities offered to client.
# For more information, see
# 
#
# Syntax: pop3s_capability 
#
# Supported capabilities and parameters:
# TOP
# USER
# UIDL
# SASL          # one or more of [PLAIN LOGIN ANONYMOUS CRAM-MD5 CRAM-SHA1]
# RESP-CODES
# EXPIRE        # one required parameter and one optional parameter
# LOGIN-DELAY       # one required parameter and one optional parameter
# IMPLEMENTATION    # one required parameter
# AUTH-RESP-CODE
#
# Default: none
#
pop3s_capability    TOP
pop3s_capability    USER
pop3s_capability    SASL PLAIN LOGIN ANONYMOUS CRAM-MD5 CRAM-SHA1
pop3s_capability    UIDL
pop3s_capability    IMPLEMENTATION "INetSim POP3s server"
#


#########################################
# pop3s_ssl_keyfile
#
# Name of the SSL private key PEM file.
# The key MUST NOT be encrypted!
#
# The file must be placed in /certs/
#
# Syntax: pop3s_ssl_keyfile 
#
# Default: default_key.pem
#
#pop3s_ssl_keyfile  pop3s_key.pem


#########################################
# pop3s_ssl_certfile
#
# Name of the SSL certificate PEM file.
#
# The file must be placed in /certs/
#
# Syntax: pop3s_ssl_certfile 
#
# Default: default_cert.pem
#
#pop3s_ssl_certfile pop3s_cert.pem


#########################################
# pop3s_ssl_dhfile
#
# Name of the Diffie-Hellman parameter PEM file.
#
# The file must be placed in /certs/
#
# Syntax: pop3s_ssl_dhfile 
#
# Default: none
#
#pop3s_ssl_dhfile   pop3s_dh1024.pem


#############################################################
# Service TFTP
#############################################################

#########################################
# tftp_bind_port
#
# Port number to bind TFTP service to
#
# Syntax: tftp_bind_port 
#
# Default: 69
#
#tftp_bind_port     69


#########################################
# tftp_allow_overwrite
#
# Allow overwriting of existing files
#
# Syntax: tftp_allow_overwrite [yes|no]
#
# Default: no
#
#tftp_allow_overwrite   yes


#########################################
# tftp_enable_options
#
# Turn support for tftp options on or off
#
# Syntax: tftp_enable_options [yes|no]
#
# Default: yes
#
#tftp_enable_options    no


#########################################
# tftp_option
#
# TFTP extensions offered to client.
# For more information, see RFC 2347
#
# Syntax: tftp_option 

恶意代码分析-使用apataDNS+inetsim模拟网络环境_第1张图片

测试是否成功

  1. 在win7下cmd使用命令 ipconfig 查看win7 IP地址为:192.168.2.2

恶意代码分析-使用apataDNS+inetsim模拟网络环境_第2张图片

  1. 在ubuntu下使用命令 ifconfig -a 查看ubuntu IP地址为:192.168.2.167

    恶意代码分析-使用apataDNS+inetsim模拟网络环境_第3张图片

  2. 使用 ping 命令查看两个系统能否连通,如下图则确认连通。

    恶意代码分析-使用apataDNS+inetsim模拟网络环境_第4张图片

  3. Ubuntu下使用终端进入 inetsim 目录下:

    恶意代码分析-使用apataDNS+inetsim模拟网络环境_第5张图片

    接着运行命令 sudo ./inetsim ,运行结果如下:

    恶意代码分析-使用apataDNS+inetsim模拟网络环境_第6张图片

    至此,ubuntu服务器端前期工作完成。

  4. Win7客户端启动 apateDNS 软件,输入Ubuntu服务器端的IP地址,点击 Start Server 按钮。如图

    恶意代码分析-使用apataDNS+inetsim模拟网络环境_第7张图片

  5. win7下,在浏览器中访问任意网站,或者启动应用。可以观察应用或网页请求服务器的行为。本例中我们试着访问 https://hao.360.cn/ 。显示效果如下,可见返回了Ubuntu服务器端的请求数据。

    恶意代码分析-使用apataDNS+inetsim模拟网络环境_第8张图片

  6. 接着在Ubuntu服务器端ctrl+c。在 inetsim-1.2.5/report 目录下生成日志报告。

    恶意代码分析-使用apataDNS+inetsim模拟网络环境_第9张图片

    使用命令 sudo cat report.2629.txt 查看日志内容:

    恶意代码分析-使用apataDNS+inetsim模拟网络环境_第10张图片

    可以看到我们的网址请求在服务器端都请求了什么。

    注:sample.html就是服务器返回给客户端的样例网页(倒数第三张图片)。

转载于:https://www.cnblogs.com/houhaibushihai/p/9681193.html

你可能感兴趣的:(恶意代码分析-使用apataDNS+inetsim模拟网络环境)