First, the port foundation.
Although the port was briefly introduced in the previous section, the application of the port in remote control communication, especially in the attacks carried out by Trojan hackers, is far more than that described in the previous section. Because in the computer network, there are all kinds of computer network services corresponding to port technology, so here is a brief introduction of computer network services.
1. Computer network service
In the hierarchical structure of the network, each layer is strictly interdependent, and the division of labor and cooperation of each layer are concentrated on the interface between each layer. "Service" in communication process is an abstract concept, which is used to describe the relationship between adjacent layers in network hierarchy. Generally speaking, in the network hierarchy, the lower layer provides services for the upper layer. In the Open Interconnection System Model (OSI) of the International Organization for Standardization (IOS), there are seven layers, namely, physical layer, data link layer, network layer, transport layer, session layer, presentation layer and application layer from bottom to top. In this open architecture, it is also stipulated that the network layer and its lower layers are also called communication subnets, which only provide point-to-point communication without the concept of programs or processes. For example, the connection between simple network devices such as network cards and hubs belongs to the physical layer or data link layer. The concept of "end-to-end" communication is realized above the transport layer, which solves the problems of error control, flow control and data sorting of data packets. According to the different ways of various services on the Internet, all services are divided into two different ways: connection-oriented services and connectionless services. Although this has been introduced earlier in this chapter, in order to explain the "port" technology in more detail, we will further explain these two services here.
Connection-oriented services such as telephone system service mode, that is, every complete data transmission has to go through the process of establishing connection, using connection and terminating connection. Because each packet in data transmission does not carry the destination address, the connection number is used. In this way, in essence, the connection is just a channel, and sending and receiving data are not only in the same order, but also in the same content. The common protocol that uses the connection service mode is TCP protocol.
Connectionless service mode is the abstraction of postal service. Each packet carries a complete destination address and is transmitted independently in the system. Connectionless service cannot guarantee the order of packets, recover and retransmit packet errors, and cannot guarantee the reliability of packet transmission. The common protocol for providing connectionless services is UDP protocol. Because remote control mainly uses TCP/IP protocol and UDP protocol, we will introduce these two protocols first.
2. Type of computer port
According to experts' analysis, there can be up to 65,535 server ports, but in fact there are only dozens of commonly used ports, which shows that there are quite a few undefined ports. This is why so many hacker programs can define a special port in some way to achieve the purpose of intrusion. In order to define this port, you need to rely on a program to automatically load it into memory before the computer starts, and forcibly control the computer to open that special port. This program is a "backdoor" program, and these backdoor programs are usually called Trojan horses. To put it simply, these Trojan horse programs first implant a program in a personal computer by some means, and open a specific port, commonly known as the "back door", making the computer a FTP server with high openness (users have extremely high rights), and then achieve the purpose of intrusion through the back door.
There are different ways to classify ports according to their reference objects. If classified according to the nature of the port, it can usually be divided into the following three categories:
(1) Well-known ports: These ports are also commonly called "public ports". The port numbers of these ports range from 0 to 1023, and they are closely bound to some specific services. Usually, the communication of these ports clearly indicates the protocol of a service, and this port cannot be redefined. For example, port 80 is actually always used for HTTP communication, while port 23 is dedicated to Telnet service. These ports are usually not used by hackers like Trojans. In order to let you know more about these common ports, the services corresponding to these ports will be listed in detail later in this chapter for your understanding and reference.
(2) Registered port: the port number ranges from 1024 to 49 15 1. They are loosely bound to some services. In other words, many services are bound to these ports, and these ports are also used for many other purposes. Most of these ports have no clear definition of service objects, and different programs can define them according to actual needs. For example, these ports will be defined in the remote control software and Trojan horse programs introduced later. It is very necessary to remember these common program ports in the protection and killing of Trojan horses. The ports used by common Trojans will be listed in detail later.
(3) Dynamic and/or dedicated ports: the port number ranges from 49 152 to 65535. Theoretically, these ports should not be assigned to services. In fact, some special programs, especially some Trojans, like to use these ports very much, because these ports are often unknown and easy to hide.
According to different service modes, ports can be divided into "TCP protocol ports" and "UDP protocol ports". Because computers generally use these two communication protocols to communicate with each other. The "connection mode" mentioned above is a direct connection with the receiver. After sending the information, you can confirm whether the information has arrived. This mode mostly adopts TCP protocol. The other is to send information online without direct connection with the receiver, regardless of whether the information arrives or not, which is the "connectionless mode" introduced earlier. This way mostly adopts UDP protocol, and IP protocol is also a connectionless way. Ports provided for services using the above two communication protocols are also divided into "TCP protocol ports" and "UDP protocol ports".
Common ports using TCP protocol mainly include the following:
(1) FTP: define the file transfer protocol, and use port 2 1. It is often said that when a computer starts FTP service, it starts file transfer service. FTP service is used to download files and upload home pages.
(2) Telnet: It is a remote login port, and users can connect to the computer remotely in their own capacity, through which they can provide a communication service based on DOS. For example, the previous BBS was a pure character interface, and the server supporting BBS opened port 23 to provide services to the outside world.
(3) SMTP: A simple mail transmission protocol is defined, and now many mail servers use it to send mail. For example, this mail service port is used in the commonly used free mail service, so it is often seen in the mail settings that there is such an SMTP port setting bar, and the server opens 25 ports.
(4) POP3: corresponding to SMTP, POP3 is used to receive mail. Generally, the POP3 protocol uses the port 1 10. That is to say, as long as you have a corresponding program using POP3 protocol (such as Foxmail or Outlook), you can log in to the email interface without using the Web (if the email address is 163, you don't need to go to Netease website first and then enter your own email address to receive emails), and you can receive emails directly with the email program.
Commonly used UDP protocol ports are:
(1) HTTP: This is the most commonly used protocol, which is also known as hypertext transfer protocol. When surfing the Internet, you should open its port 80 on the computer that provides web resources to provide services. It is often said that "WWW service" and "Web server" use this port.
(2) DNS: used for domain name resolution service, which is most used in Windows NT system. Every computer on the Internet has a corresponding network address. This address is usually called IP address, and it is expressed in the form of pure numbers. However, this is not convenient to remember, so the domain name appears. When accessing a computer, you only need to know the domain name, and the conversion of domain name and IP address is completed by DNS server. DNS uses port 53.
(3) SNMP: Simple network management protocol, which uses port 16 1 to manage network devices. Because there are many network devices, connectionless service shows its advantages.
(4) OICQ: OICQ program not only accepts services, but also provides services, so that two chat talents are equal. OICQ uses connectionless protocol, that is, it uses UDP protocol. Its server uses port 8000 to listen to information, and the client uses port 4000 to send information. If both ports are in use (many people are chatting with several friends at the same time), add them in order.
Second, common computer ports.
Among the more than 60,000 ports of a computer, those with port numbers within 1024 are usually called public ports, and the services corresponding to these public ports are usually fixed. It is necessary to know these common ports in a program.
1. public server port
These ports are the default ports of the server and cannot be changed. These ports are mainly used in general communication, so it is very necessary to know these server ports. Table 2. 1 lists the services corresponding to this port.
Table 1 common ports of server
Service Type Default Port Service Type Default Port
Echo 7 daytime 13
FTP 2 1 Telnet 23
SMTP 25 time 37
Whois 43 DNS 53
Gopher 70 finger 79
WWW 80 POP3 1 10
NNTP 1 19 IRC 194
In addition, proxy servers usually use the following ports:
(1). Common port number of HTTP protocol proxy server: 80/8080/3128/8081/9080.
(2).SOCKS proxy protocol server public port number: 1080.
(3) Commonly used port number of FTP protocol proxy server: 2 1.
(4).Telnet protocol proxy server universal port: 23