Malware threats

December 09, 2020

Malware threats

Create a Fork Bomb

In the simplest terms, malware is malicious software. Malware is a category of malicious software, which can contain different types:

Virus
Worm
Trojan
Keylogger
Spyware
Backdoor
Ransomware

Different types of malware have different characteristics. For example, a trojan is a malware that is hidden inside a regular software. A trojan is often used for various purposes, such as:

Creation of a backdoor
Unauthorized access
File deletion
Spreading infection to the connected drives
Disabling firewall

A trojan can be of different types, such as:

FTP Trojan
VNC Trojan
Mobile Trojan
Notification Trojan
Data hiding Trojan
ICMP Trojan
Mobile Trojan
HTTP/HTTPS Trojan
Remote Access Trojan (RAT)

There are different methods using which malware can propagate. Some of the common methods are:

Free applications or software, such as software cracks or pirated software
Free file-sharing services, such as torrents or peer-to-peer
Removable media
An E-mail that contains a malicious attachment

In this exercise, you will learn to create a fork bomb and execute it.

Learning Outcomes

After completing this exercise, you will be able to:

Create a Fork Bomb as a Simple Virus

Your Devices

You will be using the following devices in this lab. Please power these on now.

PLABDC01 - (Windows Server 2019 - Domain Server)
PLABWIN10 - (Windows 10 - Workstation)

Practice Labs screenshot.

Task 1 - Create a Fork Bomb as a Simple Virus

A fork bomb is a form of virus. When executed, it continuously repeats itself and consumes the system’s resources. A fork bomb does not harm any files on the system. However, it slows down or crashes the system. You can create a fork bomb using a batch file and execute it. You can create batch files to perform malicious tasks such as deleting system files, creating backdoors, and so on.

Consider an example of a batch file that will delete all the files in the Windows operating system’s System32 directory. The given code on execution can result in damage to your system, and it may require extensive time and skill to fix the system.

@echo off
Del c:\windows\system32\*.*
Del c:\windows\*.*

The @echo off command will disable the command prompt from being shown and will execute the batch file in the back end.

In this task, you will create a fork bomb using a batch file and execute it.

Step 1

Ensure you have powered on the required devices and connect to PLABWIN10.

Figure 1.1 Screenshot of PLABWIN10: Displaying the desktop of PLABWIN10.

Step 2

To open the Task Manager, from PLABWIN10 desktop, right-click the taskbar and select Task Manager.

Figure 1.2 Screenshot of PLABWIN10: Right-clicking the taskbar to select Task Manager.

Step 3

The Task Manager window is displayed. Click the More details drop-down arrow.

Figure 1.3 Screenshot of PLABWIN10: Showing the Task Manager window.

Step 4

The Task Manager window expands with the Processes tab selected by default.

To open the Performance tab, in the Task Manager window, click the Performance tab.

Note: The Performance tab in the Task Manager helps you observe the working of the fork bomb execution.

Figure 1.4 Screenshot of PLABWIN10: Showing the Processes tab and clicking the Performance tab.

Step 5

Notice that the performance of various components, such as CPU and Memory, is displayed on this tab.

Figure 1.5 Screenshot of PLABWIN10: Showing the CPU performance on the Performance tab.

Step 6

You need to now open Notepad.

In the Type here to search textbox, type the following:

Notepad

From the search results, click Notepad.

Figure 1.6 Screenshot of PLABWIN10: Selecting Notepad from the search results.

Step 7

The Untitled - Notepad window opens.

To create a new batch file, in the Untitled - Notepad window, type the following fork bomb code:

%0|%0

Note: A batch file contains instructions to be executed in sequence. In this batch file, %0 is the name of the currently executing batch file. This batch file is going to recursively execute itself forever. It quickly creates many processes and slows down the system.

Figure 1.7 Screenshot of PLABWIN10: Entering the commands in the Notepad file.

Step 8

To save the file, click File > Save As.

Figure 1.8 Screenshot of PLABWIN10: Selecting Save As from the File menu.

Step 9

The Save As dialog box appears. You can save the file on the desktop. To do this, select Desktop in the left pane.

To provide the file name, in the File name textbox, type the following name:

forkbomb.bat

From the Save as type drop-down, select All Files.

Click Save.

Figure 1.9 Screenshot of PLABWIN10: Entering the file name in the File name textbox and then clicking Save.

Step 10

Notice the forkbomb.bat file is created on the desktop. Close the forkbomb - Notepad window.

Figure 1.10 Screenshot of PLABWIN10: Closing the Notepad window.

Step 11

You need to restore the Task Manager now. To do this, click Task Manager in the taskbar.

Figure 1.11 Screenshot of PLABWIN10: Restoring the Task Manager from the taskbar.

Step 12

Before you execute the batch file, observe the CPU usage in the Task Manager.

To do so, in the Task Manager window, under the Performance tab, in the left pane, observe the CPU activity.

The CPU utilization is 6%.

Note: The CPU performance will vary in your lab environment.

Figure 1.12 Screenshot of PLABWIN10: Showing the CPU utilization before executing the fork bomb batch file.

Step 13

Reduce the size of the Task Manager window so that the forkbomb.bat file is visible on the desktop.

To execute the forkbomb.bat file, on the desktop, right-click forkbomb, and select Open.

Step 14

The Command Prompt window opens, and the forkbomb.bat file starts executing recursively.

Figure 1.14 Screenshot of PLABWIN10: Showing the execution of the forkbomb file in the command prompt.

Step 15

You may or may not receive an error message during the execution time.

For the purpose of this demonstration, the batch file execution throws up an error message.

Click OK to close the cmd.exe - Application Error message box.

Figure 1.15 Screenshot of PLABWIN10: Showing the cmd.exe - Application Error dialog box.

Step 16

After the batch file execution, observe the CPU usage in the Task Manager.

To do so, in the Task Manager window, under the Performance tab, in the left pane, observe the CPU activity.

The CPU utilization went up to 100%, and even the memory consumption went up from 2 GB to 5.5 GB.

Note: The PLABWIN10 device would hang and could crash. You would have to reconnect to the device.

Figure 1.16 Screenshot of PLABWIN10: Showing the Windows Command Processor dialog box with the error along with the cmd.exe - Application Error.

Step 17

You will also notice several other error dialog boxes.

Figure 1.17 Screenshot of PLABWIN10: Showing the Windows Command Processor dialog box with the error along with the cmd.exe - Application Error.

Step 18

Close the error windows. The cmd.exe - Application Error and Windows Command Processor dialog boxes will continue to pop-up even if you close them.

Notice that memory utilization has jumped to 93%.

Figure 1.18 Screenshot of PLABWIN10: Showing the memory utilization along with the error dialog boxes.

Step 19

In the background, notice the Out of Memory error in the command prompt window. At this point, you are virtually unable to click anywhere in the PLABWIN10 system.

Note: You can reboot the PLABWIN10 device from the Practice Labs environment. However, ensure that you do not Reset it.