Download practical packet analysis practical packet analysis

Fixing this issue is a painless process, requiring a bit of manipulation
with a hex editor. This process is called file carving. In Figure 10-25, I’ve used
WinHex to highlight the first several bytes of the JPG file. You will need to
delete these bytes and save the image file using any hex editor.
Figure 10-25: Removing the extraneous bytes from the JPG file
With the unneeded bytes of data removed, the file should open. It should
be clear now that the trojan is taking screen captures of the victim’s desktop
and transmitting them back to the attacker (Figure 10-26).
Figure 10-26: The JPG being transferred is a screen capture of the victim’s computer.
212
Chapter 10