Scan 19

The first step is to retrieve the challenge package and check its md5sum.

Ok, this correctly matches the md5 hash listed on the website. Lets move on

1. Which vulnerability did the intruder exploit?

To find out which vulnerability was exploited, we can run newdat3.log through snort with standard rules:

We can then find this log entry:

After a quick web search we find a link for it: http://www.kb.cert.org/vuls/id/29823

2. What ways, and in what order, did the intruder use to connect and run commands on the system?

The first way the intruder executed commands on the server was through the shell created by the aformentioned vulnerability. In order to tell what commands he ran, we can use snort. First we create a temporary config file for snort (trule) that has the rule:

Then we use the snort command:

This will have created several directories in the /tmp directory. Inside the directory named with the attackers IP is a file that has the commands issued by the attacker during the ftp session. It can be found here.

The second way in which the intruder connected was telnet. During his previous ftp connection he changed the password of user nobody

And the attacker created a new user, dns

Now we can modify the snort rule file we made to look for telnet connections.

We find a directory named 217.156.93.166 and in it a file containing the commands used during the telnet session. Those commands can be found here.

The third way the intruder connected was via ssh to a trojan ssh deamon. Luckly we were logging keystrokes to syslog (and remotly logging that) so we were able to tell what the intruder was doing during the encrypted session. To read that we can use:

3. How did the intruder try to hide his edits from the MAC times?

The intruder tried to hide his changes to the passwd file by using the touch command to change the files Modification Access Creation times.

First the attacker makes a dummy passwd file and a dummy directory. The intruder then assigns the MAC time of /etc/passwd to the fummy file and the MAC times of /etc to the dummy directory. Next the intruder strips user nobody of a password and adds user dns. Finally they change the times of /etc and /etcpasswd to those of the dummy file/directory.

4. The intruder downloaded rootkits, what were they called? Are they new/custom rootkits?

The first rootkit downloaded was Zer0.tar.gz. Zer0 is a modified t0rn rootkit. This can easily be seen by comparing it to a t0rn config file.

The second kit downloaded was copy.tar.gz. This packages contains programs to generate lists of IP addresses, an ftp scanner, the wu-ftp site-exec exploit and other various things

The third kit downloaded was ooty.tar.gz. This kit contains a bunch of local exploits and even a nice motd message for the sysadmin.

5.Recover (tell how you did it too) the rootkits from the snort binary capture

To recover the rootkits I used a program called tcpflow, http://www.circlemud.org/~jelson/software/tcpflow/.

This returned 3 files with names that are made up of the IP involved. Next we can move them to the more appropriate names:

6.What does the rootkit do to hide the presence of the attacker on the system?

The rootkit, Zer0.tar.gz, contains the Adore Loadable Kernel Module (URL). A kernel module can be a very effective way of hiding things on a system. It does not require you to replace any files, instead it intercepts the system calls to those files. This intruder wanted to hide processes and directories using the adore commands:

The rootkit also used touch to change the MAC times of certain directoies, a snippet is shown:

7. This challenge took me about 6 hours to do.

Snort
TcpFlow
CERT