Reconstruct attacker methods on a Linux system by analyzing a disk image, recovering deleted files with Photorec, and correlating logs, command history, and configuration files.
During routine security audits at a startup, the SOC team detected unusual activity on Linux servers in the company’s infrastructure, including unexpected configuration changes and unfamiliar files in critical system directories. These anomalies suggest possible unauthorized access and raise concerns about the integrity of the server environment. You received a disk image from one of the affected servers for forensic analysis. Your objective is to determine if a compromise has occurred, identify any tactics or tools used by a potential attacker, assess the scope and impact of the incident, and recommend mitigation strategies to safeguard against future breaches.
Medium - Endpoint Forensics | Completion Achievement
First, let's mount the provided disk_image.img onto the provided Linux machine:
Let's navigate to the mounted image and continue our investigation.
- Assigning high-level privileges to a new user is essential in the attack chain, as it enables the attacker to execute commands with administrative access, ensuring persistent control over the system. What command did the attacker use to grant elevated privileges to the newly created user?
Let's navigate to the /home directory and see if we can find a .bash_history file to read commands executed previously.
root@ip-172-31-23-76:/mnt/disk1/home# ls
noah ubuntuLet's try with /home/noah:
root@ip-172-31-23-76:/mnt/disk1/home/noah# ls -la
total 20
drwxr-x--- 2 1001 1001 4096 Oct 28 2024 .
drwxr-xr-x 4 root root 4096 Oct 28 2024 ..
-rw-r--r-- 1 1001 1001 220 Oct 28 2024 .bash_logout
-rw-r--r-- 1 1001 1001 3771 Oct 28 2024 .bashrc
-rw-r--r-- 1 1001 1001 807 Oct 28 2024 .profile/home/ubuntu:
Great! Let's read that file.
root@ip-172-31-23-76:/mnt/disk1/home/ubuntu# cat .bash_history
sudo adduser noah
sudo usermod -aG sudo noah
sudo rm -f ~/.bash_history
sudo rm -f /var/log/auth.log
exitThe attacker used the usermod command to add the noah user to the sudo group.
- Understanding the commands used by the attacker to cover their traces is essential for identifying attempts to hide malicious activity on the system. What is the second command the attacker used to erase evidence from the system?
This command appears in the previous .bash_history command as the second rm -f instruction.
- Identifying the configuration added or modified by the attacker for persistence is essential for detecting and removing recurring malicious activities on the system. What configuration line did the attacker add to one of the key Linux system files for scheduled tasks to ensure the miner would run continuously?
Since we are talking about continuous tasks, it would be a good idea to read cron related files. The crontab for the root user is located in /var/spool/cron/crontabs/root. Reading the file will return the answer:
- Identifying the hash of the malicious file is crucial for confirming its uniqueness and tracking its presence across systems. What is the MD5 hash of the file dropped by the attacker with mining capabilities?
The /tmp/backup.elf is still present in the system!
- Knowing the original name of a malicious file helps link it to known malware families and provides valuable insights into its behavior. According to threat intelligence reports, what is the original name of the miner?
We can find our answer by looking up the MD5 hash on VirusTotal and navigating to Details > Names to find the original name of the miner:
- Understanding the attacker's actions is crucial for tracing how malicious files were introduced to the system. The attacker successfully executed a command to download and save the miner on the compromised Linux system. What was the exact file path on the attacker's server where the malicious miner was hosted?
The file must have probably been transferred by the root user once the attacker escalated privileges. Let's read the .bash_history file inside /root to find anything interesting:
The last wget request contains the path where the backup.elf file was located.
- To understand which sensitive information was accessed and transferred from the compromised system, it’s essential to identify the files exfiltrated by the attacker. What is the full path on the attacker’s remote machine where the exfiltrated passwd file was saved?
The /root/.bash_history file also contains a command that shows that the /etc/passwd file was exfiltrated via scp.
- Understanding how the attacker maintained elevated privileges without repeated permission prompts is essential for uncovering their methods of persistent access. What command did the attacker use to configure continuous privilege escalation without requiring repeated permission?
The attacker appended some text to the /etc/sudoers to gain elevated privileges during each TTY shell, as seen in the first command in .bash_history.
- Identifying the source IP address used for lateral movement is essential for tracing the attacker's path and understanding the extent of the compromise. What is the IP address of the machine the attacker used to perform lateral movement to this Linux box?
Normally, we should use the auth.log file to find any successful logins from a foreign IP address to find another attacker IP address. However, this file was deleted by the ubuntu user during privilege escalation. We are going to use the photorec utility for this.
Since our disk image is mounted on /dev/loop11p2, let's use the arrow keys to navigate to that media.
Press ENTER to search that disk.
This filesystem is OK, let's also select it.
Select Whole to extract all files from the disk.
Navigate to the directory where you would like to dump all the files. I made a directory called photorec-out to output these files. Type C to confirm. This process will take a long take (~25 minutes in my case), so please be patient.
Once the process is over, we will need to find the contents of the auth.log amongst the recup_dir directories. Let's use the following grep command to find any matches for inux sshd:
# change the 1 for each of the ten digits until you find the correct file
grep -rnw recup_dir.1* -e "inuxserver sshd"In my case, these were the files that showed strings related to the auth.log file: recup_dir.4/f0420432.txt and recup_dir.70/f14157896.xz. We can use the strings and grep utilities to find the IP corresponding to the successful lateral movement:
- Identifying the first username targeted by the attacker in their brute-force attempts offers insight into their initial access strategy and target selection, as the attacker attempted to access two different accounts. What was the first username the attacker targeted in these brute-force attempts?
Let's check the other file to find out which username was the first to be targeted by the attacker:
- Determining the timestamp of the attacker’s final login is crucial for identifying when they last accessed the system to hide their activities and erase evidence. What is the timestamp of the last login session during which the attacker cleared traces on the compromised machine?
The last login session from the attacker can be seen in the Accepted password logs coming from the attacker IP. We can assume that the correct year is 2024 because of the timestamps shown in the mounted disk image:
- During the attacker’s SSH session, they used a command that mistakenly saved their activities to the hard drive rather than keeping them in memory where they’d be more difficult to analyze. Which bash command did they use that left this trace?
Throughout this challenge, we have used the .bash_history files left by the attacker to recreate attacker behavior. The exit command appears at the end of each bash session, which writes down the commands used in each session to .bash_history.