EscapeRoom Blue Team Challenge
这是一道流量分析结合可执行程序木马的逆向题目,难度适中
Q1
What service did the attacker use to gain access to the system?
SSH
Q2
What attack type was used to gain access to the system?(one word)
bruteforce
流量中可以看到有多次ssh连接,所以推测是暴力破解。运行SSH的服务器通常是暴力攻击的软目标
Q3
What was the tool the attacker possibly used to perform this attack?
hydra
搜一搜常见的ssh攻击工具,然后尝试得到是海德拉
Q4
How many failed attempts were there?
52
一共有54个连接ssh的tcp的请求,其中有两个传输的数据较多,所以判断出有两个连接成功,所以有52个失败了
Q5
What credentials (username:password) were used to gain access? Refer to shadow.log and sudoers.log.
manager:forgot
直接解hash就可以了,然后看哪些有root权限
Q6
What other credentials (username:password) could have been used to gain access also have SUDO privileges? Refer to shadow.log and sudoers.log.
和第五题一样,剩下几个跑不出密码
sean:spectre
Q7
What is the tool used to download malicious files on the system?
wget
这个是攻击机,后面是上传马的过程
wget下载的
Q8
How many files the attacker download to perform malware installation?
3
用networkminer分析一下文件,发现上传了3个elf
最后一个伪装了html
Q9
What is the main malware MD5 hash?
772b620736b760c1d736b1e6ba2f885b
可以看出来执行命令的内容,判断出1是主要的马,添加了+x权限,用networkminer可以查看md5
Q10
What file has the script modified so the malware will start upon reboot?
/etc/rc.local
GPT分析法
第3行说明了自动启动的程序
Q11
Where did the malware keep local files?
/var/mail/
将文件1移动到了/var/mail/mail,所以文件在/var/mail/
Q12
What is missing from ps.log?
/var/mail/mail
前面可以知道mail会运行,但是在ps中没有他
Q13
What is the main file that used to remove this information from ps.log?
sysmod.ko
还是代码分析,可以看出来利用sysmod.ko,将mail程序隐藏了
Q14
Inside the Main function, what is the function that causes requests to those servers?
requestFile
开始逆向一下1.html,先查壳,发现有upx壳
利用**upx -d 1.html **脱壳
用ida查看,发现好多函数,看到requestfile有点像访问的函数,F5点进去看一下
发现是wget的脚本,所以可以确定是这个函数
一个简单的逆向
Q15
One of the IP’s the malware contacted starts with 17. Provide the full IP.
174.129.57.253
直接梭哈
Q16
How many files the malware requested from external servers?
9
一共13个文件,三个elf,剩下9个都是上传的图片马
Q17
What are the commands that the malware was receiving from attacker servers? Format: comma-separated in alphabetical order
Nop,Run
最后这个有回到了前面的逆向,要找到返回执行的命令
查看这个函数,看着像是要找的函数(message嘛
里面都是文件读取啥的
没有发现啥,看另一个函数
然后将上面判断的编码改为char
fwrite函数输出了a1