Mi hanno bucato il server, e adesso?

Transcript

1 Mi hanno bucato il server, e adesso? Matteo Sgalaberni ERLUG 1

2 Matteo Sgalaberni 2

3 C'era una volta... Ragazzo Server WebApp (PHP) 3

4 Obiettivo sicurezza reattiva 4

5 Agenda Usi e costumi Target Capire Reagire Correggere 5

6 Usi e costumi Processo Gestione sicurezza proattiva Ufficio Federale Aviazione Civile Svizzera Prevenzione Sistemisti Programmatori Processo 6

7 E STATO INSUFFICIENTE SIETE STATI SFONDATI! 7

8 Metodo Niente Panico Correzione Analisi 8

9 Se hai un problema, trova la causa e risolvilo altrimenti riaccadrà! quindi se non trovi da dove sono entrati e risolvi TI RIBUCHERANNO! 9

10 Perchè proprio te?! Rubare Modificare Farti un danno forse ma... 10

11 per soldi (li guadagnano loro!) 11

12 Un brutto mondo! Source: McAfee Threats Report: First Quarter

13 TI SFRUTTANO PER FARE Spam Phishing Advertisement Virus Malware Data leakage DOS DDOS 13

14 Target Web Application Account SMTP Account FTP Rete LAN 14

15 Ma mi hanno bucato?! Come me ne accorgo?! Rete Posta Sito Web Server non risponde Sito lento Timeout servizi Alert es. Nagios/Zimbra Abuse notification Blacklist IPS IDS Firewall CONOSCENZA! 15

16 BRUTTO?! 16

17 BRUTTO?! server:~# ps afx grep apache2 wc -l

18 BRUTTO?! server:~# /var/qmail/bin/qmail-qstat messages in queue: 5963 messages in queue but not yet preprocessed:

19 DIPENDE Conoscenza Normalità Confronto (Analisi del delta) 19

20 ma come si manifesta il vero MALE!? 20

21 Un bel giorno sul server di Daniele SMTP: CRITICAL - Socket timeout after 10 seconds POP3: CRITICAL - Socket timeout after 10 seconds HTTP: CRITICAL - Socket timeout after 10 seconds DAAA DAAAA DAAA DAAA DAAA! 21

22 Ma da dove sono entrati?! FTP SMTP Web App / PHP 22

23 FTP?!?!? SMTP?!? password 23

24 Web App Wordpress Joomla Plugins File upload validation Remote file execution Attacks on application platform Upload.jsp file into web tree - jsp code executed as web user Upload.gif to be resized - image library flaw exploited Upload huge files - file space denial of service Upload file using malicious path or name - overwrite critical file Upload file containing personal data - other users access it Upload file containing "tags" - tags get executed as part of being "included" in a web page <?php if (isset( $_GET['COLOR'] ) ){ include( $_GET['COLOR']. '.php' ); }?> PHP shell PHP backdoor HTML/JS infected

25 Semplice! Informazioni: ma dove sono?! File Creati Log Timestamp 25

26 TRUCCO find -ctime 0 stat files... less files grep Nuovi file File con nomi strani File con contenuti strani eval(base64_decode($_request['comment']))); JS offuscato/incomprensibile 26

27 php shit 27

28 28

29 ~/$ clamscan newsp15.php newsp15.php: PHP.Trojan.Spambot FOUND SCAN SUMMARY Known viruses: Engine version: Scanned directories: 0 Scanned files: 1 Infected files: 1 Data scanned: 0.00 MB Data read: 0.00 MB (ratio 1.00:1) Time: sec (0 m 4 s) 29

30 JS shit 30

31 FTP PHP shell PHP backdoor HTML with infected javascript perl in CGI-BIN 31

32 [07/Oct/2013:17:00: ] "POST /listn3a.php HTTP/1.1" "-" "-" stat /httpdocs_bucato/listn3a.php File: `listn3a.php' Size: 7325 Blocks: 16 IO Block: 4096 regular file Device: 808h/2056dInode: Links: 1 Access: (0644/-rw-r--r--) Uid: (10669/fsfsadfd) Gid: ( 2524/ psacln) Access: :18: Modify: :19: Change: :19:

33 zgrep listn3a.php xferlog* xferlog.processed:fri Oct 4 11:19: /var/www/vhosts/ sito1.it/httpdocs/listn3a.php b _ i r o sito1 ftp 0 * c sesedefdfs:/opt/psa/var/log# grep xferlog* xferlog.processed:tue Oct 1 12:39: /var/www/vhosts/ sito2.it/httpdocs/newsp15.php b _ i r sito1 ftp 0 * c xferlog.processed:thu Oct 3 12:00: /var/www/vhosts/ sito2.it/httpdocs/.htaccess b _ d r sito1 ftp 0 * c xferlog.processed:thu Oct 3 12:00: /var/www/vhosts/ sito2.it/httpdocs/rllsmf.html b _ i r sito1 ftp 0 * c xferlog.processed:thu Oct 3 12:00: /var/www/vhosts/ sito2.it/httpdocs/allsmf.html b _ i r sito1 ftp 0 * c xferlog.processed:fri Oct 4 11:19: /var/www/vhosts/ sito1.it/httpdocs/listn3a.php b _ i r sito2 ftp 0 * c xferlog.processed:sun Oct 6 12:19: /var/www/vhosts/ sito1.it/httpdocs/.htaccess b _ d r sito2 ftp 0 * c xferlog.processed:sun Oct 6 12:19: /var/www/vhosts/ sito1.it/httpdocs/rtlsk.html b _ i r sito2 ftp 0 * c xferlog.processed:sun Oct 6 12:19: /var/www/vhosts/ sito1.it/httpdocs/atlsk.html b _ i r sito2 ftp 0 * c xferlog.processed:sun Oct 6 12:34: /var/www/vhosts/ sito2.it/httpdocs/rllsmf.html b _ i r sito1 33

34 Ma cosa c era in quel file?!? <html> <head> <meta http-equiv="refresh" content="2; url= robotsfr6w/bar/index.html"> </head> <body> <h1>loading...</h1> </body> 34

35 35

36 server:~# /var/qmail/bin/qmail-qstat messages in queue: 5963 messages in queue but not yet preprocessed: 623 Received: (qmail 3931 invoked by uid 33); 22 Oct :55: Date: 22 Oct :55: Message-ID: To: Subject: Voice Message Notification From: "WhatsApp Messaging Service" X-PHP-Originating-Script: 10035:infoKSw.php X-Mailer: Oudmlr(ver.3.4) Reply-To: "WhatsApp Messaging Service" Mime-Version: 1.0 Content-Type: multipart/ alternative;boundary=" b " 36

37 server:~# /var/qmail/bin/qmail-qstat messages in queue: 5963 messages in queue but not yet preprocessed: 623 Received: (qmail invoked from network); 21 Oct :24: Received: from hostbruttorusso.ru (HELO UserHP) ( ) by mioserver.it with ESMTPA; 21 Oct :24: Return-Receipt-To: "Monica" From: "Monica" To: Subject: I: RQST FATTURA Date: Mon, 21 Oct :24: MIME-Version: 1.0 Content-Type: multipart/related; boundary="----=_nextpart_000_004b_01cece47" X-Mailer: Microsoft Office Outlook 11 Oct 25 12:37:08 server6 smtp_auth: SMTP user : logged in from hostbruttorusso.ru [ ] 37

38 Risposta ad un accesso SMTP Identifico le caselle compromesse Cambio le password Iptables ip logged in Cancello le dalla coda 38

39 Un bel giorno sul server di Daniele 5671? S 0:00 \_ /usr/sbin/apache2 -k start 5672? S 0:00 \_ /usr/sbin/apache2 -k start 5673? S 0:00 \_ /usr/sbin/apache2 -k start 5674? S 0:00 \_ /usr/sbin/apache2 -k start 20388? S 0:00 couriertls -localfd=4 -tcpd -server 6159? S 0:00 couriertls -localfd=4 -tcpd -server 6908? S 0:00 couriertls -localfd=4 -tcpd -server 16593? S 0:00 couriertls -localfd=4 -tcpd -server 17308? S 0:00 couriertls -localfd=4 -tcpd -server 9631? S 0:00 perl udpflood.pl 9632? S 0:00 perl udpflood.pl 9633? S 0:00 perl udpflood.pl 9634? S 0:00 perl udpflood.pl 9635? S 0:00 perl udpflood.pl 9636? S 0:00 perl udpflood.pl 4626? SN 0:00 /usr/sbin/zabbix_agentd 4671? SN 28:24 \_ /usr/sbin/zabbix_agentd 4672? SN 0:00 \_ /usr/sbin/zabbix_agentd 4673? SN 0:00 \_ /usr/sbin/zabbix_agentd 39

40 Un bel giorno sul server di Marco 5638? S 0:00 \_ /usr/sbin/apache2 -k start 5655? S 0:00 \_ /usr/sbin/apache2 -k start 5662? S 0:00 \_ /usr/sbin/apache2 -k start 5671? S 0:00 \_ /usr/sbin/apache2 -k start 5672? S 0:00 \_ /usr/sbin/apache2 -k start 5673? S 0:00 \_ /usr/sbin/apache2 -k start 5674? S 0:00 \_ /usr/sbin/apache2 -k start 4292? S 0:21 /usr/sbin/sw-cp-serverd -f /etc/sw-cp-server/config 4587? Ss 0:02 drwebd.real 4588? S 1:10 \_ drwebd.real 4589? S 1:14 \_ drwebd.real 4590? S 1:10 \_ drwebd.real 4591? S 1:07 \_ drwebd.real 9631? S 0:00 /usr/sbin/apache2 -k start 4626? SN 0:00 /usr/sbin/zabbix_agentd 4671? SN 28:24 \_ /usr/sbin/zabbix_agentd 4672? SN 0:00 \_ /usr/sbin/zabbix_agentd 4673? SN 0:00 \_ /usr/sbin/zabbix_agentd 40

41 Mani in alto! Data collecting Trigger - iptables log Trigger - swatch #!/bin/bash echo -n "starting collecting data..." date TMPFILE=`tempfile` netstat -tanp >>$TMPFILE lsof -n >>$TMPFILE ps afx >>$TMPFILE stat /tmp/* >>$TMPFILE bzip2 $TMPFILE echo -n "ending collecting data..." date echo "Trace salvato in :" $ {TMPFILE}.bz2 exit 0 perl www-data 509w REG 254, /tmp/sess_e96a e0061e5f88a9ca9bc3dab 41

42 MA ALMENO QUESTO FATELO /etc/php5/apache2/php.ini allow_url_fopen = Off disable_functions = "exec,system,passthru,readfile,shell_exec,escapeshellarg,es capeshellcmd,proc_close,proc_open,ini_alter,dl,parse_ini_fi le,show_source" 42

43 E se non lo becco?! tcpdump -s0 -w -C <maxsize> -W <maxcountfile> tcpslice wireshark ngrep (live gathering) 43

44 Strumenti top ps afx lsof -p [PID] netstat -tanp stat find -ctime 0 last netstat -tanp chkrootkit rkhunter clamav wireshark Intelligenza! Conoscenza! 44

45 ALLORA analisi pulizia correzione controllo 45

46 GRAZIE PER L'ATTENZIONE Le slides e le riprese audio/video dell'intervento saranno disponibili su: 46