{"id":85702,"date":"2020-06-18T13:42:59","date_gmt":"2020-06-18T11:42:59","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/bhunter-vzlamyvaem-uzly-bot-setej"},"modified":"2020-06-18T13:42:59","modified_gmt":"2020-06-18T11:42:59","slug":"bhunter-vzlamyvaem-uzly-bot-setej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/bhunter-vzlamyvaem-uzly-bot-setej","title":{"rendered":"Bhunter \u2014 hacking botnet nodes","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Malware analysts and cybersecurity researchers strive to collect as many samples of new botnets as possible. They use honeypots for their purposes.\u2026 But what if you want to observe malware in real conditions? To put your server or router at risk? What if a suitable device isn't available? These questions led me to create bhunter \u2014 a tool for gaining access to botnet nodes.<\/p>\n

\"Bhunter
\n<\/a><\/noindex><\/p>\n

The main idea<\/h1>\n

\nThere are many ways to spread malicious software to expand bot networks, ranging from phishing to exploiting 0-day vulnerabilities. However, the most common method remains brute-forcing SSH passwords.<\/p>\n

The idea is very simple. If a node of the botnet is attempting to brute-force your server's password, it's likely that this node was itself compromised through simple password brute-forcing. Thus, to gain access to it, you need to respond in kind.<\/p>\n

This is exactly how bhunter works. It listens on port 22 (the SSH service) and collects all the login attempts and passwords that try to connect to it. Then, using the collected passwords, it attempts to connect to the attacking nodes.<\/p>\n

Operating Algorithm<\/h1>\n

\nThe program can be conventionally divided into two main parts that operate in separate threads. The first part is the honeypot. It processes login attempts, collects unique logins and passwords (in this case, a login-password pair is considered a whole), and adds to a queue the IP addresses that attempted to connect for further attack.<\/p>\n

The second part is directly responsible for the attack. The attack is performed in two modes: BurstAttack (queue-based attack) \u2014 brute-forcing logins and passwords from a common list, and SingleShotAttack (single shot attack) \u2014 brute-forcing passwords that were used by the attacked node but have not yet been added to the common list.<\/p>\n

To have some base of logins and passwords immediately after startup, bhunter is initialized with a list from the file \/etc\/bhunter\/defaultLoginPairs. <\/p>\n

The PerformanceResourceTiming<\/h1>\n

\nSeveral ways to run bhunter are provided:<\/p>\n

Simply with the command<\/h5>\n

<\/p>\n

sudo bhunter<\/code><\/pre>\n
\nWith this launch, you can manage bhunter through its text menu: add usernames and passwords for attacks, export the database of usernames and passwords, specify a target for the attack. All hacked nodes can be viewed in the file \/var\/log\/bhunter\/hacked.log.<\/p>\n
Using tmux<\/h5>\n
<\/p>\n
sudo bhunter-ts # command to start bhunter via tmux  \nsudo tmux attach -t bhunter # connect to the session where bhunter is running\n<\/code><\/pre>\n
\nTmux is a terminal multiplexer, a very convenient tool. It allows you to create multiple windows within a single terminal and split those windows into panes. By using it, you can exit the terminal and then re-enter without interrupting running processes. <\/p>\n
The bhunter-ts script creates a tmux session and splits the window into three panes. In the first, the largest pane, is the text menu. The top right pane contains the logs of the honeypot, where you can see messages about attempts to access the honeypot. The bottom right pane displays information about the progress of the attack on botnet nodes and successful hacks.<\/p>\n
The advantage of this method over the first one is that we can comfortably close the terminal and return to it later, while bhunter will continue its operation. For those who are not familiar with tmux, I suggest  this cheat sheet<\/a><\/noindex>.<\/p>\n
As a service<\/h5>\n
<\/p>\n
systemctl enable bhunter\nsystemctl start bhunter<\/code><\/pre>\n
\nIn this case, we are enabling the autostart of bhunter when the system starts. This method does not allow interaction with bhunter, and the list of hacked nodes can be obtained from \/var\/log\/bhunter\/hacked.log<\/p>\n
Effectiveness<\/h1>\n
\nDuring my work on bhunter, I have managed to find and gain access to completely different devices: raspberry pi, routers (especially mikrotik), web servers, and once even a mining farm (unfortunately, access to it was only for a day, so no interesting story came from it). Here's a screenshot of the program showing the list of hacked nodes after several days of operation:<\/p>\n
\"Bhunter
\n
\nUnfortunately, the effectiveness of this tool did not meet my expectations: bhunter can spend several days brute-forcing passwords on nodes without success, or it can compromise several targets within a couple of hours. But for a regular influx of new botnet samples, this is sufficient.<\/p>\n
Effectiveness is influenced by such parameters as: the country in which the server with bhunter is located, the hosting, and the range from which the IP address is allocated. In my experience, there was a case when I rented two virtual servers from the same host, and one of them was attacked by botnets twice as often.<\/p>\n
Bugs that I haven't fixed yet<\/h1>\n
\nWhen attacking infected nodes, in some situations it's not possible to definitively determine whether the password was correct or not. Logging of such cases is maintained in the file \/var\/log\/debug.log.<\/p>\n
The Paramiko module, used for working with SSH, sometimes misbehaves: it goes into an infinite wait for a response from the node when trying to connect. I experimented with timers but did not achieve the desired result.<\/p>\n
What else needs to be worked on?<\/h1>\n
<\/p>\n
Service name<\/h5>\n
\nAccording to RFC-4253, the client and server exchange service names implementing the SSH protocol before establishing a connection. This name is contained in the \"SERVICE NAME\" field, present in both the client request and server response. The field is a string, and its value can be obtained using Wireshark or Nmap. Here\u2019s an example for OpenSSH:<\/p>\n
$ nmap -p 22 ***.**.***.** -sV\nStarting Nmap ...\nPORT   STATE SERVICE VERSION\n22\/tcp open  ssh     <b>OpenSSH 7.9p1 Debian 10+deb10u2<\/b> (protocol 2.0)\nNmap done: 1 IP address (1 host up) scanned in 0.47 seconds\n<\/code><\/pre>\n
\nHowever, in the case of Paramiko, this field contains a string like \"Paramiko Python sshd 2.4.2\", which may deter botnets that are programmed to \"avoid\" traps. Therefore, I believe it is necessary to replace this string with something more neutral.<\/p>\n
Other vectors<\/h5>\n
\nSSH is not the only means of remote administration. There are also Telnet and RDP. It\u2019s worth taking a look at them as well.<\/p>\n
Extension<\/h5>\n
\nIt would be great to have several traps in different countries and centrally collect login credentials, passwords, and compromised nodes into a common database. <\/p>\n
Where to download?<\/h1>\n
\nAt the time of writing, only a test version is available for download from the repository on GitHub<\/a><\/noindex>.
\n
Source: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0412\u0438\u0440\u0443\u0441\u043d\u044b\u0435 \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u043a\u0438 \u0438 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0441\u0442\u0440\u0435\u043c\u044f\u0442\u0441\u044f \u0441\u043e\u0431\u0440\u0430\u0442\u044c \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u0431\u043e\u043b\u044c\u0448\u0435 \u043e\u0431\u0440\u0430\u0437\u0446\u043e\u0432 \u043d\u043e\u0432\u044b\u0445 \u0431\u043e\u0442\u043d\u0435\u0442\u043e\u0432. \u0412 \u0441\u0432\u043e\u0438\u0445 \u0446\u0435\u043b\u044f\u0445 \u043e\u043d\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 honeypot’\u044b.\u2026 \u041d\u043e \u0447\u0442\u043e \u0435\u0441\u043b\u0438 \u0445\u043e\u0447\u0435\u0442\u0441\u044f \u043f\u043e\u043d\u0430\u0431\u043b\u044e\u0434\u0430\u0442\u044c \u0437\u0430 \u0437\u043b\u043e\u0432\u0440\u0435\u0434\u043e\u043c \u0432 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445? \u041f\u043e\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u043f\u043e\u0434 \u0443\u0434\u0430\u0440 \u0441\u0432\u043e\u0439 \u0441\u0435\u0440\u0432\u0435\u0440, \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440? \u0410 \u0447\u0442\u043e \u0435\u0441\u043b\u0438 \u043f\u043e\u0434\u0445\u043e\u0434\u044f\u0449\u0435\u0433\u043e \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u043d\u0435\u0442? \u0418\u043c\u0435\u043d\u043d\u043e \u044d\u0442\u0438 \u0432\u043e\u043f\u0440\u043e\u0441\u044b \u043d\u0430\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438 \u043c\u0435\u043d\u044f \u043d\u0430 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 bhunter \u2014 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430 \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":85703,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-85702","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Bhunter \u2014 compromising botnet nodes | ProHoster","description":"Virus analysts and computer security researchers strive to collect as many samples of new botnets as possible.","canonical_url":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/bhunter-vzlamyvaem-uzly-bot-setej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Bhunter \u2014 \u0432\u0437\u043b\u0430\u043c\u044b\u0432\u0430\u0435\u043c \u0443\u0437\u043b\u044b \u0431\u043e\u0442-\u0441\u0435\u0442\u0435\u0439 | ProHoster","og:description":"\u0412\u0438\u0440\u0443\u0441\u043d\u044b\u0435 \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u043a\u0438 \u0438 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0441\u0442\u0440\u0435\u043c\u044f\u0442\u0441\u044f \u0441\u043e\u0431\u0440\u0430\u0442\u044c \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u0431\u043e\u043b\u044c\u0448\u0435 \u043e\u0431\u0440\u0430\u0437\u0446\u043e\u0432 \u043d\u043e\u0432\u044b\u0445 \u0431\u043e\u0442\u043d\u0435\u0442\u043e\u0432.","og:url":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/bhunter-vzlamyvaem-uzly-bot-setej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-06-18T11:42:59+00:00","article:modified_time":"2020-06-18T11:42:59+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"85702","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 14:32:46","updated":"2022-09-27 21:52:04","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/85702","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=85702"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/85702\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media\/85703"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=85702"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=85702"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=85702"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}