{"id":85702,"date":"2020-06-18T13:42:59","date_gmt":"2020-06-18T11:42:59","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/bhunter-vzlamyvaem-uzly-bot-setej"},"modified":"2020-06-18T13:42:59","modified_gmt":"2020-06-18T11:42:59","slug":"bhunter-vzlamyvaem-uzly-bot-setej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/bhunter-vzlamyvaem-uzly-bot-setej","title":{"rendered":"Bhunter \u2014 lagundame botiv\u00f5rkude s\u00f5lmi","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Viirusanal\u00fc\u00fctikud ja arvutiturbe uurijad p\u00fc\u00fcavad koguda v\u00f5imalikult palju uusi botnetide n\u00e4idiseid. Oma eesm\u00e4rkide saavutamiseks kasutavad nad honeypot'e.\u2026 Aga mis siis, kui soovid j\u00e4lgida pahavara reaalses keskkonnas? Kasutada oma serverit v\u00f5i ruuterit? Ja ent kui sobivat seadet pole? Just need k\u00fcsimused ajendasid mind looma bhunter'i \u2014 t\u00f6\u00f6riista, et saada juurdep\u00e4\u00e4s bot-v\u00f5rkude s\u00f5lmedele.<\/p>\n

\"Bhunter
\n<\/a><\/noindex><\/p>\n

P\u00f5him\u00f5te<\/h1>\n

\nOn mitmeid viise pahavara levimiseks botiv\u00f5rkude laiendamiseks: alates phishing'ust kuni 0-day haavatavuste \u00e4ra kasutamiseni. Kuid endiselt on k\u00f5ige levinum meetod paroolide j\u00e4rjestamine SSH-le.<\/p>\n

Idee on v\u00e4ga lihtne. Kui m\u00f5nest botiv\u00f5rgust tehdakse teie serverile paroolide j\u00e4rjekord, siis on t\u00f5en\u00e4oliselt see s\u00f5lm ise olnud v\u00e4ljakutse kaudu h\u00f5ivatud lihtsate paroolidega. Seega, et sellele juurde p\u00e4\u00e4seda, tuleb lihtsalt vastata talle \"vastastikku\".<\/p>\n

Just nii toimib bhunter. Ta kuuleb 22. porti (SSH teenus) ja kogub k\u00f5ik logiinid ja paroolid, millega \u00fcritatakse tema poole \u00fchendust luua. Seej\u00e4rel proovib ta kogutud paroole kasutada r\u00fcndavate s\u00f5lmede \u00fchendamiseks.<\/p>\n

T\u00f6\u00f6 algoritm<\/h1>\n

\nProgrammi v\u00f5ib tinglikult jagada kaheks p\u00f5hiosaks, mis t\u00f6\u00f6tavad eraldi voogudes. Esimene - honeypot. T\u00f6\u00f6tleb sisselogimise katseid, kogub unikaalseid logi ja paroolide kombinatsioone (antud juhul loetakse logi ja parooli paar \u00fchiseks), samuti lisab j\u00e4rjekorda IP-aadresse, mis \u00fcritasid \u00fchendust luua, et neid hiljem r\u00fcnnata.<\/p>\n

Teine osa vastutab otse r\u00fcnnaku eest. R\u00fcnnak toimub kahel re\u017eiimil: BurstAttack (j\u00e4rjekorra r\u00fcnnak) \u2014 logiinide ja paroolide proovimine \u00fchest loendist ning SingleShotAttack (\u00fche lasku r\u00fcnnak) \u2014 paroolide proovimine, mida on kasutanud r\u00fcnnatav s\u00f5lm, kuid mis pole veel \u00fcldisesse loendisse lisatud.<\/p>\n

Kuna p\u00e4rast k\u00e4ivitamist on oluline omada mingit logiinide ja paroolide baasi, initsialiseeritakse bhunter failist \/etc\/bhunter\/defaultLoginPairs. <\/p>\n

Liides<\/h1>\n

\nBhunteri k\u00e4ivitamiseks on ette n\u00e4htud mitmeid viise:<\/p>\n

Lihtsalt k\u00e4suga<\/h5>\n

<\/p>\n

sudo bhunter<\/code><\/pre>\n
\nSelle k\u00e4ivitamisega on v\u00f5imalik hallata bhunter'it tema tekstimen\u00fc\u00fc kaudu: lisada r\u00fcnnaku jaoks sisselogimiseid ja paroole, eksportida sisselogimiste ja paroolide baasi, m\u00e4\u00e4rata sihtm\u00e4rgiks r\u00fcnnakuks. K\u00f5iki h\u00e4kitud s\u00f5lmi saab n\u00e4ha failis \/var\/log\/bhunter\/hacked.log<\/p>\n
Kasuta tmux<\/h5>\n
<\/p>\n
sudo bhunter-ts # k\u00e4sk bhunter k\u00e4ivitamiseks l\u00e4bi tmux  \nsudo tmux attach -t bhunter # liitume sessiooniga, kus bhunter jookseb\n<\/code><\/pre>\n
\nTmux on terminali multiplexer, v\u00e4ga mugav t\u00f6\u00f6riist. See v\u00f5imaldab \u00fches terminalis luua mitu akent ja jagada aknad paneelideks. Selle kasutamisel saab terminalist lahkuda ja hiljem tagasi tulla katkemata jooksvaid protsesse. <\/p>\n
Skript bhunter-ts loob tmux-seansi ja jagab akna kolme paneeli. Esimeses \u2014 k\u00f5ige suuremas, asub tekstimen\u00fc\u00fc. \u00dclemises paremas pooles on honeypot'i logid, kus saab n\u00e4ha teateid sisselogimiskatsete kohta honeypot'ile. Alumises paremas paneelis kuvatakse teavet r\u00fcnnaku k\u00e4igu ja bot-v\u00f5rkude s\u00f5lmede eduka h\u00e4kkimise kohta.<\/p>\n
Selle meetodi eelis esimesega v\u00f5rreldes on see, et saame terminali julgelt sulgeda ja hiljem tagasi tulla, samal ajal kui bhunter ei peata oma t\u00f6\u00f6d. Neile, kes ei tunne tmux'it h\u00e4sti, soovitan  seda spikrit<\/a><\/noindex>.<\/p>\n
Teenuse vorm<\/h5>\n
<\/p>\n
systemctl enable bhunter\nsystemctl start bhunter<\/code><\/pre>\n
\nAntud juhul aktiveerime bhunteri automaatse k\u00e4ivitamise s\u00fcsteemi k\u00e4ivitamisel. Selles meetodis ei ole etten\u00e4htud interaktsiooni bhunteriga, kuid h\u00e4kitud s\u00f5lmede nimekirja saab saada failist \/var\/log\/bhunter\/hacked.log<\/p>\n
T\u00f5husus<\/h1>\n
\nBhunteriga t\u00f6\u00f6tamise ajal \u00f5nnestus mul leida ja juurde p\u00e4\u00e4seda t\u00e4iesti erinevatele seadmetele: raspberry pi, ruuteritele (eriti mikrotik), veebi-serveritele, ja \u00fchel p\u00e4eval ka kaevandamisfarmile (kahjuks oli p\u00e4\u00e4s sellele p\u00e4eva jooksul, seega huvitavat lugu ei tulnud). Siin on ekraanipilt programmist, kus on n\u00e4ha h\u00e4kitud s\u00f5lmede loetelu p\u00e4rast mitmeid t\u00f6\u00f6p\u00e4evi:<\/p>\n
\"Bhunter
\n
\nKahjuks ei saavutanud antud t\u00f6\u00f6riista efektiivsus minu ootusi: bhunter suudab proovida paroole s\u00f5lmedele mitu p\u00e4eva tulemusteta, v\u00f5i v\u00f5ib h\u00e4kkida mitu sihtm\u00e4rki paari tunni jooksul. Kuid regulaarseks uute botiv\u00f5rkude proovide saamiseks on see piisav.<\/p>\n
T\u00f5hususele m\u00f5jutavad sellised parameetrid nagu: riik, kus server bhunter asub, hostimine ja IP-aadressi vahemik. Minu kogemuse j\u00e4rgi oli juhtum, kus rentisin kaks virtuaalserverit \u00fchelt hostijalt, ja \u00fcks neist oli botiv\u00f5rkude r\u00fcnnakute sihtm\u00e4rk kahel korral sagedamini.<\/p>\n
Vead, mida ma veel ei ole parandanud<\/h1>\n
\nR\u00fcnnaku ajal nakatunud s\u00f5lmedele ei pruugi teatud olukordades olla selge, kas parool sobib v\u00f5i mitte. Selliste juhtumite logimine toimub failis \/var\/log\/debug.log.<\/p>\n
Paramiko moodul, mida kasutatakse SSH-ga t\u00f6\u00f6tamiseks, k\u00e4itub m\u00f5nikord valesti: see j\u00e4\u00e4b ootama n\u00e4dalatega vastust s\u00f5lmelt, kui p\u00fc\u00fcab sellele \u00fchendust luua. Olen katsetanud taimeritega, kuid mingit soovitud tulemust ei saanud.<\/p>\n
Millega veel tuleb t\u00f6\u00f6d teha?<\/h1>\n
<\/p>\n
Teenuse nimi<\/h5>\n
\nVastavalt RFC-4253 vahetavad klient ja server enne \u00fchenduse loomist teenuste nimesid, mis implementeerivad SSH protokolli. See nimi sisaldub v\u00e4ljases \"SERVICE NAME\", mis on nii kliendi p\u00e4ringus kui ka serveri vastuses. See v\u00e4li on string ja selle v\u00e4\u00e4rtust saab teada, kasutades wiresharki v\u00f5i nmapi. Siin on n\u00e4ide OpenSSH jaoks:<\/p>\n
$ nmap -p 22 ***.**.***.** -sV\nNmap käivitamine ...\nPORT   OLEK TEENUS VERSIOON\n22\/tcp avatud  ssh     <b>OpenSSH 7.9p1 Debian 10+deb10u2<\/b> (protokoll 2.0)\nNmap lõpetatud: 1 IP-aadress (1 host on üleval) skaneeritud 0.47 sekundiga\n<\/code><\/pre>\n
\nKuid Paramiku puhul sisaldab see v\u00e4li stringi, mis n\u00e4eb v\u00e4lja nagu \"Paramiko Python sshd 2.4.2\", mis v\u00f5ib hirmutada botiv\u00f5rke, kus on loodud \"p\u00fc\u00fcniste v\u00e4ltimise\" mehhanism. Seet\u00f5ttu arvan, et on vajalik muuta see string midagi neutraalsemat.<\/p>\n
Teised vektored<\/h5>\n
\nSSH ei ole ainus kaugjuhtimise vahend. Veel on telnet, rdp. Tuleks t\u00e4helepanu p\u00f6\u00f6rata ka neile.<\/p>\n
Laien<\/h5>\n
\nOleks suurep\u00e4rane omada mitu l\u00f5ksu erinevates riikides ja tsentraliseeritult koguda neist logi, paroolid ja rikutud s\u00f5lmed \u00fchte andmebaasi. <\/p>\n
Kus alla laadida?<\/h1>\n
\nArtikli kirjutamise hetkel on valmis ainult testversioon, mille saab alla laadida Githubi hoidlast<\/a><\/noindex>.
\n
Allikas: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0412\u0438\u0440\u0443\u0441\u043d\u044b\u0435 \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u043a\u0438 \u0438 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0441\u0442\u0440\u0435\u043c\u044f\u0442\u0441\u044f \u0441\u043e\u0431\u0440\u0430\u0442\u044c \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u0431\u043e\u043b\u044c\u0448\u0435 \u043e\u0431\u0440\u0430\u0437\u0446\u043e\u0432 \u043d\u043e\u0432\u044b\u0445 \u0431\u043e\u0442\u043d\u0435\u0442\u043e\u0432. \u0412 \u0441\u0432\u043e\u0438\u0445 \u0446\u0435\u043b\u044f\u0445 \u043e\u043d\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 honeypot’\u044b.\u2026 \u041d\u043e \u0447\u0442\u043e \u0435\u0441\u043b\u0438 \u0445\u043e\u0447\u0435\u0442\u0441\u044f \u043f\u043e\u043d\u0430\u0431\u043b\u044e\u0434\u0430\u0442\u044c \u0437\u0430 \u0437\u043b\u043e\u0432\u0440\u0435\u0434\u043e\u043c \u0432 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445? \u041f\u043e\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u043f\u043e\u0434 \u0443\u0434\u0430\u0440 \u0441\u0432\u043e\u0439 \u0441\u0435\u0440\u0432\u0435\u0440, \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440? \u0410 \u0447\u0442\u043e \u0435\u0441\u043b\u0438 \u043f\u043e\u0434\u0445\u043e\u0434\u044f\u0449\u0435\u0433\u043e \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u043d\u0435\u0442? \u0418\u043c\u0435\u043d\u043d\u043e \u044d\u0442\u0438 \u0432\u043e\u043f\u0440\u043e\u0441\u044b \u043d\u0430\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438 \u043c\u0435\u043d\u044f \u043d\u0430 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 bhunter \u2014 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430 \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":85703,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-85702","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Bhunter \u2014 h\u00e4kkime botiv\u00f5rgud | ProHoster","description":"Viirusanal\u00fc\u00fctikud ja arvutiturbe uurijad p\u00fc\u00fcavad koguda v\u00f5imalikult palju uusi botiv\u00f5rkude n\u00e4idiseid.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/bhunter-vzlamyvaem-uzly-bot-setej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Bhunter \u2014 \u0432\u0437\u043b\u0430\u043c\u044b\u0432\u0430\u0435\u043c \u0443\u0437\u043b\u044b \u0431\u043e\u0442-\u0441\u0435\u0442\u0435\u0439 | ProHoster","og:description":"\u0412\u0438\u0440\u0443\u0441\u043d\u044b\u0435 \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u043a\u0438 \u0438 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0441\u0442\u0440\u0435\u043c\u044f\u0442\u0441\u044f \u0441\u043e\u0431\u0440\u0430\u0442\u044c \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u0431\u043e\u043b\u044c\u0448\u0435 \u043e\u0431\u0440\u0430\u0437\u0446\u043e\u0432 \u043d\u043e\u0432\u044b\u0445 \u0431\u043e\u0442\u043d\u0435\u0442\u043e\u0432.","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/bhunter-vzlamyvaem-uzly-bot-setej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-06-18T11:42:59+00:00","article:modified_time":"2020-06-18T11:42:59+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"85702","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 14:32:46","updated":"2022-09-27 21:52:04","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/85702","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=85702"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/85702\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/85703"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=85702"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=85702"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=85702"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}