{"id":85702,"date":"2020-06-18T13:42:59","date_gmt":"2020-06-18T11:42:59","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/bhunter-vzlamyvaem-uzly-bot-setej"},"modified":"2020-06-18T13:42:59","modified_gmt":"2020-06-18T11:42:59","slug":"bhunter-vzlamyvaem-uzly-bot-setej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/administrirovanie\/bhunter-vzlamyvaem-uzly-bot-setej","title":{"rendered":"Bhunter \u2014 hakiramo \u010dvorove bot-mre\u017ea","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Virusni analiti\u010dari i istra\u017eitelji ra\u010dunarske sigurnosti nastoje skupiti \u0161to je mogu\u0107e vi\u0161e uzoraka novih botnetova. U svoje svrhe koriste honeypotove.\u2026 No, \u0161to ako se \u017eeli promatrati zlo\u0107udni softver u stvarnim uvjetima? Izlo\u017eiti svoj server, usmjeriva\u010d? A \u0161to ako nema odgovaraju\u0107e opreme? Ova pitanja su me potaknula na stvaranje bhuntera \u2014 alata za dobivanje pristupa \u010dvorovima bot mre\u017ea.<\/p>\n

\"Bhunter
\n<\/a><\/noindex><\/p>\n

Osnovna ideja<\/h1>\n

\nPostoji mnogo na\u010dina \u0161irenja zlonamjernog softvera za pro\u0161irenje bot mre\u017ea: po\u010dev\u0161i od phishinga do iskori\u0161tavanja 0-day ranjivosti. No naj\u010de\u0161\u0107a metoda ostaje poku\u0161avanje prolaska zaporki za SSH.<\/p>\n

Ideja je vrlo jednostavna. Ako se s nekog \u010dvora bot mre\u017ee poku\u0161ava pro\u0107i zaporke za va\u0161 poslu\u017eitelj, vjerojatno je da je taj \u010dvor sam bio kompromitiran poku\u0161ajem jednostavnih zaporki. Stoga, kako biste dobili pristup, samo mu je potrebno uzvratiti \"uzvra\u0107anjem\".<\/p>\n

Upravo tako funkcionira bhunter. Slu\u0161a port 22 (SSH usluga) i prikuplja sve logine i zaporke s kojima se poku\u0161avaju povezati. Zatim, koriste\u0107i prikupljene zaporke, poku\u0161ava se spojiti na napada\u010dke \u010dvorove.<\/p>\n

Algoritam rada<\/h1>\n

\nProgram se mo\u017ee uvjetno podijeliti na 2 glavne dijela, koja rade u odvojenim nitima. Prvi dio \u2014 honeypot. Obradjuje poku\u0161aje prijave, prikuplja jedinstvene logine i zaporke (u ovom slu\u010daju par login+zaporka tretira se kao cjelina), te dodaje u red za daljnji napad IP adrese koje su poku\u0161ale povezivanje.<\/p>\n

Drugi dio odgovara izravno za napad. Pri \u010demu se napad provodi u dva na\u010dina: BurstAttack (napad u redu) \u2014 poku\u0161aj prolaska logina i zaporki iz zajedni\u010dkog popisa i SingleShotAttack (napad s pojedina\u010dnim pucanjima) \u2014 poku\u0161aj prolaska zaporki koje je koristio napadnuti \u010dvor, ali jo\u0161 nisu dodane u zajedni\u010dki popis.<\/p>\n

Kako bi imao neku bazu logina i zaporki odmah nakon pokretanja, bhunter se inicijalizira popisom iz datoteke \/etc\/bhunter\/defaultLoginPairs. <\/p>\n

Interfejs<\/h1>\n

\nPredvi\u0111eno je nekoliko na\u010dina pokretanja bhunter-a:<\/p>\n

Jednostavnom naredbom<\/h5>\n

<\/p>\n

sudo bhunter<\/code><\/pre>\n
\nPrilikom takvog pokretanja postoji mogu\u0107nost upravljanja bhunterom putem njegovog tekstualnog izbornika: dodavanje prijava i lozinki za napad, izvo\u0111enje baze prijava i lozinki, odre\u0111ivanje cilja za napad. Sve hakirane \u010dvorove mo\u017eete vidjeti u datoteci \/var\/log\/bhunter\/hacked.log<\/p>\n
Kori\u0161tenjem tmux<\/h5>\n
<\/p>\n
sudo bhunter-ts # komanda za pokretanje bhunter-a preko tmux-a  \nsudo tmux attach -t bhunter # povezuju\u0107i se na sesiju u kojoj je pokrenut bhunter\n<\/code><\/pre>\n
\nTmux je terminalni multiplexer, vrlo zgodan alat. Omogu\u0107uje stvaranje vi\u0161e prozora unutar jednog terminala, a prozore mo\u017eete razdvojiti na pane. Njegova upotreba omogu\u0107uje izlazak iz terminala, a zatim se ponovno mo\u017eete prijaviti ne prekidaju\u0107i pokrenute procese. <\/p>\n
Skripta bhunter-ts stvara tmux sesiju i dijeli prozor na tri plo\u010de. U prvoj \u2014 najve\u0107oj, nalazi se tekstualni izbornik. Gornja desna sadr\u017ei logove honeypota, ovdje mo\u017eete vidjeti poruke o poku\u0161ajima prijave na honeypot. U donjoj desnoj plo\u010di prikazuje se informacija o toku napada na \u010dvorove bot mre\u017ea i o uspje\u0161nim hakerskim napadima.<\/p>\n
Prednost ovog na\u010dina u odnosu na prvi je u tome \u0161to mo\u017eemo zatvoriti terminal i vratiti mu se kasnije, a bhunter ne\u0107e prekinuti rad. Onima koji nisu upoznati s tmux-om preporu\u010dujem  ovaj vodi\u010d<\/a><\/noindex>.<\/p>\n
Kao usluga<\/h5>\n
<\/p>\n
systemctl enable bhunter\nsystemctl start bhunter<\/code><\/pre>\n
\nU ovom slu\u010daju uklju\u010dujemo automatsko pokretanje bhunter-a prilikom pokretanja sustava. U ovoj metodi interakcija s bhunter-om nije predvi\u0111ena, a popis hakiranih \u010dvorova mo\u017eete dobiti iz \/var\/log\/bhunter\/hacked.log<\/p>\n
U\u010dinkovitost<\/h1>\n
\nTijekom rada na bhunter-u uspio sam prona\u0107i i pristupiti potpuno razli\u010ditim ure\u0111ajima: raspberry pi, usmjeriva\u010di ( posebno mikrotik), web serveri, a jednom \u010dak i farmi za rudarenje (na\u017ealost, pristup tome je bio samo tijekom dana, pa se nije dogodila zanimljiva pri\u010da). Evo snimke programa koja pokazuje popis hakiranih \u010dvorova nakon nekoliko dana rada:<\/p>\n
\"Bhunter
\n
\nNa\u017ealost, u\u010dinkovitost ovog alata nije ispunila moja o\u010dekivanja: bhunter mo\u017ee provjeravati lozinke na \u010dvorovima nekoliko dana bez rezultata, a mo\u017ee provaliti nekoliko ciljeva za nekoliko sati. No, za redoviti priljev novih uzoraka bot mre\u017ea, to je dovoljno.<\/p>\n
Na u\u010dinkovitost utje\u010du parametri poput: zemlje u kojoj se nalazi server s bhunter-om, hosting i raspon iz kojeg je dodijeljen IP adresi. U mom iskustvu bio je slu\u010daj kada sam unajmio dva virtualna servera od jednog hostera, i jedan od njih je bio napadnut od strane bot mre\u017ea dva puta \u010de\u0161\u0107e.<\/p>\n
Bugs koje jo\u0161 nisam ispravio<\/h1>\n
\nPrilikom napada na zara\u017eene \u010dvorove u nekim situacijama nije mogu\u0107e jednozna\u010dno utvrditi je li lozinka ispravna ili nije. Evidencija takvih slu\u010dajeva vodi se u datoteci \/var\/log\/debug.log.<\/p>\n
Modul Paramiko, koji se koristi za rad s SSH, ponekad se pona\u0161a neispravno: ulazi u beskona\u010dno \u010dekanje odgovora od \u010dvora kada poku\u0161ava uspostaviti vezu. Eksperimentirao sam s tajmerima, ali nisam postigao \u017eeljeni rezultat.<\/p>\n
Na \u010demu jo\u0161 trebate raditi?<\/h1>\n
<\/p>\n
Ime usluge<\/h5>\n
\nPrema RFC-4253, klijent i server razmjenjuju nazive usluga koje implementiraju SSH protokol prije uspostavljanja veze. Ovaj naziv sadr\u017ean je u polju \"SERVICE NAME\", koje se nalazi kako u zahtjevu klijenta, tako i u odgovoru servera. Polje je string, a njegovu vrijednost mo\u017eete saznati koriste\u0107i Wireshark ili Nmap. Evo primjera za OpenSSH:<\/p>\n
$ nmap -p 22 ***.**.***.** -sV\nPokre\u0107e se Nmap ...\nPORT   STANJE USLUGA VERZIJA\n22\/tcp otvoren  ssh     <b>OpenSSH 7.9p1 Debian 10+deb10u2<\/b> (protokol 2.0)\nNmap gotov: 1 IP adresa (1 host aktivan) skenirana u 0.47 sekundi\n<\/code><\/pre>\n
\nMe\u0111utim, u slu\u010daju Paramiko, ovo polje sadr\u017ei string poput \"Paramiko Python sshd 2.4.2\", \u0161to mo\u017ee odbiti botnetove koji imaju implementiranu funkciju \"izbjegavanja\" zamki. Stoga smatram neophodnim zamijeniti ovu string s ne\u010dim neutralnijim.<\/p>\n
Drugi vektori<\/h5>\n
\nSSH nije jedini na\u010din za daljinsko upravljanje. Tu su jo\u0161 telnet i RDP. Vrijedi ih tako\u0111er razmotriti.<\/p>\n
Pro\u0161irenje<\/h5>\n
\nBilo bi sjajno imati nekoliko zamki u razli\u010ditim zemljama i centralizirano prikupljati s njih prijave, lozinke i hakirane \u010dvorove u zajedni\u010dku bazu podataka. <\/p>\n
Gdje preuzeti?<\/h1>\n
\nU trenutku pisanja ovog \u010dlanka dostupna je samo testna verzija koju mo\u017eete preuzeti iz repozitorija na GitHubu<\/a><\/noindex>.
\n
Izvor: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0412\u0438\u0440\u0443\u0441\u043d\u044b\u0435 \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u043a\u0438 \u0438 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0441\u0442\u0440\u0435\u043c\u044f\u0442\u0441\u044f \u0441\u043e\u0431\u0440\u0430\u0442\u044c \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u0431\u043e\u043b\u044c\u0448\u0435 \u043e\u0431\u0440\u0430\u0437\u0446\u043e\u0432 \u043d\u043e\u0432\u044b\u0445 \u0431\u043e\u0442\u043d\u0435\u0442\u043e\u0432. \u0412 \u0441\u0432\u043e\u0438\u0445 \u0446\u0435\u043b\u044f\u0445 \u043e\u043d\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 honeypot’\u044b.\u2026 \u041d\u043e \u0447\u0442\u043e \u0435\u0441\u043b\u0438 \u0445\u043e\u0447\u0435\u0442\u0441\u044f \u043f\u043e\u043d\u0430\u0431\u043b\u044e\u0434\u0430\u0442\u044c \u0437\u0430 \u0437\u043b\u043e\u0432\u0440\u0435\u0434\u043e\u043c \u0432 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445? \u041f\u043e\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u043f\u043e\u0434 \u0443\u0434\u0430\u0440 \u0441\u0432\u043e\u0439 \u0441\u0435\u0440\u0432\u0435\u0440, \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440? \u0410 \u0447\u0442\u043e \u0435\u0441\u043b\u0438 \u043f\u043e\u0434\u0445\u043e\u0434\u044f\u0449\u0435\u0433\u043e \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u043d\u0435\u0442? \u0418\u043c\u0435\u043d\u043d\u043e \u044d\u0442\u0438 \u0432\u043e\u043f\u0440\u043e\u0441\u044b \u043d\u0430\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438 \u043c\u0435\u043d\u044f \u043d\u0430 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 bhunter \u2014 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430 \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":85703,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-85702","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Bhunter \u2014 hakujemo \u010dvorove bot-mre\u017ea | ProHoster","description":"Virusni analiti\u010dari i istra\u017eiva\u010di ra\u010dunalne sigurnosti nastoje prikupiti \u0161to vi\u0161e uzoraka novih botnetova.","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/administrirovanie\/bhunter-vzlamyvaem-uzly-bot-setej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Bhunter \u2014 \u0432\u0437\u043b\u0430\u043c\u044b\u0432\u0430\u0435\u043c \u0443\u0437\u043b\u044b \u0431\u043e\u0442-\u0441\u0435\u0442\u0435\u0439 | ProHoster","og:description":"\u0412\u0438\u0440\u0443\u0441\u043d\u044b\u0435 \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u043a\u0438 \u0438 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0441\u0442\u0440\u0435\u043c\u044f\u0442\u0441\u044f \u0441\u043e\u0431\u0440\u0430\u0442\u044c \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u0431\u043e\u043b\u044c\u0448\u0435 \u043e\u0431\u0440\u0430\u0437\u0446\u043e\u0432 \u043d\u043e\u0432\u044b\u0445 \u0431\u043e\u0442\u043d\u0435\u0442\u043e\u0432.","og:url":"https:\/\/prohoster.info\/hr\/blog\/administrirovanie\/bhunter-vzlamyvaem-uzly-bot-setej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-06-18T11:42:59+00:00","article:modified_time":"2020-06-18T11:42:59+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"85702","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 14:32:46","updated":"2022-09-27 21:52:04","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/85702","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=85702"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/85702\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media\/85703"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=85702"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=85702"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=85702"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}