{"id":85702,"date":"2020-06-18T13:42:59","date_gmt":"2020-06-18T11:42:59","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/bhunter-vzlamyvaem-uzly-bot-setej"},"modified":"2020-06-18T13:42:59","modified_gmt":"2020-06-18T11:42:59","slug":"bhunter-vzlamyvaem-uzly-bot-setej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/lv\/blog\/administrirovanie\/bhunter-vzlamyvaem-uzly-bot-setej","title":{"rendered":"Bhunter \u2014 uzlau\u017eam botu t\u012bklu mezglus","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V\u012brusu anal\u012bti\u0137i un datora dro\u0161\u012bbas p\u0113tnieki cen\u0161as sav\u0101kt p\u0113c iesp\u0113jas vair\u0101k paraugu no jaunajiem botnetiem. Sav\u0101 m\u0113r\u0137\u012b vi\u0146i izmanto honeypot'us.\u2026 Bet ko dar\u012bt, ja v\u0113l\u0101s nov\u0113rot \u013caunpr\u0101t\u012bgu programmu re\u0101los apst\u0101k\u013cos? Ielikt risk\u0101 savu serveri, mar\u0161rut\u0113t\u0101ju? Un ko dar\u012bt, ja piem\u0113rota ier\u012bce nav pieejama? \u0160ie jaut\u0101jumi mudin\u0101ja mani izveidot bhunter - r\u012bku piek\u013cuvei botnetu mezgliem.<\/p>\n

\"Bhunter
\n<\/a><\/noindex><\/p>\n

Pamatideja<\/h1>\n

\nIr daudz veidu, k\u0101 izplat\u012bt \u013caunpr\u0101t\u012bgu programmat\u016bru, lai papla\u0161in\u0101tu botnetus: s\u0101kot no phishing un beidzot ar 0-day ievainojam\u012bbu izmanto\u0161anu. Ta\u010du popul\u0101r\u0101kais joproj\u0101m ir SSH paroli uzmin\u0113\u0161ana.<\/p>\n

Ideja ir \u013coti vienk\u0101r\u0161a. Ja no k\u0101da botnetu mezgla tiek veikta paroli uzmin\u0113\u0161ana j\u016bsu serverim, visticam\u0101k, ka \u0161is mezgls pats ir iek\u013cuvis t\u012bkl\u0101, izmantojot vienk\u0101r\u0161u paroli. T\u0101d\u0113\u013c, lai ieg\u016btu piek\u013cuvi, j\u0101atbild ar \"atvair\u012b\u0161anu\".<\/p>\n

Tie\u0161i t\u0101 bhunter darbojas. Tas klaus\u0101s 22. port\u0101 (SSH pakalpojums) un sav\u0101c visus lietot\u0101jv\u0101rdu un parolu komplektus, ar kuriem tiek m\u0113\u0123in\u0101ts piek\u013c\u016bt. P\u0113c tam, izmantojot sav\u0101kt\u0101s paroles, tas m\u0113\u0123ina piesl\u0113gties uzbr\u016bko\u0161ajiem mezgliem.<\/p>\n

Darba algoritms<\/h1>\n

\nProgrammu var nosac\u012bti sadal\u012bt div\u0101s galvenaj\u0101s da\u013c\u0101s, kas darbojas atsevi\u0161\u0137os pavedienos. Pirmais \u2014 honeypot. Tas apstr\u0101d\u0101 piesl\u0113g\u0161an\u0101s m\u0113\u0123in\u0101jumus, sav\u0101c unik\u0101los lietot\u0101jv\u0101rdus un paroles (\u0161aj\u0101 gad\u012bjum\u0101 parole un lietot\u0101jv\u0101rds tiek uzskat\u012bti par vienu veselumu), k\u0101 ar\u012b pievieno uzbr\u016bko\u0161o IP adreses uzbrukumiem n\u0101kotn\u0113.<\/p>\n

Otr\u0101 da\u013ca atbild tie\u0161i par uzbrukumu. Turkl\u0101t uzbrukums tiek veikts divos re\u017e\u012bmos: BurstAttack (uzbrukums sec\u012bgi) \u2014 lietot\u0101jv\u0101rdus un paroles uzmin\u0113\u0161ana no kop\u0113j\u0101 saraksta un SingleShotAttack (individu\u0101lu uzbrukumu) \u2014 uzmin\u0113\u0161ana ar parol\u0113m, kuras izmantoja uzbr\u016bko\u0161ais mezgls, bet v\u0113l nav pievienotas kop\u0113jam sarakstam.<\/p>\n

Lai ieg\u016btu vismaz k\u0101du lietot\u0101jv\u0101rdus un parolu b\u0101zi t\u016bl\u012bt p\u0113c palai\u0161anas, bhunter tiek inicializ\u0113ts ar sarakstu no faila \/etc\/bhunter\/defaultLoginPairs. <\/p>\n

Interfeiss<\/h1>\n

\nIr paredz\u0113ti vair\u0101ki veidi, k\u0101 palaist bhunter:<\/p>\n

Vienk\u0101r\u0161i ar komandu<\/h5>\n

<\/p>\n

sudo bhunter<\/code><\/pre>\n
\n\u0160\u0101dos palai\u0161anas apst\u0101k\u013cos ir iesp\u0113ja p\u0101rvald\u012bt bhunter caur t\u0101 teksta izv\u0113lni: pievienot lietot\u0101jv\u0101rdus un parolei uzbrukumam, eksport\u0113t lietot\u0101jv\u0101rdu un paroli datu b\u0101zi, nor\u0101d\u012bt m\u0113r\u0137i uzbrukumam. Visas uzlauzt\u0101s mezgli var tikt redz\u0113tas fail\u0101 \/var\/log\/bhunter\/hacked.log<\/p>\n
Izmantojot tmux<\/h5>\n
<\/p>\n
sudo bhunter-ts # komanda, lai palaistu bhunter caur tmux  \nsudo tmux attach -t bhunter # pievienojamies sesijai, kur\u0101 tiek palaists bhunter\n<\/code><\/pre>\n
\nTmux ir termin\u0101la multiplikators, \u013coti \u0113rts r\u012bks. Tas \u013cauj vien\u0101 termin\u0101l\u012b izveidot vair\u0101kas logus un sadal\u012bt logus pane\u013cos. To izmantojot, var iziet no termin\u0101la un p\u0113c tam atgriezties, nesniegdami uzs\u0101ktos procesus. <\/p>\n
Scripts bhunter-ts izveido tmux sesiju un sadala logu tr\u012bs pane\u013cos. Pirmaj\u0101 \u2014 visliel\u0101kaj\u0101, atrodas teksta izv\u0113lne. Aug\u0161\u0113j\u0101 labaj\u0101 panel\u012b ir honeypot'u \u017eurn\u0101li, kur var redz\u0113t zi\u0146ojumus par m\u0113\u0123in\u0101jumiem piek\u013c\u016bt honeypot. Apak\u0161\u0113j\u0101 labaj\u0101 panel\u012b tiek r\u0101d\u012bta inform\u0101cija par uzbrukuma gaitu uz botnet mezgliem un par veiksm\u012bgajiem uzbrukumiem.<\/p>\n
\u0160\u012b metode ir lab\u0101ka par pirmo, jo m\u0113s varam dro\u0161i aizv\u0113rt termin\u0101li un v\u0113l\u0101k atgriezties pie t\u0101, t\u0101d\u0113j\u0101di bhunter neaptur\u0113s darbu. \u0160iem, kas maz paz\u012bstami ar tmux, ieteiktu  \u0161os pierakstus<\/a><\/noindex>.<\/p>\n
K\u0101 pakalpojums<\/h5>\n
<\/p>\n
systemctl enable bhunter\nsystemctl start bhunter<\/code><\/pre>\n
\n\u0160aj\u0101 gad\u012bjum\u0101 m\u0113s iesl\u0113dzam bhunter autom\u0101tisko palai\u0161anu sist\u0113mas palai\u0161anas laik\u0101. \u0160aj\u0101 metod\u0113 mijiedarb\u012bba ar bhunter nav paredz\u0113ta, un p\u0101rrakst\u012bto mezglu sarakstu var ieg\u016bt no \/var\/log\/bhunter\/hacked.log<\/p>\n
Efektivit\u0101te<\/h1>\n
\nStr\u0101d\u0101jot ar bhunter, man izdev\u0101s atrast un piek\u013c\u016bt piln\u012bgi at\u0161\u0137ir\u012bg\u0101m ier\u012bc\u0113m: raspberry pi, mar\u0161rut\u0113t\u0101jiem (\u012bpa\u0161i mikrotik), web-serveriem, un k\u0101du reizi ar\u012b kalnr\u016bpniec\u012bbas fermai (diem\u017e\u0113l piek\u013cuve t\u0101 bija tikai dienas laik\u0101, t\u0101p\u0113c interesanta st\u0101sta nerad\u0101s). \u0160eit ir ekr\u0101n\u0161\u0101vi\u0146\u0161 no programmas, kur redzams p\u0101rrakst\u012bto mezglu saraksts p\u0113c da\u017e\u0101m darba dien\u0101m:<\/p>\n
\"Bhunter
\n
\nDiem\u017e\u0113l \u0161\u012b r\u012bka efektivit\u0101te nav sasniegusi manas cer\u012bbas: bhunter var j\u0101p\u0101rbauda paroles mezgliem vair\u0101kas dienas bez rezult\u0101tiem, bet var ar\u012b uzlauzt vair\u0101kas m\u0113r\u0137us tikai p\u0101ris stund\u0101s. Bet regul\u0101rai jaunu botnetu paraugu iepl\u016b\u0161anai tas ir pietiekami.<\/p>\n
Efektivit\u0101ti ietekm\u0113 t\u0101di parametri k\u0101: valsts, kur\u0101 atrodas serveris ar bhunter, hostings un IP adrese, no kuras tas ir pie\u0161\u0137irts. Man\u0101 pieredz\u0113 bija gad\u012bjums, kad es \u012br\u0113ju divus virtu\u0101los serverus no viena hostinga, un viens no tiem tika uzbrukts no botnet divas reizes bie\u017e\u0101k.<\/p>\n
K\u013c\u016bdas, kuras es pagaid\u0101m neesmu izlabojis<\/h1>\n
\nUzbrukuma gad\u012bjum\u0101 infic\u0113tajiem mezgliem da\u017e\u0101s situ\u0101cij\u0101s nav iesp\u0113jams nep\u0101rprotami noteikt, vai parole ir der\u012bga vai n\u0113. \u0160\u0101du gad\u012bjumu \u017eurn\u0101ls tiek veikts fail\u0101 \/var\/log\/debug.log.<\/p>\n
Paramiko modulis, kas tiek izmantots darbam ar SSH, da\u017ek\u0101rt uzvedas nepareizi: tas non\u0101k bezgal\u012bg\u0101 gaid\u012b\u0161anas st\u0101vokl\u012b, m\u0113\u0123inot izveidot savienojumu ar mezglu. Es eksperiment\u0113ju ar taimeriem, bet v\u0113lamo rezult\u0101tu neieguvu.<\/p>\n
Uz ko v\u0113l ir j\u0101str\u0101d\u0101?<\/h1>\n
<\/p>\n
Pakalpojuma nosaukums<\/h5>\n
\nSaska\u0146\u0101 ar RFC-4253 klients un serveris pirms savienojuma izveides apmain\u0101s ar pakalpojumu nosaukumiem, kas \u012bsteno SSH protokolu. \u0160is nosaukums ietilpst lauk\u0101 \"SERVICE NAME\", kas atrodams gan klienta piepras\u012bjum\u0101, gan servera atbild\u0113. Lauks ir virkne, un t\u0101 v\u0113rt\u012bbu var uzzin\u0101t, izmantojot wireshark vai nmap. L\u016bk, piem\u0113rs OpenSSH:<\/p>\n
$ nmap -p 22 ***.**.***.** -sV\nS\u0101k Nmap ...\nPORT   ST\u0100VOKLIS SERVISS VERSIJA\n22\/tcp atv\u0113rts  ssh     <b>OpenSSH 7.9p1 Debian 10+deb10u2<\/b> (protokols 2.0)\nNmap pabeigts: 1 IP adrese (1 viesis akt\u012bvs) skann\u0113ts 0.47 sekund\u0113s\n<\/code><\/pre>\n
\nTom\u0113r, run\u0101jot par Paramiko, \u0161is lauks satur virkni form\u0101t\u0101 \"Paramiko Python sshd 2.4.2\", kas var atbaid\u012bt botnetus, kuriem ir iek\u013cauts \"izvair\u012b\u0161an\u0101s\" no slazdiem. T\u0101p\u0113c uzskatu, ka ir nepiecie\u0161ams aizst\u0101t \u0161o virkn\u0113 ar kaut ko neitr\u0101l\u0101ku.<\/p>\n
Citi vektori<\/h5>\n
\nSSH nav vien\u012bgais att\u0101lin\u0101ta p\u0101rvald\u012bbas l\u012bdzeklis. Ir v\u0113l telnet, rdp. J\u0101piev\u0113r\u0161 uzman\u012bba ar\u012b tiem.<\/p>\n
Papla\u0161in\u0101jums<\/h5>\n
\nB\u016btu lieliski, ja b\u016btu vair\u0101ki slazdi da\u017e\u0101d\u0101s valst\u012bs un centraliz\u0113ti v\u0101kt no tiem pieteikumus, paroles un uzlauztus mezglus kop\u0113j\u0101 datu b\u0101z\u0113. <\/p>\n
Kur lejupiel\u0101d\u0113t?<\/h1>\n
\nRaksta rakst\u012b\u0161anas br\u012bd\u012b ir pieejama tikai test\u0113\u0161anas versija, kuru var lejupiel\u0101d\u0113t no repozitorija Github<\/a><\/noindex>.
\n
Avots: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0412\u0438\u0440\u0443\u0441\u043d\u044b\u0435 \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u043a\u0438 \u0438 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0441\u0442\u0440\u0435\u043c\u044f\u0442\u0441\u044f \u0441\u043e\u0431\u0440\u0430\u0442\u044c \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u0431\u043e\u043b\u044c\u0448\u0435 \u043e\u0431\u0440\u0430\u0437\u0446\u043e\u0432 \u043d\u043e\u0432\u044b\u0445 \u0431\u043e\u0442\u043d\u0435\u0442\u043e\u0432. \u0412 \u0441\u0432\u043e\u0438\u0445 \u0446\u0435\u043b\u044f\u0445 \u043e\u043d\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 honeypot’\u044b.\u2026 \u041d\u043e \u0447\u0442\u043e \u0435\u0441\u043b\u0438 \u0445\u043e\u0447\u0435\u0442\u0441\u044f \u043f\u043e\u043d\u0430\u0431\u043b\u044e\u0434\u0430\u0442\u044c \u0437\u0430 \u0437\u043b\u043e\u0432\u0440\u0435\u0434\u043e\u043c \u0432 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445? \u041f\u043e\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u043f\u043e\u0434 \u0443\u0434\u0430\u0440 \u0441\u0432\u043e\u0439 \u0441\u0435\u0440\u0432\u0435\u0440, \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440? \u0410 \u0447\u0442\u043e \u0435\u0441\u043b\u0438 \u043f\u043e\u0434\u0445\u043e\u0434\u044f\u0449\u0435\u0433\u043e \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u043d\u0435\u0442? \u0418\u043c\u0435\u043d\u043d\u043e \u044d\u0442\u0438 \u0432\u043e\u043f\u0440\u043e\u0441\u044b \u043d\u0430\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438 \u043c\u0435\u043d\u044f \u043d\u0430 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 bhunter \u2014 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430 \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":85703,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-85702","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Bhunter \u2014 botnet mezglu uzlau\u0161ana | ProHoster","description":"V\u012brusu anal\u012bti\u0137i un datoru dro\u0161\u012bbas p\u0113tnieki cen\u0161as sav\u0101kt p\u0113c iesp\u0113jas vair\u0101k jauno botnet paraugu.","canonical_url":"https:\/\/prohoster.info\/lv\/blog\/administrirovanie\/bhunter-vzlamyvaem-uzly-bot-setej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"lv_LV","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Bhunter \u2014 \u0432\u0437\u043b\u0430\u043c\u044b\u0432\u0430\u0435\u043c \u0443\u0437\u043b\u044b \u0431\u043e\u0442-\u0441\u0435\u0442\u0435\u0439 | ProHoster","og:description":"\u0412\u0438\u0440\u0443\u0441\u043d\u044b\u0435 \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u043a\u0438 \u0438 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0441\u0442\u0440\u0435\u043c\u044f\u0442\u0441\u044f \u0441\u043e\u0431\u0440\u0430\u0442\u044c \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u0431\u043e\u043b\u044c\u0448\u0435 \u043e\u0431\u0440\u0430\u0437\u0446\u043e\u0432 \u043d\u043e\u0432\u044b\u0445 \u0431\u043e\u0442\u043d\u0435\u0442\u043e\u0432.","og:url":"https:\/\/prohoster.info\/lv\/blog\/administrirovanie\/bhunter-vzlamyvaem-uzly-bot-setej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-06-18T11:42:59+00:00","article:modified_time":"2020-06-18T11:42:59+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"85702","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 14:32:46","updated":"2022-09-27 21:52:04","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/85702","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/comments?post=85702"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/85702\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/media\/85703"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/media?parent=85702"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/categories?post=85702"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/tags?post=85702"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}