{"id":85702,"date":"2020-06-18T13:42:59","date_gmt":"2020-06-18T11:42:59","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/bhunter-vzlamyvaem-uzly-bot-setej"},"modified":"2020-06-18T13:42:59","modified_gmt":"2020-06-18T11:42:59","slug":"bhunter-vzlamyvaem-uzly-bot-setej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/bhunter-vzlamyvaem-uzly-bot-setej","title":{"rendered":"Bhunter \u2014 spargerea nodurilor re\u021belelor de bot","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Anali\u0219tii de viru\u0219i \u0219i cercet\u0103torii \u00een securitatea cibernetic\u0103 \u00eencearc\u0103 s\u0103 adune c\u00e2t mai multe mostre noi de botnete. \u00cen acest scop, ei folosesc honeypot-uri.\u2026 Dar ce se \u00eent\u00e2mpl\u0103 dac\u0103 vrei s\u0103 observi un malware \u00een condi\u021bii reale? S\u0103 \u00ee\u021bi pui serverul sau routerul \u00een pericol? Dar ce se face dac\u0103 nu ai un dispozitiv potrivit? Aceste \u00eentreb\u0103ri m-au inspirat s\u0103 creez bhunter \u2014 un instrument pentru a ob\u021bine acces la nodurile bot-re\u021belelor.<\/p>\n

\"Bhunter
\n<\/a><\/noindex><\/p>\n

Ideea principal\u0103<\/h1>\n

\nExist\u0103 multe moduri de a r\u0103sp\u00e2ndi software-ul mali\u021bios pentru a extinde re\u021belele de bot: de la phishing p\u00e2n\u0103 la exploatarea vulnerabilit\u0103\u021bilor de tip 0-day. Cu toate acestea, cea mai r\u0103sp\u00e2ndit\u0103 metod\u0103 r\u0103m\u00e2ne p\u00e2n\u0103 \u00een prezent for\u021barea parolelor SSH.<\/p>\n

Ideea este foarte simpl\u0103. Dac\u0103 un nod al re\u021belei de bot \u00eencearc\u0103 s\u0103 for\u021beze o parol\u0103 pentru serverul t\u0103u, exist\u0103 \u0219anse mari ca acel nod s\u0103 fi fost capturat prin for\u021barea parolelor simple. Asta \u00eenseamn\u0103 c\u0103, pentru a ob\u021bine acces, trebuie pur \u0219i simplu s\u0103-i r\u0103spunzi \u00ab\u00een aceea\u0219i manier\u0103\u00bb.<\/p>\n

A\u0219a func\u021bioneaz\u0103 bhunter. Ascult\u0103 pe portul 22 (serviciul SSH) \u0219i adun\u0103 toate loginurile \u0219i parolele cu care se \u00eencearc\u0103 conectarea. Apoi, folosind parolele adunate, \u00eencearc\u0103 s\u0103 se conecteze la nodurile atacatoare.<\/p>\n

Algoritmul de func\u021bionare<\/h1>\n

\nProgramul poate fi \u00eemp\u0103r\u021bit \u00een 2 p\u0103r\u021bi principale, care func\u021bioneaz\u0103 \u00een fluxuri separate. Prima \u2014 honeypot. Proceseaz\u0103 \u00eencerc\u0103rile de conectare, adun\u0103 loginuri \u0219i parole unice (\u00een acest caz, un login + parol\u0103 este v\u0103zut ca un \u00eentreg), \u0219i de asemenea adaug\u0103 la coada pentru o atac viitor IP-urile care au \u00eencercat conectarea.<\/p>\n

A doua parte se ocup\u0103 direct de atac. De fapt, atacul se desf\u0103\u0219oar\u0103 \u00een dou\u0103 moduri: BurstAttack (atac \u00een coad\u0103) \u2014 for\u021barea loginurilor \u0219i parolilor dintr-o list\u0103 comun\u0103 \u0219i SingleShotAttack (atac prin focuri unice) \u2014 for\u021barea parolelor care au fost folosite de nodul atacat, dar care nu au fost \u00eenc\u0103 ad\u0103ugate \u00een lista comun\u0103.<\/p>\n

Pentru a avea o baz\u0103 de loginuri \u0219i parole imediat dup\u0103 lansare, bhunter se ini\u021bializeaz\u0103 cu o list\u0103 din fi\u0219ierul \/etc\/bhunter\/defaultLoginPairs. <\/p>\n

Interfa\u021ba<\/h1>\n

\nSunt prev\u0103zute mai multe moduri de a lansa bhunter:<\/p>\n

Doar cu comanda<\/h5>\n

<\/p>\n

sudo bhunter<\/code><\/pre>\n
\n\u00centr-o astfel de lansare, exist\u0103 posibilitatea de a controla bhunter-ul prin intermediul meniului s\u0103u text: se pot ad\u0103uga nume de utilizator \u0219i parole pentru atac, se poate exporta baza de date de nume de utilizator \u0219i parole, se poate specifica \u021binta pentru atac. Toate nodurile compromise pot fi vizualizate \u00een fi\u0219ierul \/var\/log\/bhunter\/hacked.log<\/p>\n
Folosind tmux<\/h5>\n
<\/p>\n
sudo bhunter-ts # comanda de lansare a bhunter prin tmux  \nsudo tmux attach -t bhunter # ne conect\u0103m la sesiunea \u00een care este lansat bhunter\n<\/code><\/pre>\n
\nTmux este un multiplexor de terminal, un instrument foarte util. Permite crearea mai multor feronier \u00een interiorul unui singur terminal \u0219i \u00eemp\u0103r\u021birea feronierelor \u00een panouri. Folosindu-l, putem ie\u0219i din terminal \u0219i apoi reveni f\u0103r\u0103 a \u00eentrerupe procesele lansate. <\/p>\n
Scriptul bhunter-ts creeaz\u0103 o sesiune tmux \u0219i \u00eemparte fereastra \u00een trei panouri. \u00cen primul \u2014 cel mai mare, se afl\u0103 meniul text. Panoul din dreapta sus con\u021bine jurnalele honeypot-ului, aici pot fi v\u0103zute mesajele despre \u00eencerc\u0103rile de accesare a honeypot-ului. \u00cen panoul din dreapta jos este afi\u0219at\u0103 informa\u021bia despre progresul atacului asupra nodurilor bot-re\u021belelor \u0219i despre bre\u0219ele reu\u0219ite.<\/p>\n
Avantajul acestui mod fa\u021b\u0103 de primul este c\u0103 putem \u00eenchide lini\u0219tit terminalul \u0219i ne putem \u00eentoarce mai t\u00e2rziu, f\u0103r\u0103 ca bhunter s\u0103 \u00ee\u0219i opreasc\u0103 func\u021bionarea. Cei care nu sunt foarte familiariza\u021bi cu tmux \u00eei propun  aceast\u0103 fi\u0219\u0103<\/a><\/noindex>.<\/p>\n
As a service<\/h5>\n
<\/p>\n
systemctl enable bhunter\nsystemctl start bhunter<\/code><\/pre>\n
\n\u00cen acest caz, activ\u0103m pornirea automat\u0103 a bhunter la startul sistemului. \u00cen aceast\u0103 metod\u0103, interac\u021biunea cu bhunter nu este prev\u0103zut\u0103, iar lista nodurilor compromise poate fi ob\u021binut\u0103 din \/var\/log\/bhunter\/hacked.log<\/p>\n
Eficien\u021b\u0103<\/h1>\n
\nDe-a lungul timpului petrecut lucr\u00e2nd la bhunter, am reu\u0219it s\u0103 g\u0103sesc \u0219i s\u0103 accesez dispozitive complet diferite: raspberry pi, routere (\u00een special mikrotik), servere web, iar odat\u0103, o ferm\u0103 de minerit (din p\u0103cate, accesul la aceasta a fost pe parcursul zilei, a\u0219a c\u0103 nu a ie\u0219it o poveste interesant\u0103). Iat\u0103 o captur\u0103 de ecran a programului, pe care se poate vedea lista nodurilor compromise dup\u0103 c\u00e2teva zile de func\u021bionare:<\/p>\n
\"Bhunter
\n
\nDin p\u0103cate, eficien\u021ba acestui instrument nu a atins a\u0219tept\u0103rile mele: bhunter poate s\u0103 \u00eencerce parolele nodurilor timp de c\u00e2teva zile f\u0103r\u0103 rezultate, sau poate s\u0103 compromit\u0103 c\u00e2teva \u021binte \u00een c\u00e2teva ore. Dar pentru un flux regulat de noi mostre de botneturi, aceasta este suficient.<\/p>\n
Eficien\u021ba este influen\u021bat\u0103 de parametrii precum: \u021bara \u00een care se afl\u0103 serverul cu bhunter, hostingul \u0219i intervalul din care a fost alocat adresa IP. \u00cen experien\u021ba mea, a fost un caz c\u00e2nd am \u00eenchiriat dou\u0103 servere virtuale de la un singur host \u0219i unul dintre ele a fost atacat de botneturi de dou\u0103 ori mai des.<\/p>\n
Bugs pe care nu le-am reparat deocamdat\u0103<\/h1>\n
\nAtunci c\u00e2nd atac\u0103m nodurile compromise, \u00een unele situa\u021bii nu reu\u0219im s\u0103 determin\u0103m cu certitudine dac\u0103 parola s-a potrivit sau nu. Jurnalizarea acestor cazuri se face \u00een fi\u0219ierul \/var\/log\/debug.log.<\/p>\n
Modul Paramiko, care este folosit pentru a lucra cu SSH, se comport\u0103 uneori necorespunz\u0103tor: intr\u0103 \u00eentr-o a\u0219teptare infinit\u0103 pentru un r\u0103spuns de la nod atunci c\u00e2nd \u00eencerc\u0103 s\u0103 se conecteze. Am experimentat cu temporizatoare, dar nu am ob\u021binut rezultatele dorite.<\/p>\n
Ce altceva mai trebuie s\u0103 lucr\u0103m?<\/h1>\n
<\/p>\n
Numele serviciului<\/h5>\n
\nConform RFC-4253, clientul \u0219i serverul schimb\u0103 denumirile serviciilor care implementeaz\u0103 protocolul SSH \u00eenainte de a stabili conexiunea. Aceast\u0103 denumire este con\u021binut\u0103 \u00een c\u00e2mpul \u201eSERVICE NAME\u201d, prezent at\u00e2t \u00een cererea clientului, c\u00e2t \u0219i \u00een r\u0103spunsul serverului. C\u00e2mpul reprezint\u0103 un \u0219ir de caractere, iar valoarea sa poate fi aflat\u0103 utiliz\u00e2nd Wireshark sau nmap. Iat\u0103 un exemplu pentru OpenSSH:<\/p>\n
$ nmap -p 22 ***.**.***.** -sV\nÎncepem Nmap ...\nPORT   STATE SERVICE VERSION\n22\/tcp open  ssh     <b>OpenSSH 7.9p1 Debian 10+deb10u2<\/b> (protocol 2.0)\nNmap a terminat: 1 adres\u0103 IP (1 gazd\u0103 activ\u0103) scanat\u0103 în 0.47 secunde\n<\/code><\/pre>\n
\nCu toate acestea, \u00een cazul lui Paramiko, acest c\u00e2mp con\u021bine un \u0219ir de tipul \u201eParamiko Python sshd 2.4.2\u201d, ceea ce poate descuraja botneturile, \u00een care este inclus\u0103 \u201eevitarea\u201d capcanelor. Prin urmare, consider c\u0103 este necesar s\u0103 \u00eenlocuiesc acest \u0219ir cu ceva mai neutru.<\/p>\n
Alte vectori<\/h5>\n
\nSSH nu este singura metod\u0103 de gestionare de la distan\u021b\u0103. Exist\u0103 \u0219i telnet, rdp. Merit\u0103 s\u0103 ne uit\u0103m \u0219i la acestea.<\/p>\n
Extensie<\/h5>\n
\nAr fi grozav s\u0103 avem c\u00e2teva capcane \u00een diferite \u021b\u0103ri \u0219i s\u0103 colect\u0103m centralizat de la acestea log\u0103ri, parole \u0219i noduri compromise \u00eentr-o baz\u0103 de date comun\u0103. <\/p>\n
De unde se poate desc\u0103rca?<\/h1>\n
\nLa momentul redact\u0103rii acestui articol, este disponibil\u0103 doar o versiune de test, care poate fi desc\u0103rcat\u0103 din repozitoriu pe Github<\/a><\/noindex>.
\n
Sursa: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0412\u0438\u0440\u0443\u0441\u043d\u044b\u0435 \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u043a\u0438 \u0438 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0441\u0442\u0440\u0435\u043c\u044f\u0442\u0441\u044f \u0441\u043e\u0431\u0440\u0430\u0442\u044c \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u0431\u043e\u043b\u044c\u0448\u0435 \u043e\u0431\u0440\u0430\u0437\u0446\u043e\u0432 \u043d\u043e\u0432\u044b\u0445 \u0431\u043e\u0442\u043d\u0435\u0442\u043e\u0432. \u0412 \u0441\u0432\u043e\u0438\u0445 \u0446\u0435\u043b\u044f\u0445 \u043e\u043d\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 honeypot’\u044b.\u2026 \u041d\u043e \u0447\u0442\u043e \u0435\u0441\u043b\u0438 \u0445\u043e\u0447\u0435\u0442\u0441\u044f \u043f\u043e\u043d\u0430\u0431\u043b\u044e\u0434\u0430\u0442\u044c \u0437\u0430 \u0437\u043b\u043e\u0432\u0440\u0435\u0434\u043e\u043c \u0432 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445? \u041f\u043e\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u043f\u043e\u0434 \u0443\u0434\u0430\u0440 \u0441\u0432\u043e\u0439 \u0441\u0435\u0440\u0432\u0435\u0440, \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440? \u0410 \u0447\u0442\u043e \u0435\u0441\u043b\u0438 \u043f\u043e\u0434\u0445\u043e\u0434\u044f\u0449\u0435\u0433\u043e \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u043d\u0435\u0442? \u0418\u043c\u0435\u043d\u043d\u043e \u044d\u0442\u0438 \u0432\u043e\u043f\u0440\u043e\u0441\u044b \u043d\u0430\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438 \u043c\u0435\u043d\u044f \u043d\u0430 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 bhunter \u2014 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430 \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":85703,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-85702","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Bhunter \u2014 spargem noduri ale re\u021belelor bot | ProHoster","description":"Analizatorii de viru\u0219i \u0219i cercet\u0103torii \u00een securitate cibernetic\u0103 \u00ee\u0219i propun s\u0103 adune c\u00e2t mai multe mostre de noi botneturi.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/bhunter-vzlamyvaem-uzly-bot-setej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Bhunter \u2014 \u0432\u0437\u043b\u0430\u043c\u044b\u0432\u0430\u0435\u043c \u0443\u0437\u043b\u044b \u0431\u043e\u0442-\u0441\u0435\u0442\u0435\u0439 | ProHoster","og:description":"\u0412\u0438\u0440\u0443\u0441\u043d\u044b\u0435 \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u043a\u0438 \u0438 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0441\u0442\u0440\u0435\u043c\u044f\u0442\u0441\u044f \u0441\u043e\u0431\u0440\u0430\u0442\u044c \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u0431\u043e\u043b\u044c\u0448\u0435 \u043e\u0431\u0440\u0430\u0437\u0446\u043e\u0432 \u043d\u043e\u0432\u044b\u0445 \u0431\u043e\u0442\u043d\u0435\u0442\u043e\u0432.","og:url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/bhunter-vzlamyvaem-uzly-bot-setej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-06-18T11:42:59+00:00","article:modified_time":"2020-06-18T11:42:59+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"85702","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 14:32:46","updated":"2022-09-27 21:52:04","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/85702","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=85702"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/85702\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/85703"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=85702"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=85702"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=85702"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}