{"id":85702,"date":"2020-06-18T13:42:59","date_gmt":"2020-06-18T11:42:59","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/bhunter-vzlamyvaem-uzly-bot-setej"},"modified":"2020-06-18T13:42:59","modified_gmt":"2020-06-18T11:42:59","slug":"bhunter-vzlamyvaem-uzly-bot-setej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/bhunter-vzlamyvaem-uzly-bot-setej","title":{"rendered":"Bhunter - zlomljive vozli\u0161\u010da bot mre\u017e","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Viral analysts and cybersecurity researchers strive to gather as many samples of new botnets as possible. They use honeypots for their purposes. But what if you want to observe malicious activity in real conditions? Should you risk your server or router? What if there's no suitable device available? These questions led me to create bhunter \u2014 a tool for gaining access to bot network nodes.<\/p>\n

\"Bhunter
\n<\/a><\/noindex><\/p>\n

Glavna ideja<\/h1>\n

\nThere are many ways to spread malware to expand botnets: from phishing to exploiting 0-day vulnerabilities. However, the most common method remains brute-forcing SSH passwords.<\/p>\n

The idea is very simple. If a node from a botnet is brute-forcing passwords to your server, it\u2019s likely that this node itself was compromised by brute-forcing simple passwords. Thus, to gain access to it, you just need to respond with 'like for like.'<\/p>\n

This is exactly how bhunter works. It listens on port 22 (SSH service) and collects all the logins and passwords it attempts to connect with. Then, using the gathered passwords, it tries to connect to the attacking nodes.<\/p>\n

Operating Algorithm<\/h1>\n

\nThe program can be conditionally divided into two main parts, which operate in separate threads. The first is the honeypot. It processes login attempts, collects unique logins and passwords (in this case, a login+password pair is considered as a whole), and adds to a queue for further attacks the IP addresses that attempted to connect.<\/p>\n

The second part is responsible for the attack itself. The attack is carried out in two modes: BurstAttack (queue-based attack) \u2014 brute-forcing logins and passwords from a general list and SingleShotAttack (single shot attacks) \u2014 brute-forcing passwords that have been used by the attacked node but have not yet been added to the general list.<\/p>\n

To have at least some database of logins and passwords right after launch, bhunter is initialized with a list from the file \/etc\/bhunter\/defaultLoginPairs. <\/p>\n

Vmesnik<\/h1>\n

\nSeveral ways to launch bhunter are provided:<\/p>\n

Simply using the command<\/h5>\n

<\/p>\n

sudo bhunter<\/code><\/pre>\n
\nWith this launch, you can manage bhunter through its text menu: add usernames and passwords for attacks, export the database of usernames and passwords, and specify a target for the attack. All hacked nodes can be viewed in the file \/var\/log\/bhunter\/hacked.log.<\/p>\n
Uporabite tmux<\/h5>\n
<\/p>\n
sudo bhunter-ts # ukaz za zagon bhunter preko tmux  \nsudo tmux attach -t bhunter # povezovanje s sejo, kjer je zagnan bhunter\n<\/code><\/pre>\n
\nTmux je terminalni multiplexer, zelo priro\u010dno orodje. Omogo\u010da ustvarjanje ve\u010d oken znotraj enega terminala, okna pa je mogo\u010de razdeliti na panele. Njegova uporaba omogo\u010da izhod iz terminala in kasnej\u0161i vstop brez prekinitev pote\u010denih procesov. <\/p>\n
The bhunter-ts script creates a tmux session and splits the window into three panes. In the first \u2014 the largest, there's the text menu. The upper right contains the honeypot logs, where you can see messages about login attempts on the honeypot. The lower right pane displays information about the progress of the attack on bot network nodes and successful hacks.<\/p>\n
Prednost te metode pred prvo je v tem, da lahko mirno zaprete terminal in se mu pozneje vrnete, pri \u010demer bhunter ne bo ustavil delovanja. Tistim, ki niso dobro seznanjeni s tmux, priporo\u010dam  tole pomo\u010dnico<\/a><\/noindex>.<\/p>\n
Kot storitev<\/h5>\n
<\/p>\n
systemctl enable bhunter\nsystemctl start bhunter<\/code><\/pre>\n
\nV tem primeru omogo\u010damo samodejni zagon bhunter ob zagonu sistema. Ta metoda ne predvideva interakcije z bhunter, seznam vkradenih vozli\u0161\u010d pa je mogo\u010de pridobiti iz \/var\/log\/bhunter\/hacked.log<\/p>\n
U\u010dinkovitost<\/h1>\n
\nMed delom na bhunterju sem uspel najti in dostopati do povsem razli\u010dnih naprav: raspberry pi, usmerjevalnikov (zlasti mikrotik), spletnih stre\u017enikov, enkrat pa tudi do rudarskega sistema (\u017eal je bil dostop do njega le \u010dez dan, zato ni bilo zanimive zgodbe). Tukaj je posnetek programa, na katerem je prikazan seznam vkradenih vozli\u0161\u010d po nekaj dneh dela:<\/p>\n
\"Bhunter
\n
\n\u017dal u\u010dinkovitost tega orodja ni dosegla mojih pri\u010dakovanj: bhunter lahko dni preizku\u0161a gesla na vozli\u0161\u010dih brez rezultatov ali pa lahko vdrne ve\u010d ciljev v dveh urah. A za redno pridobivanje novih vzorcev botnetov je to dovolj.<\/p>\n
Na u\u010dinkovitost vplivajo taki parametri kot so: dr\u017eava, v kateri je stre\u017enik s bhunterjem, gostovanje in obseg, iz katerega je dodeljena IP-naslov. Z mojimi izku\u0161njami je bil primer, ko sem najel dva virtualna stre\u017enika pri enem gostitelju, in eden od njiju je bil tar\u010da napadov bot mre\u017e dvakrat pogosteje.<\/p>\n
Bagi, ki jih \u0161e nisem popravil<\/h1>\n
\nPri napadu na oku\u017eena vozli\u0161\u010da v nekaterih situacijah ni mogo\u010de nedvoumno dolo\u010diti, ali geslo ustreza ali ne. Evidenca takih primerov se vodi v datoteki \/var\/log\/debug.log.<\/p>\n
Modul Paramiko, ki se uporablja za delo z SSH, v\u010dasih nepravilno deluje: pri povezovanju z vozli\u0161\u010dem vstopi v neskon\u010dno \u010dakanje na odgovor. Eksperimentiral sem s \u010dasovniki, a \u017eelenega rezultata nisem dosegel.<\/p>\n
Na \u010dem \u0161e moramo delati?<\/h1>\n
<\/p>\n
Ime storitve<\/h5>\n
\nPo RFC-4253 se stranka in stre\u017enik pred vzpostavitvijo povezave izmenjata imena storitev, ki uresni\u010dujejo protokol SSH. To ime je vsebovano v polju \u00bbSERVICE NAME\u00ab, ki je prisotno tako v zahtevku stranke kot v odgovoru stre\u017enika. Polje je niz in njegovo vrednost lahko pridobite s pomo\u010djo wireshark ali nmap. Tukaj je primer za OpenSSH:<\/p>\n
$ nmap -p 22 ***.**.***.** -sV\nZagon Nmap ...\nPORT   STANJE  STORITEV        VERZIJA\n22\/tcp odprto  ssh     <b>OpenSSH 7.9p1 Debian 10+deb10u2<\/b> (protokol 2.0)\nNmap kon\u010dano: 1 IP naslov (1 gost aktiven) skeniran v 0.47 sekundah\n<\/code><\/pre>\n
\nVendar pa v primeru Paramiko to polje vsebuje niz v obliki \u00abParamiko Python sshd 2.4.2\u00bb, kar lahko odvrne botnete, ki imajo vgrajeno taktiko \u00bbizogibanja\u00ab pastem. Zato menim, da je potrebno to besedilo zamenjati z ne\u010dim bolj nevtralnim.<\/p>\n
Drugi vektorji<\/h5>\n
\nSSH ni edino orodje za oddaljeno upravljanje. Obstajata \u0161e telnet in rdp. Vsekakor se spla\u010da tudi njiju natan\u010dneje preu\u010diti.<\/p>\n
Ekstenzija<\/h5>\n
\nSuper bi bilo imeti ve\u010d pasti v razli\u010dnih dr\u017eavah in centralizirano zbirati uporabni\u0161ke ra\u010dune, gesla in oku\u017eena vozli\u0161\u010da v skupno bazo podatkov. <\/p>\n
Kje prenesti?<\/h1>\n
\nOb \u010dasu pisanja \u010dlanka je na voljo le preizkusna razli\u010dica, ki jo lahko prenesete iz repozitorija na GitHubu<\/a><\/noindex>.
\n
Izvor: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0412\u0438\u0440\u0443\u0441\u043d\u044b\u0435 \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u043a\u0438 \u0438 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0441\u0442\u0440\u0435\u043c\u044f\u0442\u0441\u044f \u0441\u043e\u0431\u0440\u0430\u0442\u044c \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u0431\u043e\u043b\u044c\u0448\u0435 \u043e\u0431\u0440\u0430\u0437\u0446\u043e\u0432 \u043d\u043e\u0432\u044b\u0445 \u0431\u043e\u0442\u043d\u0435\u0442\u043e\u0432. \u0412 \u0441\u0432\u043e\u0438\u0445 \u0446\u0435\u043b\u044f\u0445 \u043e\u043d\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 honeypot’\u044b.\u2026 \u041d\u043e \u0447\u0442\u043e \u0435\u0441\u043b\u0438 \u0445\u043e\u0447\u0435\u0442\u0441\u044f \u043f\u043e\u043d\u0430\u0431\u043b\u044e\u0434\u0430\u0442\u044c \u0437\u0430 \u0437\u043b\u043e\u0432\u0440\u0435\u0434\u043e\u043c \u0432 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445? \u041f\u043e\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u043f\u043e\u0434 \u0443\u0434\u0430\u0440 \u0441\u0432\u043e\u0439 \u0441\u0435\u0440\u0432\u0435\u0440, \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440? \u0410 \u0447\u0442\u043e \u0435\u0441\u043b\u0438 \u043f\u043e\u0434\u0445\u043e\u0434\u044f\u0449\u0435\u0433\u043e \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u043d\u0435\u0442? \u0418\u043c\u0435\u043d\u043d\u043e \u044d\u0442\u0438 \u0432\u043e\u043f\u0440\u043e\u0441\u044b \u043d\u0430\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438 \u043c\u0435\u043d\u044f \u043d\u0430 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 bhunter \u2014 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430 \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":85703,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-85702","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Bhunter \u2014 vdirajte v vozli\u0161\u010da botnetov | ProHoster","description":"Analitiki za viruse in raziskovalci kibernetske varnosti si prizadevajo zbrati kar najve\u010d vzorcev novih botnetov.","canonical_url":"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/bhunter-vzlamyvaem-uzly-bot-setej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sl_SI","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Bhunter \u2014 \u0432\u0437\u043b\u0430\u043c\u044b\u0432\u0430\u0435\u043c \u0443\u0437\u043b\u044b \u0431\u043e\u0442-\u0441\u0435\u0442\u0435\u0439 | ProHoster","og:description":"\u0412\u0438\u0440\u0443\u0441\u043d\u044b\u0435 \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u043a\u0438 \u0438 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0441\u0442\u0440\u0435\u043c\u044f\u0442\u0441\u044f \u0441\u043e\u0431\u0440\u0430\u0442\u044c \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u0431\u043e\u043b\u044c\u0448\u0435 \u043e\u0431\u0440\u0430\u0437\u0446\u043e\u0432 \u043d\u043e\u0432\u044b\u0445 \u0431\u043e\u0442\u043d\u0435\u0442\u043e\u0432.","og:url":"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/bhunter-vzlamyvaem-uzly-bot-setej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-06-18T11:42:59+00:00","article:modified_time":"2020-06-18T11:42:59+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"85702","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 14:32:46","updated":"2022-09-27 21:52:04","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/85702","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/comments?post=85702"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/85702\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/media\/85703"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/media?parent=85702"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/categories?post=85702"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/tags?post=85702"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}