ืืืืจืืก ืึทื ืึทืืืก ืืื ืงืึธืืคึผืืืืขืจ ืืืืขืจืืืื ืจืืกืขืจืืฉืขืจื ืืขื ืขื ืจืืืกืื ื ืฆื ืืึทืืืขื ืืื ืคืืืข ืกืึทืืคึผืึทืื ืคืื ื ืืึท ืืึธืื ืขืฅ ืืื ืืขืืืขื. ืืื ื ืืฆื ืืึทื ืืคึผืึธืฅ ืคึฟืึทืจ ืืืืขืจ ืืืืื ืฆืืืขืงื ... ืึธืืขืจ ืืืึธืก ืืืื ืืืจ ืืืืื ืฆื ืึธืืกืขืจืืืืจื ืื ืืึทืืืืึทืจืข ืืื ืคืึทืงืืืฉ ืื ืึธืื? ืฉืืขืื ืืืื ืกืขืจืืืขืจ ืึธืืขืจ ืจืึทืืืขืจ ืืื ืจืืืืงืืจื? ืืืึธืก ืืืื ืขืก ืืื ืงืืื ืคึผืึทืกืืง ืืืื? ืขืก ืืื ืืขืืืขื ืื ืคึฟืจืืื ืืืึธืก ืคึผืจืึทืืคึผืืื ืืืจ ืฆื ืฉืึทืคึฟื bhunter, ืึท ืืขืฆืืึทื ืคึฟืึทืจ ืืืื ืื ื ืึทืงืกืขืก ืฆื ืืึธืื ืขื ื ืึธืืื.
ืื ืืืืคึผื ืืขืืึทื ืง
ืขืก ืืขื ืขื ืคืืืข ืืืขืื ืฆื ืคืึทืจืฉืคึผืจืืืื ืืึทืืืืึทืจืข ืฆื ืืงืกืคึผืึทื ื ืืึธืื ืขืฅ: ืคึฟืื ืคืืฉืื ื ืฆื ืขืงืกืคึผืืืืืื ื 0-ืืึธื ืืืึทืื ืขืจืึทืืืืืืื. ืึธืืขืจ ืื ืืขืจืกื ืคึผืจืึธืกื ืืืคึฟื ืืื ื ืึธื ืืจืื-ืคืึธืจืกืื ื SSH ืคึผืึทืกืืืขืจืื.
ืืขืจ ืืขืืึทื ืง ืืื ืืืืขืจ ืคึผืฉืื. ืืืื ืขืืืขืืข ืืึธืื ืขื ื ืึธืืข ืืื ืืจืืื ื ืฆื ืืจืื-ืงืจืึทืคื ืคึผืึทืกืืืขืจืื ืคึฟืึทืจ ืืืื ืกืขืจืืืขืจ, ืจืืึฟ ืืกืชึผืื ืืขื ื ืึธืืข ืืื ืืื ืงืึทืคึผืืฉืขืจื ืืืจื ืืจืื-ืคืึธืจืกืื ื ืคึผืฉืื ืคึผืึทืกืืืขืจืื. ืืขื ืืืื ืึทื ืืื ืกืืจ ืฆื ืืึทืงืืืขื ืึทืงืกืขืก ืฆื ืขืก, ืืืจ ื ืึธืจ ืืึทืจืคึฟื ืฆื ืงืขืื ืึทื ืึทื ืืืง.
ืืึธืก ืืื ืคึผืื ืงื ืืื bhunter ืึทืจืืขื. ืืืกืึทื ื ืฆื ืคึผืึธืจื 22 (SSH ืืื ืกื) ืืื ืงืึทืืขืงืฅ ืึทืืข ืืึธืืื ืก ืืื ืคึผืึทืกืืืขืจืื ืืื ืืืึธืก ืืื ืคึผืจืืืืจื ืฆื ืคืึทืจืืื ืื ืฆื ืขืก. ืืขืจื ืึธื, ื ืืฆื ืื ืืขืืืืื ืคึผืึทืกืืืขืจืื, ืขืก ืคืจืืืื ืฆื ืคืึทืจืืื ืื ืฆื ืึทืืึทืงืื ื ื ืึธืืื.
ืึทืจืืขื ืึทืืืขืจืืืึทื
ืืขืจ ืคึผืจืึธืืจืึทื ืงืขื ืขื ืืืื ืฆืขืืืืื ืืื 2 ืืืืคึผื ืคึผืึทืจืฅ, ืืืึธืก ืึทืจืืขื ืืื ืืึทืืื ืืขืจ ืคึฟืขืืขื. ืืขืจ ืขืจืฉืืขืจ ืืื ืืึทื ืืคึผืึทื. ืคึผืจืึทืกืขืกืึทื ืืึธืืื ืคืจืืืื, ืงืึทืืขืงืฅ ืืื ืฆืืง ืืึธืืื ืก ืืื ืคึผืึทืกืืืขืจืื (ืืื ืืขื ืคืึทื, ืื ืืึธืืื + ืคึผืึทืจืึธื ืคึผืึธืจ ืืื ืืขืจืขืื ื ืืื ืึท ืืืื ืืึทื ืฅ), ืืื ืืืื ืืืกืืฃ IP ืึทืืจืขืกืขืก ืืืึธืก ืืขืคืจืืืื ืฆื ืคืึทืจืืื ืื ืฆื ืื ืจืื ืคึฟืึทืจ ืืืืึทืืขืจ ืืึทืคืึทืื.
ืืขืจ ืฆืืืืืืขืจ ืืืื ืืื ืืืืึทื ืคืึทืจืึทื ืืืืึธืจืืืขื ืคึฟืึทืจ ืื ืืึทืคืึทืื. ืืขืจืฆื, ืื ืืึทืคืึทืื ืืื ืืืจืืืขืงืึธืื ืืื ืฆืืืื ืืึธืืขืก: BurstAttack (ืคึผืืึทืฆื ืืึทืคืึทืื) - ืืจืื ืงืจืึทืคื ืืึธืืื ืก ืืื ืคึผืึทืกืืืขืจืื ืคืื ืื ืึทืืืขืืืื ืข ืจืฉืืื ืืื SingleShotAttack (ืืืื ืฉืึธืก ืืึทืคืึทืื) - ืืจืื ืงืจืึทืคื ืคึผืึทืกืืืขืจืื ืืืึธืก ืืขื ืขื ืืขื ืืฆื ืืืจื ืื ืึทืืึทืงืืจื ื ืึธืืข, ืึธืืขืจ ืืึธืื ื ืืฉื ื ืึธื ืืขืืืขื ืฆืืืขืืขืื ืฆื ืื ืึทืืืขืืืื ืข ืจืฉืืื.
ืืื ืกืืจ ืฆื ืืึธืื ืืืึท ืืื ืืกืืขืจ ืขืืืขืืข ืืึทืืึทืืืืก ืคืื ืืึธืืื ืก ืืื ืคึผืึทืกืืืขืจืื ืืื ื ืึธื ืงืึทืืขืจ, bhunter ืืื ืื ืืฉืึทืืืืื ืืื ืึท ืจืฉืืื ืคืื ืืขืจ ืืขืงืข /etc/bhunter/defaultLoginPairs.
ืฆืืืื ื
ืขืก ืืขื ืขื ืขืืืขืืข ืืืขืื ืฆื ืงืึทืืขืจ bhunter:
ื ืึธืจ ืืื ืึท ืงืึธืืขืงืืืื
sudo bhunterืืื ืืขื ืงืึทืืขืจ, ืขืก ืืื ืืขืืืขื ืฆื ืงืึธื ืืจืึธืืืจื ืืืื ืืขืจ ืืืจื ืืืื ืืขืงืกื ืืขื ืื: ืืืืื ืืึธืืื ืก ืืื ืคึผืึทืกืืืขืจืื ืคึฟืึทืจ ืึท ืืึทืคืึทืื, ืึทืจืืืกืคืืจื ืึท ืืึทืืึทืืืืก ืคืื ืืึธืืื ืก ืืื ืคึผืึทืกืืืขืจืื, ืกืคึผืขืฆืืคืืฆืืจื ืึท ืฆืื ืคึฟืึทืจ ืึท ืืึทืคืึทืื. ืื ืืึทืงื ื ืึธืืื ืงืขื ืขื ืืืื ืืขืืขื ืืื ืืขืจ ืืขืงืข /var/log/bhunter/hacked.log
ื ืืฆื tmux
sudo bhunter-ts # ะบะพะผะฐะฝะดะฐ ะทะฐะฟััะบะฐ bhunter ัะตัะตะท tmux
sudo tmux attach -t bhunter # ะฟะพะดะบะปััะฐะตะผัั ะบ ัะตััะธะธ, ะฒ ะบะพัะพัะพะน ะทะฐะฟััะตะฝ bhunter
ืืืืงืก ืืื ืึท ืืืึธืงืืึทื ืืืืืืคึผืืขืงืกืขืจ, ืึท ืืืืขืจ ืืึทืงืืืขื ืืขืฆืืึทื. ืึทืืึทืื ืืืจ ืฆื ืฉืึทืคึฟื ืขืืืขืืข ืคึฟืขื ืฆืืขืจ ืืื ืืืื ืืืึธืงืืึทื ืืื ืฉืคึผืึทืืื ืื ืคึฟืขื ืฆืืขืจ ืืื ืคึผืึทื ืึทืื. ื ืืฆื ืขืก, ืืืจ ืงืขื ืขื ืึทืจืืืกืืึทื ื ืืขื ืืืึธืงืืึทื ืืื ืืขืืึธืื ืงืืึธืฅ ืืื ืึธื ืื ืืขืจืึทืคึผืืื ื ืคืืืกื ืืืง ืคึผืจืึทืกืขืกืึทื.
ืื bhunter-ts ืฉืจืืคื ืงืจืืืืฅ ืึท tmux ืกืขืกืืข ืืื ืกืคึผืืืฅ ืื ืคึฟืขื ืฆืืขืจ ืืื ืืจืื ืคึผืึทื ืึทืื. ืืขืจ ืขืจืฉืืขืจ, ืืจืขืกืื, ืึผืืื ืึท ืืขืงืกื ืืขื ืื. ืื ืฉืคึผืืฅ ืจืขืื ืืืื ืขืจ ืึผืืื ืืึธื ืืืคึผืึธื ืืึธืืก, ืืึธ ืืืจ ืงืขื ืขื ืืขื ืึทืจืืืงืืขื ืืืขืื ืคืจืืืื ืฆื ืงืืึธืฅ ืืื ืื ืืึธื ืืืคึผืึธื. ืืขืจ ื ืืืขืจืืงืขืจ ืจืขืื ืืึทืคืืืข ืืืกืคึผืืืื ืืื ืคึฟืึธืจืืึทืฆืืข ืืืขืื ืื ืคึผืจืึธืืจืขืก ืคืื ืื ืืึทืคืึทืื ืืืืฃ ืืึธืื ืขื ื ืึธืืื ืืื ืืืขืื ืืขืจืึธืื ืืึทืงืก.
ืื ืืืึทืืข ืคืื โโืืขื ืืืคึฟื ืืืืขืจ ืืขืจ ืขืจืฉืืขืจ ืืื ืึทื ืืืจ ืงืขื ืขื ืืขืฉืึธืืขื ืคืึทืจืืึทืื ืืขื ืืืึธืงืืึทื ืืื ืฆืืจืืงืงืืืขื ืฆื ืืื ืฉืคึผืขืืขืจ, ืึธื ืืืื ืืขืจ ืกืืึธืคึผืคึผืื ื ืืืึทื ืึทืจืืขื. ืคึฟืึทืจ ืื ืืืืก ืืขื ืขื ืงืืืื ืืึทืงืึทื ื ืืื tmux, ืืื ืคึฟืึธืจืฉืืึธืื .
ืืื ืึท ืืื ืกื
systemctl enable bhunter
systemctl start bhunterืืื ืืขื ืคืึทื, ืืืจ ืืขืื bhunter ืึทืืืึธืกืืึทืจื ืืื ืกืืกืืขื ืกืืึทืจืืึทืคึผ. ืืื ืืขื ืืืคึฟื, ืื ืืขืจืึทืงืฉืึทื ืืื bhunter ืืื ื ืืฉื ืฆืืืขืฉืืขืื, ืืื ืื ืจืฉืืื ืคืื ืืึทืงื ื ืึธืืื ืงืขื ืขื ืืืื ืืืงืืืขื ืคึฟืื /var/log/bhunter/hacked.log
ืขืคืขืงืืืืืงืืึทื
ืืฉืขืช ืืจืืขืื ืืืืฃ ืืืื ืืขืจ, ืืื ืืขืจืืื ืฆื ืืขืคึฟืื ืขื ืืื ืืึทืงืืืขื ืึทืงืกืขืก ืฆื ืืึธืจ ืคืึทืจืฉืืืขื ืข ืืขืืืืกืขืก: ืืึทืืขื ืข ืคึผื, ืจืึธืืืขืจืก (ืกืคึผืขืฆืืขื ืืืงืจืึธืืืง), ืืืขื ืกืขืจืืืขืจืก, ืืื ืึทืืึธื ืึท ืืืื ืื ื ืคืึทืจื (ืฆืื ืืึทืืืืขืจื, ืึทืงืกืขืก ืฆื ืขืก ืืื ืืขืืืขื ืืขืฉืึทืก ืืขื ืืึธื, ืึทืืื ืขืก ืืื ื ืื ืืฉืืงืึทืืืข. ืืขืฉืืืืข ). ืืึธ ืืื ืึท ืกืงืจืขืขื ืฉืึธื ืคืื ืื ืคึผืจืึธืืจืึทื, ืืืึธืก ืืืืึทืื ืึท ืจืฉืืื ืคืื ืืึทืงื ื ืึธืืื ื ืึธื ืขืืืขืืข ืืขื ืคืื ืึทืจืืขื:
ืฆืื ืืึทืืืืขืจื, ืื ืืคืขืงืืืืื ืึทืก ืคืื ืืขื ืืขืฆืืึทื ืืื ื ืืฉื ืืขืจืืจืืืื ืืืื ืขืงืกืคึผืขืงืืืืฉืึทื ื: ืืืื ืืขืจ ืงืขื ืขื ืคึผืจืืืืจื ืคึผืึทืกืืืขืจืื ืฆื ื ืึธืืื ืคึฟืึทืจ ืขืืืขืืข ืืขื ืึธื ืืฆืืื, ืืื ืงืขื ืขื ืืึทืง ืขืืืขืืข ืืึทืจืืึทืฅ ืืื ืึท ืคึผืึธืจ ืคืื ืฉืขื. ืึธืืขืจ ืืึธืก ืืื ืืขื ืื ืคึฟืึทืจ ืึท ืจืขืืืืขืจ ืื ืคืืึทืงืก ืคืื ื ืืึท ืืึธืื ืขื ืกืึทืืคึผืึทืื.
ืื ืืคืขืงืืืืื ืึทืก ืืื ืื ืคืืืึทื ืกื ืืืจื ืึทืืึท ืคึผืึทืจืึทืืขืืขืจืก ืืื: ืื ืืืื ื ืืื ืืืึธืก ืืขืจ ืกืขืจืืืืจืขืจ ืืื ืืืื ืืขืจ ืืื ืืืื, ืืึธืกืืื ื ืืื ืื ืงืืื ืคืื ืืืึธืก ืื IP ืึทืืจืขืก ืืื ืึทืืึทืงืืืืื. ืืื ืืืื ืืขืจืคืึทืจืื ื, ืขืก ืืื ืืขืืืขื ืึท ืคืึทื ืืืขื ืืื ืจืขื ืืึทื ืฆืืืื ืืืืจืืืึทื ืกืขืจืืืขืจืก ืคืื ืืืื ืืึธืกืืื ื, ืืื ืืืื ืขืจ ืคืื ืืื ืืื ืืขืืืขื ืงืขืื ืืืจื ืืึธืื ืขืฅ 2 ืืื ืืขืจ ืึธืคื.
ืืึทืื ืืืึธืก ืืื ืืึธืื ื ืืฉื ืคืึทืจืคืขืกืืืงื ื ืึธื
ืืืขื ืึทืืึทืงืื ื ืื ืคืขืงืืึทื ืืื ืืช, ืืื ืขืืืขืืข ืกืืืืึทืืืึธื ืก ืขืก ืืื ื ืื ืืขืืืขื ืฆื ืึทื ืึทืืืืืืืึทืกืื ืืึทืฉืืืืขื ืฆื ืื ืคึผืึทืจืึธื ืืื ืจืืืืืง ืึธืืขืจ ื ืืฉื. ืึทืืึท ืงืึทืกืขืก ืืขื ืขื ืืึธืื ืืื ืื /var/log/debug.log ืืขืงืข.
ืื Paramiko ืืึธืืืืข, ืืืึธืก ืืื ืืขื ืืฆื ืฆื ืึทืจืืขืื ืืื SSH, ืืืืืืืื ืืื ืคืึทืืฉ: ืขืก ืขื ืืืึทืกืื ืืืืจืื ืคึฟืึทืจ ืึท ืขื ืืคืขืจ ืคืื ืืขืจ ืืึทืืขืืึธืก ืืืขื ืขืก ืคืจืืืื ืฆื ืคืึทืจืืื ืื ืฆื ืืื. ืืื ืขืงืกืคึผืขืจืืืขื ืืขื ืืื ืืืืืขืจื, ืึธืืขืจ ืืื ื ืืฉื ืืึทืงืืืขื ืื ืืขืืืืื ืจืขืืืืืึทื
ืืืึธืก ืึทื ืืขืจืฉ ืืึทืจืฃ ืฆื ืึทืจืืขืื ืืืืฃ?
ืกืขืจืืืืก ื ืึธืืขื
ืืืื RFC-4253, ืืขืจ ืงืืืขื ื ืืื ืกืขืจืืืขืจ ืืืขืงืกื ื ืขืืขื ืคืื ืกืขืจืืืืกืขืก ืืืึธืก ืื ืกืืจืืืขื ื ืื SSH ืคึผืจืึธืืึธืงืึธื ืืืืืขืจ ืื ืกืืึทืืืจืื ื. ืืขืจ ื ืึธืืขื ืืื ืงืึทื ืืืื ื ืืื ืื "ืกืขืจืืืืก ื ืึธืืขื" ืคืขืื, ืงืึทื ืืืื ื ืืืืืข ืืื ืืขืจ ืืงืฉื ืคืื ืื ืงืืืขื ื ืืืึทื ืืื ืืื ืืขืจ ืขื ืืคืขืจ ืคืื ืื ืกืขืจืืืขืจ ืืืึทื. ืื ืคืขืื ืืื ืึท ืฉืืจืืงื, ืืื ืืืื ืืืขืจื ืงืขื ืขื ืืืื ืืขืคึฟืื ืขื ืืื wireshark ืึธืืขืจ nmap. ืืึธ ืก ืึท ืืืึทืฉืคึผืื ืคึฟืึทืจ OpenSSH:
$ nmap -p 22 ***.**.***.** -sV
Starting Nmap ...
PORT STATE SERVICE VERSION
22/tcp open ssh <b>OpenSSH 7.9p1 Debian 10+deb10u2</b> (protocol 2.0)
Nmap done: 1 IP address (1 host up) scanned in 0.47 seconds
ืึธืืขืจ, ืืื ืืขื ืคืึทื ืคืื Paramiko, ืืึธืก ืคืขืื ืึผืืื ืึท ืฉืืจืืงื ืืื "Paramiko Python sshd 2.4.2", ืืืึธืก ืงืขื ืขื ืืืขืจืฉืจืขืงื ืืึธืื ืขืฅ ืืืึธืก ืืขื ืขื ืืืืืื ื ืฆื "ืืืกืืืืื" ืืจืึทืคึผืก. ืืขืจืืืขืจ, ืืื ืืจืึทืืื ืขืก ืืื ื ืืืืืง ืฆื ืคืึทืจืืืึทืื ืืขื ืฉืืจื ืืื ืขืคึผืขืก ืืขืจ ื ืืืืจืึทื.
ืื ืืขืจืข ืืืขืงืืึธืจืก
SSH ืืื ื ืืฉื ืืขืจ ืืืืื ืืืื ืคืื ืืืืึทื ืคืึทืจืืืึทืืืื ื. ืขืก ืืื ืืืื Telnet, rdp. ืขืก ืืื ืืืขืจื ืฆื ื ืขืืขื ืึท ื ืขืขื ืืขืจ ืงืืง ืืืึท ืืื.
ืขืงืกืคึผืึทื ืกืืึธื
ืขืก ืืืึธืื ืืืื ืืจืืืก ืฆื ืืึธืื ืขืืืขืืข ืืจืึทืคึผืก ืืื ืคืึทืจืฉืืืขื ืข ืืขื ืืขืจ ืืื ืกืขื ืืจืึทืื ืงืืืึทืื ืืึธืืื ืก, ืคึผืึทืกืืืขืจืื ืืื ืืึทืงื ื ืึธืืื ืคืื ืืื ืืื ืึท ืคึผืจืึธืกื ืืึทืืึทืืืืก.
ืืื ืงืขื ืืื ืืจืืคืงืืคืืข?
ืืื ืืขืจ ืฆืืื ืคืื ืฉืจืืืื, ืืืืื ืึท ืคึผืจืึธืืข ืืืขืจืกืืข ืืื ืืจืืื, ืืืึธืก ืงืขื ืขื ืืืื ืืึทืื ืืึธืืืื ืคึฟืื .
ืืงืืจ: www.habr.com
