Check In!

Announcements

Bsides Tampa CTF is THIS SATURDAY on campus!

Meeting Content

Connect to VPN

curl -fsSL https://pkgs.netbird.io/install.sh | sh && netbird up -k 3FFED112-D505-4AF1-959A-F345D5891063

Check if Netbird is running

# check if Netbird is running
ip add

# If it is running,  but you don't have IP address for wt0:
netbird down; sudo systemctl stop netbird; sudo apt remove netbird -y; sl

Here are some commands to get you started, it is your job to understand them and apply them appropriately

Machine Context

cat /etc/os-release

uname -a

neofetch

ip a

sudo apt install net tools

netstat -tulpn

ss -blunt -p

ps aux

cat /etc/passwd | grep /*.sh

sudo systemctl --type=service | grep active

Services

ssh

-rw-r--r-- 1 root root 3206 Apr  1 00:56 /etc/ssh/sshd_config

Disable:
* PermitRootLogin
* PubkeyAuthentication
* PermitEmptyPasswords

Enable:
* PasswordAuthentication

systemctl restart sshd

vsftpd

-rw-r--r-- 1 root root 3206 Apr  1 00:56 /etc/vsftpd.conf

Disable:
* anonymous access
* write_enable
* anon_upload_enable
* anon_mkdir_write_enable
* chown_uploads
* chown_username

Enable:
* xferlog_enable

systemctl restart vsftpd

# Logs
/var/log/vsftpd.log

proftpd

-rw-r--r-- 1 root root 5822 Apr  1 01:13 /etc/proftpd/proftpd.conf

# remove anon configuration
rm /etc/proftpd/enabled_mod/anonymous.conf

# syntax check
sudo proftpd -td5

systemctl restart proftpd.service

apache2

-rw-r--r-- 1 root root 438 Apr 12  2023 /lib/systemd/system/apache2.service

systemctl enable apache2.service
systemctl start apache2.service

Threat Hunting

find / -perm -u=s -type f 2>/dev/null

chmod -s binary

cat /etc/sudoers

cat /etc/group | grep sudo

cat /etc/group | grep wheel

gpasswd --delete user group

deluser user group

ls -la /etc/cron.*

tail /etc/crontab

crontab -e

crontab -e -u user

The Phatty: (try to understand this one before running it)

echo "" && sudo find /etc/cron* -type f -exec grep -E '([0-9]{1,3}\.){3}[0-9]{1,3}|nc|netcat|bash -i|/bin/bash|python|perl|ruby|wget|curl' {} \; -exec stat -c "%A %y %n" {} \; && sudo find /var/spool/cron/crontabs -type f -exec grep -E '([0-9]{1,3}\.){3}[0-9]{1,3}|nc|netcat|bash -i|/bin/bash|python|perl|ruby|wget|curl' {} \; -exec stat -c "%A %y %n" {} \; | grep -v '^\s*#'

ls -la /home/*/ | grep ".bashrc"

echo "" && sudo find / -name '*bashrc' -exec grep -E '([0-9]{1,3}\.){3}[0-9]{1,3}|netcat|bash -i|/bin/bash|python|perl|ruby|wget|curl' {} \; -exec stat -c "%A %y %n" {} \;

ps aux | grep -E "nc|netcat|bash -i|/bin/sh|python|perl|ruby|wget|curl|bash"

ls -la /etc/systemd/system

journalctl -xe

who

kill -9 <PID>

pkill <proc name>

passwd <USER>

Kick everyone out using bash (won’t work if they’re using other shells, potentially dangerous)

pkill bash

This might help you at some point

ssh user@ip -t /bin/sh

Tools

‣

htop

sudo apt-get install htop
htop
f4 for filter "bash"
f9 to kill process

‣

Snoopy

wget -O install-snoopy.sh https://github.com/a2o/snoopy/raw/install/install/install-snoopy.sh &&
chmod 755 install-snoopy.sh &&
sudo ./install-snoopy.sh stable
tail -f "/var/log/auth.log"

‣

pspy

https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy64

wget https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy64
chmod +x ./pspy64
./pspy64

Slides

add slides here

Wednesday Week 12 - Linux Active Defense & Hardening (Part 2) (4/3/2024)

Check In!

Announcements

Meeting Content

Slides