The first challenge is to parse a file auth.log and answer these questions:

1. what is the name of the compromised ssh server?

2. what was the first IP address to attack the server?

3. what is the second IP address to attack the server?

4. what is the third IP address to attack the server?

5. what user was targeted during the attack?

6. which attacker IP address was used to successfully log-in?

to start, let's make a new directory and download the log-file to it:

mkdir log-analysis; cd log-analysis

(to download the log-file, r-click--> save as and select the proper folder.)

let's check to see exactly how big this file is by using wc -l auth.log:

so it's not insanely gigantic, which is nice. my current knowledge for parsing logs would be to take a pcap file, create a zeek log from it, and import that into RITA and have RITA crunch it away. unfortunately it doesn't look like we were given a zeek log, since zeek is tab-delimited and this log-file seems to be inconsistently space-delimited.

luckily, it looks like we can atleast answer the first question by just cat'ing the file:

Click to reveal

cat auth.log

in these first few lines, we see the answer to the first couple of questions, actually. question 1 is column 4, the name of the server. question 2 is the IP address associated with the first failed password attempt we see in the log. question 3 is the 2nd run of failed password attempts, but with a new IP address. likewise for question 4.

we can easily see these iterations by first awk'ing columns 6 through 14 into it's own file (stripping the timestamps) and then grepping for "Failed password" and piping to sort -u to get a unique list

Click to reveal

awk '{print $6,$7,$8,$9,$10,$11,$12,$13,$14}' auth.log | grep -i "failed" > failures.txt

cat failures.txt

now that we've stripped the timestamps, we can sort -u to get a list of unique IP addresses that are attempting to connect:

Click to reveal

cat failures.txt | sort -u

now we can easily answer questions 2, 3, and 4.

NOTE: when i sort -u'ed this list, the output was reordered, and i'm not sure why. my output ended up being IP1, IP3, and IP2. so be sure to compare this list to the original file so that you answer the questions in chronological order.

for Question 5, this should be obvious as it's the username associated with the failed password attempts:

Click to reveal

cat auth.log | grep "Failed password"

The final question asks for the successful log-in attempt. so let's do a reverse grep by using grep -v to exclude "Failed password" any any other extraneous lines we don't need:

Click to reveal

cat auth.log | grep -v "Failed password"| grep -v "Received disconnect"|grep -v "Connection"

NOTE: i ran a few iterations of this to narrow it down to just a handful of lines, each iteration adding a new | grep -v "" to remove more data from the results.

and there we go! that one line near the bottom is exactly what we're looking for.

just to cover our bases, let's grep "Accepted" and make sure it's the only successful log-in:

Perfect. SSH Log Analysis? DONE!