I am not including the full logs for your appraisal (due to listserver constraints). If you would like to see those, let me know.<div><br></div><div>Please be sure to read to the bottom of the post to see the equipment and get the Android download link.<br>
<div class="gmail_quote"><div><br></div>Here's what the SSH access attempts look like from a standard linux system:<div>
<br></div><div>As you can see this person was attempting to hit our server (before the hackfest).</div><div><br></div><div>This could easily be blocked with an IPTABLE rule to deny them when they attempt to hit port 22 more than x times in a 2 minute period, the use of a portknocking utility or a denyhosts wrapper. But the very best way to remediate these types of exploits is a VPN. </div>
<div><br></div><div>0) IPTABLES/Swatch: <a href="http://home.gagme.com/greg/linux/protect-ssh.php" target="_blank">http://home.gagme.com/greg/linux/protect-ssh.php</a></div><div>1) IPTABLES/Portknocking: <a href="http://www.mariusv.com/howto-protect-services-like-ssh-against-brute-force-using-only-iptables/" target="_blank">http://www.mariusv.com/howto-protect-services-like-ssh-against-brute-force-using-only-iptables/</a></div>
<div>2) Wrapper (port knocking): <a href="http://www.cipherdyne.org/fwknop/" target="_blank">http://www.cipherdyne.org/fwknop/</a></div>
<div>3) Denyhosts (with whitelisting): <a href="http://denyhosts.sourceforge.net/" target="_blank">http://denyhosts.sourceforge.net/</a></div><div>4) We love OpenVPN Access Server: <a href="http://openvpn.net/index.php/access-server/overview.html" target="_blank">http://openvpn.net/index.php/access-server/overview.html</a></div>
<div><br></div><div><div><span style="font-family:arial,sans-serif">Aug 9 17:52:54 metasploitable sshd[26036]: Failed password for root from 188.132.135.123 port 42662 ssh2</span><br style="font-family:arial,sans-serif">
<span style="font-family:arial,sans-serif">Aug 9 17:52:56 metasploitable sshd[26038]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=</span><a href="http://static-123-135-132-188.sadecehosting.net/" style="color:rgb(17,85,204);text-decoration:none;font-family:arial,sans-serif" target="_blank">static-123-135-132-188.sadecehosting.net</a><span style="font-family:arial,sans-serif"> user=root</span><br style="font-family:arial,sans-serif">
<span style="font-family:arial,sans-serif">Aug 9 17:52:58 metasploitable sshd[26038]: Failed password for root from 188.132.135.123 port 43631 ssh2</span><br style="font-family:arial,sans-serif"><span style="font-family:arial,sans-serif">Aug 9 17:53:00 metasploitable sshd[26041]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=</span><a href="http://static-123-135-132-188.sadecehosting.net/" style="color:rgb(17,85,204);text-decoration:none;font-family:arial,sans-serif" target="_blank">static-123-135-132-188.sadecehosting.net</a><span style="font-family:arial,sans-serif"> user=root</span><br style="font-family:arial,sans-serif">
</div><div><span style="font-family:arial,sans-serif"><br></span></div><div>As you can see this guy was pretty persistent. He was coming from a hosting house (which we have forwarded these logs to with time-date variance).</div>
<div><br></div><div>Here's our logs from the fest (which look similar):</div><div><br></div><div><div>Aug 10 14:50:41 metasploitable sshd[23658]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.209.103.73 user=root</div>
<div>Aug 10 14:50:46 metasploitable sshd[23666]: pam_unix(sshd:auth): check pass; user unknown</div><div>Aug 10 14:50:46 metasploitable sshd[23666]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.209.103.73 </div>
<div>Aug 10 14:50:46 metasploitable sshd[23660]: pam_unix(sshd:auth): check pass; user unknown</div><div>Aug 10 14:50:46 metasploitable sshd[23660]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.209.103.73 </div>
<div>Aug 10 14:50:46 metasploitable sshd[23667]: pam_unix(sshd:auth): check pass; user unknown</div><div>Aug 10 14:50:46 metasploitable sshd[23667]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.209.103.73 </div>
<div>Aug 10 14:50:46 metasploitable sshd[23665]: pam_unix(sshd:auth): check pass; user unknown</div><div>Aug 10 14:50:46 metasploitable sshd[23665]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.209.103.73 </div>
<div><br></div></div><div>In all forensics, the $DATE is salient. In our case this server (like many) is not on localtime.</div>
<div><br></div><div><div>root@metasploitable:/var/log# date</div><div>Sun Aug 11 20:43:54 EDT 2013</div></div><div><br></div><div>Since we are in -7 MST we must add 3 hours to the log times. As you can see all our originating IP's are from DeVry University.</div>
<div><br></div><div>If you are interested in building a little Android like the one I had at the fest, I used:</div><div><br></div><div>MiniPC for Android 4.0 </div><div><br></div><div><a href="http://dx.com/p/android-4-0-mini-pc-google-tv-player-w-wifi-allwinner-a10-cortex-a8-tf-hdmi-white-4gb-137012?utm_source=GoogleShoppingUS&utm_medium=CPC&utm_content=137012&utm_campaign=191&gclid=CKyH9oDZ9rgCFYdxQgodTjwA0A" target="_blank">http://dx.com/p/android-4-0-mini-pc-google-tv-player-w-wifi-allwinner-a10-cortex-a8-tf-hdmi-white-4gb-137012?utm_source=GoogleShoppingUS&utm_medium=CPC&utm_content=137012&utm_campaign=191&gclid=CKyH9oDZ9rgCFYdxQgodTjwA0A</a></div>
<div><br></div><div>Our Android exploit APP was: WIBR+ </div><div><br></div><div><a href="http://m.zimbio.com/Wireless+LAN/articles/mKzPKe4Bq7S/WIBR+WIfi+BRuteforce+hack+pro" style="color:rgb(17,85,204);font-size:12.727272033691406px;font-family:arial,sans-serif" target="_blank">http://m.zimbio.com/Wireless+LAN/articles/mKzPKe4Bq7S/WIBR+WIfi+BRuteforce+hack+pro</a></div>
<div><br></div><div>Download here:</div><div><br></div><div><a href="http://m.zimbio.com/go/_0mQVsoLbj5/http://www.mediafire.com/download/lt5cjwzls83vbcy/WIBR%2B_1.0.33.apk" style="color:rgb(17,85,204);font-size:12.727272033691406px;font-family:arial,sans-serif" target="_blank">http://m.zimbio.com/go/_0mQVsoLbj5/http://www.mediafire.com/download/lt5cjwzls83vbcy/WIBR%2B_1.0.33.apk</a></div>
<div><br></div><div>Our WPA2 "hackfest" wireless AP "target" is running on TP-LINK TL-WR700N:</div><div><br></div><div><a href="http://www.tp-link.com/en/products/details/?model=TL-WR700N" target="_blank">http://www.tp-link.com/en/products/details/?model=TL-WR700N</a></div>
<div><br></div><div>See you all next month!</div><div><br></div><div>FLAG Report:</div><div><br></div><div>We had 1 person obtain root IMMEDIATELY via SSH using the ncrack utility described in the presentation materials: </div>
<table cellpadding="0" style="border-collapse:collapse;color:rgb(34,34,34);font-size:12.727272033691406px;width:auto;font-family:arial,sans-serif;margin-top:0px">
<tbody><tr style="min-height:16px"><td style="font-family:arial,sans-serif;margin:0px;white-space:nowrap;padding-right:8px;vertical-align:top;width:486.54827880859375px;padding-top:0px"><table cellpadding="0" style="border-collapse:collapse;table-layout:fixed;width:487.272705078125px">
<tbody><tr><td style="font-family:arial,sans-serif;margin:0px"><div style="overflow:hidden;white-space:nowrap;max-width:92%;display:inline-block"><span name="Richard Busch" style="font-size:12.727272033691406px;font-weight:bold;display:inline;vertical-align:top;color:rgb(34,34,34)">Richard Busch. </span></div>
</td></tr></tbody></table></td></tr></tbody></table><div><br></div><div>Lori <span style="color:rgb(255,255,255);font-family:Roboto,arial,sans-serif;font-size:28px;white-space:nowrap;background-color:rgb(204,0,0)">Spyder Webb </span>and her team got the WPA2 password IMMEDIATELY. </div>
<div><br></div><div>Reference: <a href="http://it-clowns.com/c/files/drawer/augusthackfest-ssh.txt" target="_blank">http://it-clowns.com/c/files/drawer/augusthackfest-ssh.txt</a></div><div><br></div><a href="tel:%28503%29%20754-4452" value="+15037544452" target="_blank">(503) 754-4452</a> Android<br>
<a href="tel:%28623%29%20239-3392" value="+16232393392" target="_blank">(623) 239-3392</a> Skype<br>
<a href="tel:%28623%29%20688-3392" value="+16236883392" target="_blank">(623) 688-3392</a> Google Voice<br>**<br><a href="http://it-clowns.com/c/" target="_blank">it-clowns.com</a><br>Chief Clown<br><br><br><br><br><br><br>
<br>
<br><br><br><br><br><br>
</div>
</div><br><br clear="all"><div><br></div>-- <br><div><br></div><a href="tel:%28503%29%20754-4452" value="+15037544452" target="_blank">(503) 754-4452</a> Android<br><a href="tel:%28623%29%20239-3392" value="+16232393392" target="_blank">(623) 239-3392</a> Skype<br>
<a href="tel:%28623%29%20688-3392" value="+16236883392" target="_blank">(623) 688-3392</a> Google Voice<br>**<br><a href="http://it-clowns.com/c/" target="_blank">it-clowns.com</a><br>
Chief Clown<br><br><br><br><br><br><br><br><br><br><br><br><br><br>
</div>