looks like someone's tool is a little broken

So got a bunch of emails today, via deny hosts. Lots of traffic at my ssh server. Running failed (there is an old version on the blog, I'll add the latest version below), I saw the typical automated attack mess. But one thing caught my eye. In the invalid user section.


Oct 20 18:56:52 from root
Oct 20 19:23:57 from root

Hmm... those don't conform to my normal search for that section.

Now all failed does, is goes through and parses my auth / secure log for matched failed instances. And here is what was in the log file.


Oct 20 18:56:52 $SERVER_NAME sshd[11347]: Failed password for invalid user root b0#pdl!PP from $ATTACK_IP port 55778 ssh2

Oct 20 19:23:57 $SERVER_NAME sshd[31205]: Failed password for invalid user root c from $ATTACK_IP port 42388 ssh2

From the lines in the logs. It looks like they sent the password as part of the user name. that or my system was being slow and their's faster.

The shell script "failed"

#! /bin/sh

# checks for /var/log/auth.log for login failures.

# version 0.2

# chrisj@rattis.net

# prints failed invalid users

echo "Failed Invalid User Attempts"

grep "Failed" /var/log/auth.log | grep -i 'invalid' | awk '{print $1,$2,$3,$13,$11}' | sort -u

echo ' '

#prints failed vailid users, except for me.

echo "Failed Valid User Attempts"

grep "Failed" /var/log/auth.log | grep -vi 'invalid' |  awk '{print $1,$2,$3,$11,$9}' | sort -u

echo ' '

if you want to be a hacker, go read this

Alex, a good friend of mine and a former Eastern Michigan IA student, wrote a great article for his company's blog. You really should go read it

"The first few months of penetration testing, what they don't teach you in school."

One of the ones I didn't like

So I mentioned in the Plan for IA240 blog post, I had some other ideas. Ones that I decided to not go with for various reasons.

One to those ideas that I rejected:

Using a tablet, with my cell phone as a tether. I tried using my cellphone in class the first night. It didn't work too well. It was rather slow Googling questions the professor was asking.

I also didn't like the idea for a hand full of reasons. I could be wrong, because I don't understand all the tech.

First the tethering. I have a rooted (running cyanogen mod) cell phone, but every time I tried, I get messages saying the network I have for service is blocking it.

I'm still creating a wireless network that someone could try attacking. Other people wanting to connect. Not saying people would, but hacking wifi isn't that hard, and if they're willing to go after a laptop, why not go easier with a wifi connection.

I've only used Shark for Root sparingly. As I understand it, it can do 3g packet captures. I'm not sure if that's only for the phone it's on, or if it can grab any 3g signal. I also haven't found much documentation on it. I also don't have the equipment to test it properly at this time. Maybe we can set something like that up to EMU's IA Club, where we can play around with it and see what it does.

Just one of the ideas, I tossed to the side. I'll talk about another one some other time.

Well Tails works...

Sitting at Eastern Michigan University on the wireless network using T.A.I.L.S. It's a little slow, but that's ok. I'm riding across TOR to an exit node in germany.

To get this to work:
I loaded the system from the Live CD.

Then using the unsafe browser, I was able to get to the capture portal. To do that, you need to go to a non-https site. I like to use www.sluggy.com. Going to www.google.com got grabbed by HTTPSeverywhere, and was dragged to encrypted.google.com. Sadly that doesn't work with EMU's capture portal.

After that, started the ice-weasel browser to make sure it worked right. Which it did. Then shutdown the unsafe browser.

So this works.

Can't wait for Friday

I found out tonight that the IASA (Information Assurance Student Association) is having their kick off meeting Friday. At 5. Time sucks, but meh.

I'm actually thinking of tossing my id in the bit-bucket for an officer position. Don't know which one yet. I'm sure that'll fly like the NX37602. There are some things I think we could do better as students. Yeah it means more work for us, but in the long run, it makes us better students. No it's not hacking each other. Although some Saturday CTF in L6 would't be too bad. If allowed.

I also got to do some reading on T.A.I.L.S. tonight. I figured I could't be the only one that was having problems with capture portals (have to log in to use wireless). Looks like I was right. And I have something to test on Friday now.

Also, new version of T.A.I.L.S came out tonight. Version 0.13.0.

Need to look in to T.A.I.L.S some more.

I couldn't get T.A.I.L.S to work on campus tonight. The wireless would assoicate, but I then have to log in to the back end server. However I was never seeing a re-direct. I think I managed to disable tor, in case that was the problem. But I have also seen problems with other systems like that in the past and HTTPS everywhere.

I need to find some time to look in to it.

There will be some more posts coming

So I've tested T.A.I.L.S, it comes with sshfs pre-installed. It's also really easy to use. It looks like all the traffic goes through T.O.R. Next step will to see if it works with the University's wifi.

I've been asked to do a talk on it.

I'm also going to do some write ups on the options I didn't use and why I didn't want to use them.