How Hackers Cover Their Tracks on an Exploited Linux Server with Shell Scripting « Null Byte :: WonderHowTo

An attacker with shell access to a Linux server can manipulate, or perhaps even ruin, anything they have access to. While many more subtle attacks could provide significant value to a hacker, most attacks also leave traces. These traces, of course, can also be manipulated and avoided through methods such as shell scripting.Finding evidence of an attack can start with a trace left behind by an attacker like a file modification date. Every time a file is created, modified, or "touched" in Unix terminology, it generally updates the modification time of a file. Every file within aLinuxfilesystem contains a modification date stored somewhere.Don't Miss:Scripting for the Aspiring Hacker (BASH Basics)To a system administrator, files which suddenly display a recent modification time may notify them of an attack and prompt them to take action to lock down a system. Luckily for an attacker, modification times are not an infallible record. These modification times themselves can be spoofed or modified. One such way an attacker might automate the process of backing up and restoring modification times is to write a shell script.Step 1: Viewing & Manipulating TimestampsSeveral tools included on most Linux systems allow us to very quickly view and modify file timestamps. The most relevant tool for affecting this property is referred to astouch. This command allows us to create a new file or update the last time a file or group of files were "touched."touch fileRunning the command above will create a new file named "file" if it does not already exist, and if it does exist, it will update the modification date with the current system time. We can also use a wildcard, like in the string below.touch *This command will update the timestamp of every file in the folder in which it was run.After creating or modifying our file, there are a couple of ways we can view its details. The first is using thestatcommand.stat fileRunning stat returns some information about the file, including Access, Modify, and Change timestamps. For a batch of files, we can also view the timestamps of various files within a folder with parameters ofls. This command lists files, and the-lflag, or "long" option, also includes the timestamps of these files within its output.ls -lNow that we can set current timestamps and view those which have already been set, we can also use touch to define a custom timestamp. We can do this by using thedflag and defining a specific time in a YYYY-MM-DD format followed by a time in hours, minutes, and seconds.touch -d "2001-01-01 20:00:00" fileWe can confirm this was set by usingls.ls -l fileWhile this is useful in individual use cases, it would be very ineffective to use this technique to manually change different modification times on a server after editing the files. We can automate this process with a shell script.Step 2: Organizing the Shell ScriptBefore beginning the script, we should consider exactly what processes we need it to carry out. For the purposes of hiding tracks on a server, an attacker would need to be able to back up the original timestamps of a folder by writing them to a file, as well as to be able to restore them to the original files after we have modified them by whatever configuration changes we create during the exploitation phase.These two different functions could be triggered by different user inputs, or arguments. As our script will function based on these arguments, we'll also want to have a way to handle errors. This leaves us with a total of three potential courses of action depending on user input.no argument: return error messagesave timestamps flag: save timestamps to a filerestore timestamps flag: restore timestamps to files according to saved listWhile we could use nested if/or statements to create this script, we could also assign each one of these functions to their own "if" statement based on the conditions. We can begin writing the script in the text editor of our choice, or perhaps by using nano.Don't Miss:Linux Basics for the Aspiring Hacker (Logging)Step 3: Beginning the ScriptWe can launchnanofrom the command line and create a script titled "timestamps.sh" with the command below.nano timestamps.shFirst, let's begin the script with#!/bin/bashin order to declare the shell script as a bash script, and then write our first if statement. We'll begin withifand add a condition of[ $# -eq 0 ]. This condition indicates that if there is no argument whatsoever, and the program should do what follows thethen. In the example case, we return an error message to the user usingechoand then exit the program and close the if loop withfi.#!/bin/bashif [ $# -eq 0 ]; thenecho "Use a save (-s) or restore (-r) parameter."exit 1fiAfter we save this file, by pressingCtrl+Oin nano, we should mark it as a script which can be run. We can do this withchmod.chmod +x timestamps.shNext, we can run the script with no arguments in order to test the functionality of our error message../timestamps.shIf the script returns our echo statement, we're ready to move on to the next condition.Step 4: Writing Timestamps to a FileWe'll begin by defining an if statement which will occur only if the user input matches the defined flag.if [ $1 = "-s" ] ; thenfiThe first line defines the condition for the if statement as if the user input,$1, is equal to"-s"then it should do the sequence of steps within the if statement. As stated in our error statement, the"-s"flag indicates that the script will be run in the "save" function. We can now begin to write what this part of the script actually involves.The first line should remove, or at least check the existence of, the file which we plan to save the timestamps to. While this could be avoided by using a unique filename, and improved by using a hidden file as prefaced with a period in the filename, it's still ideal to remove the file if it exists. This will avoid accidental overlap or incorrect inputs if the file previously had any sort of content within it.rm -f timestamps;This line will remove a file named "timestamps" if that file exists. Next, we'll want to uselsin order to begin generating a list of files and their modification times. We can run ls and pipe its output to another program, such as sed, to help us clean this input later.ls -lWe'll want to limit the output fromlsto only what we need. When runningls -l, the output generally appears similar to the string below.-rw-r--r-- 1 user user 0 Jan 1 2017 fileFor the purposes of saving timestamps, we only need the year, month, day, and filename. While we could attempt to remove everything before the three-letter month abbreviation based on the number of spaces or characters before it, we can be absolutely certain of where we choose to discard unnecessary information by looking for a specific string, such as a month. The string below will remove everything on a line before the occurrence ofJan.ls -l file | sed 's/^.*Jan/Jan/p'However, while we now have all of the information we need for our program, it's not in a useable format. For usingtouchto set the modification times, the months should be in a format of numbers rather than three-letter abbreviations. We can modify this inline by changing the second string within thesedcommand below.ls -l file | sed 's/^.*Jan/01/p'Here,Janis replaced with01in addition to everything before it on the line being replaced. We can extend this system to all other possible months.ls -l | sed -n 's/^.*Jan/01/p;s/^.*Feb/02/p;s/^.*Mar/03/p;s/^.*Apr/04/p;s/^.*May/05/p;s/^.*Jun/06/p;s/^.*Jul/07/p;s/^.*Aug/08/p;s/^.*Sep/09/p;s/^.*Oct/10/p;s/^.*Nov/11/p;s/^.*Dec/12/p;'Now, if run within a folder, our output should look similar to below.This output is usable for our script, so we can add it and send the input to a file with the>>redirection. In this case, output is sent to a file named "timestamps."do echo $x | ls -l | sed -n 's/^.*Jan/01/p;s/^.*Feb/02/p;s/^.*Mar/03/p;s/^.*Apr/04/p;s/^.*May/05/p;s/^.*Jun/06/p;s/^.*Jul/07/p;s/^.*Aug/08/p;s/^.*Sep/09/p;s/^.*Oct/10/p;s/^.*Nov/11/p;s/^.*Dec/12/p;' >> timestampsNow, the first two possible actions of the script should be completed, and it should look similar to the image below.We can test the script by running it with the-sflag we have now defined../timestamps.sh -sAfter running the script, we can check that the information was saved usingcat.cat timestampsIf a list of times and filenames is returned, we're ready to move on to writing the final part of the script.Step 5: Restoring Timestamps to FilesAfter saving the original timestamps of items within a directory, the post-exploitation function of the script is to restore the timestamp backups to the files such that nothing is changed. The first step of defining this behavior is to begin with an if statement for the new flag, as in the previous section.if $1 = "-r" ; thenfiIn this case, the"-r"flag is used. Next, we'll want to read in our file of saved timestamps in a way where we can do an action for each line. We can forward the contents of the text file usingcat, and use this input in awhile readstatement. This will be enclosed within the previous if statement.cat timestamps | while read linedodoneAnything we do following these lines will be run for each single line of the file independently. Now we can assign some variables to make using the data within the file more simple.MONTH=$(echo $line | cut -f1 -d\ );DAY=$(echo $line | cut -f2 -d\ );FILENAME=$(echo $line | cut -f4 -d\ );YEAR=$(echo $line | cut -f3 -d\ )These lines each use acutstatement based on the location of a given element of the string, specifically its reference point to the number of spaces separating them.While these four variables are all relatively consistent in the way which they are formatted in the saved timestamps file, there is some variation in the way which years and times are formatted. If a timestamp occurred within the past year, it prints the hour rather than the year.As such, when we only have a time in hour and minutes, we'll need to be able to determine the current year as well. While we could just assign this to the year in which we're writing the script, we can also return it from the system.One integrated Unix utility for this purpose iscal, or calendar. We can launch this from the command line.calThe current year is shown in the first line of the program's output. We can retrieve this as a variable with the line below.CURRENTYEAR=$(cal | head -1 | cut -f6- -d\ | sed 's/ //g')We runcal, retrieve only the first line usinghead, cut it according to what we need usingcut, and finally trim unwanted output usingsed.Now that all variables are defined, we can use anif elsestatement to update the timestamps on files according to the way the date is formatted. We'll use the same touch syntax with the-dparameter as before.touch -d "2001-01-01 20:00:00" fileRather than before, however, each of these will be fulfilled by a variable rather than a defined setting. The first if statement will handle dates with times in hours and minutes. These times each contain a colon, so if the input includes a colon it will react accordingly.if [ $YEAR == *:* ]; thentouch -d $CURRENTYEAR-$MONTH-$DAY\ $YEAR:00 $FILENAME;If not, we can finish this with an else statement for the normaltouchbehavior and close the if statement.elsetouch -d ""$YEAR-$MONTH-$DAY"" $FILENAME;fiThe code for this section now should appear similar to the image below.With the restoration function completed, the script is now ready to use.Step 6: Using the ScriptUsing the script is as simple as using it with the appropriate flag. The command below saves file timestamps../timestamps.sh -sWe can run this first, and if we wish, check the created timestamps file to confirm. After this, we can run a command like the one below in order to manipulate the timestamps for all files within a directory.touch -d "2050-10-12 10:00:00" *We can confirm that these files were modified withls.ls -aNow that they've been modified, we can restore them to our backed up version../timestamps.sh -rFinally, we can confirm that this process worked by runningls -aonce more. If the timestamps now match those defined in the backup file, the script has worked successfully!Timestamps Can LieThis script considers just some of the many fragments and traces which will be left after an attack on a server. When considering how to hide one's traces, hackers must consider every single way and point at which they had accessed or manipulated a server.A clever attack treads carefully and keeps track of what has been modified, considering how to hide these tracks before they even touch a server. A system administrator must be aware both that many of their logs and protective measures can be manipulated, and they must not always trust that things are secure just because they look like they did previously.Thanks for reading! If you have any questions, you can leave a comment below or on Twitter at@tahkion.Follow Null Byte onTwitterandGoogle+Follow WonderHowTo onFacebook,Twitter,Pinterest, andGoogle+Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image byKin Lane/Flickr; Screenshots by Takhion/Null ByteRelatedHow To:Find Exploits & Get Root with Linux Exploit SuggesterHow to Hack Like a Pro:Getting Started with MetasploitHow To:Find & Exploit SUID Binaries with SUID3NUMHack Like a Pro:How to Use PowerSploit, Part 1 (Evading Antivirus Software)How To:Exploit Shellshock on a Web Server Using MetasploitHack Like a Pro:How to Exploit and Gain Remote Access to PCs Running Windows XPHow To:Use NMAP 7 to Discover Vulnerabilities, Launch DoS Attacks and More!Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 12 (Web Delivery for Linux or Mac)Hack Like a Pro:How to Hack the Shellshock VulnerabilityHack Like a Pro:Scripting for the Aspiring Hacker, Part 1 (BASH Basics)How To:Reverse Shell Using PythonHack Like a Pro:Metasploit for the Aspiring Hacker, Part 13 (Web Delivery for Windows)How To:Create a Metasploit Exploit in Few MinutesNews:Even Microsoft Acknowledges the Superiority of the Bash Shell NowHow To:Use LinEnum to Identify Potential Privilege Escalation VectorsHack Like a Pro:Scripting for the Aspiring Hacker, Part 3 (Windows PowerShell)How To:Perform Local Privilege Escalation Using a Linux Kernel ExploitHow To:Use MinGW to Compile Windows Exploits on Kali LinuxDon't Be a Script-Kiddie part1:Introduction to Shell ScriptHow To:The Essential Skills to Becoming a Master HackerHack Like a Pro:Perl Scripting for the Aspiring Hacker, Part 1How To:Use SQL Injection to Run OS Commands & Get a ShellHow To:Attack a Vulnerable Practice Computer: A Guide from Scan to ShellHow To:Configure a Reverse SSH Shell (Raspberry Pi Hacking Box)How To:Hack UnrealIRCd Using Python Socket ProgrammingHack Like a Pro:Hacking Samba on Ubuntu and Installing the MeterpreterGoodnight Byte:HackThisSite Walkthrough, Part 6 - Legal Hacker TrainingHow To:Push and Pull Remote Files Securely Over SSH with PipesRoot Exploit:Memodipper Gets You Root Access to Systems Running Linux Kernel 2.6.39+How To:Spider Web Pages with Nmap for SQLi VulnerabilitiesGoodnight Byte:HackThisSite Walkthrough, Part 7 - Legal HackerCommunity Byte:HackThisSite Walkthrough, Part 6 - Legal Hacker TrainingGoodnight Byte:HackThisSite Walkthrough, Part 4 - Legal Hacker TrainingGoodnight Byte:HackThisSite Walkthrough, Part 8 - Legal Hacker TrainingHow To:Create a Reverse Shell to Remotely Execute Root Commands Over Any Open Port Using NetCat or BASHGoodnight Byte:HackThisSite, Realistic 3 - Real Hacking SimulationsCommunity Byte:HackThisSite Walkthrough, Part 7 - Legal Hacker TrainingHow To:Create an SSH Tunnel Server and Client in Linux