Assignments of day 4 in week #4

Computer Forensics II

Last Updated : Monday, 13-May-2002 10:41:42 HKT

II) Off-line inspection

Always examin the cloned disk and mount the disk as read only file system

Check the MAC time (modfiy, access and status changed time stamp)

find -mtime|atime|ctime
ls -lt|lut 
csh> find . -mtime -1 -type f -print | xargs ls -l 
-rw-------   1 shlam    daemon     68215 Jun  9 10:10 ./ltrace_0.3.10.tar.gz
-rw-------   1 shlam    daemon     44933 Jun  9 16:10 ./www.hack.com.tar.gz
(find the file that modified lesser than a day)


csh> ls -lut
lrwxrwxrwx   1 shlam    daemon         2 Jun  9 17:52 m5 -> mm
drwxrwxr-x   2 shlam    root         104 Jun  9 17:50 .X11-pipe/
drwxrwxr-x   2 shlam    root         104 Jun  9 17:50 .X11-unix/
drwxrwxrwx   2 root     root         107 Jun  9 17:50 .pcmcia/
drwxrwxrwt   2 root     root         161 Jun  9 17:50 .rpc_door/
drwx--x--x   7 shlam    daemon      1052 Jun  9 17:50 autofs-3.1.5/
drwx--x--x   2 shlam    daemon       683 Jun  9 17:50 forensic/
(list the more recent asscess file and directory)
Note. Do not draw conclusion form MAC time stamp hastily becasue MAC time stamp can be forged easily. Remember the "touch -acmr" in the Rootkit?

Check the log files

Check the log files (syslog, messages, secure , mail, wtmp, utpmp, lastlog ...) in /var/adm , /var/log. Theese log files location is usually specified in /etc/syslog.conf Below is a list of some of the more common UNIX log file names, their function, and what to look for in those files.

The common item to look for when reviewing log files is anything that appears out of the ordinary. Note. Log files can easily be erased or forged. Hence, besides looking for anything unusual entries in the log files, we should also look for any abnormal log entry absence.

Check the consistency among your log files too. For example, if your NDIS log file show that there were lots of www traffic to your host, but your host httpd access.log does not show that. Then some of your httpd access.log entries may be erased.

Check if any files are infected

Do not use the IDS which just based on file size and check sum to determine if a file is infected or trojaned because they can be forged; use md5 instead.

Find any suspicious setuid and setgid files (especially setuid root files) everywhere on your system. Intruders often leave setuid copies of /bin/sh or /bin/time around to allow them root access at a late time. The UNIX find(1) program can be used to hunt for setuid and/or setgid files. For example, you can use the following commands to find setuid root files and setgid kmem files on the entire file system: 

        find / -user root -perm -4000 -print -xdev
        find / -group kmem -perm -2000 -print -xdev

Exam user cron jobs

Check the /var/spool/cron directory for any suspicious cron jobs as they can be used by the hackers as backdoor. Also, verify that all files/programs referenced (directly or indirectly) by the 'cron' jobs, and the job files themselves, are not world-writable.

Exam user .forward jobs

If you really allow your users to execute program through .forward, you need to check if these program is normal and not setuid

Reverse engineering of suspicious program

III) Recovery and exam of removed files (not from back up tape) 




  od -cx directory

  ils inode

  /usr/local2/bin/icat /dev_name inode > outfile


ntec5:/tmp/tt> ls
./  ../  abcdefg  hijklmn


ntec5:/tmp/tt> cat abcdefg
Hello.
This is a testing.
Bla... Bla...  testing

testing


ntec5:/tmp/tt> rm abcdefg
rm: remove `abcdefg'? y

ntec5:/tmp/tt> ls
./  ../  hijklmn


(see the current directory inode)
ntec5:/tmp/tt> ls -i
 198049 ./   160321 ../   198054 hijklmn

(see the file system device)
ntec5:/tmp/tt> df
Filesystem           1k-blocks      Used Available Use% Mounted on
/dev/hda3              2016044   1463012    450620  76% /

(view the removed file inode)
ntec5:/tmp/tt> icat /dev/hda3 198049|od -cx
0000000   ¡ 005 003  \0  \f  \0 001 002   .  \0  \0  \0   A   r 002  \0
        05a1 0003 000c 0201 002e 0000 7241 0002
0000020   0  \0 002 002   .   .  \0  \0   ¢ 005 003  \0 024  \0  \f 001
        0030 0202 2e2e 0000 05a2 0003 0014 010c
0000040   .   h   i   j   k   l   m   n   .   s   w   p   £ 005 003  \0
        682e 6a69 6c6b 6e6d 732e 7077 05a3 0003
                                      ^^^^^^^^^
                                       (198051) 
0000060 020  \0  \a 001   a   b   c   d   e   f   g   p   ¦ 005 003  \0
        0010 0107 6261 6463 6665 7067 05a6 0003
0000100   Ä 017  \a 001   h   i   j   k   l   m   n   n   .   s   w   p
        0fc4 0107 6968 6b6a 6d6c 6e6e 732e 7077


(retrive the removed by icat)
ntec5:/tmp/tt> icat /dev/hda3 198051
Hello.
This is a testing.
Bla... Bla...  testing

testing


(list the removed inode)
ntec5:/tmp/tt> ils /dev/hda3 198051
class|host|start_time
ils|ntec5|960574486
inum|allocation|uid|gid|m_time|a_time|c_time|dtime|mode|links|size|block0|block1
198051|f|0|0|960574079|960574139|960574162|960574162|100644|0|60|418630|0
                                                            ^^ (links = 0) 

ntec5:/tmp/tt> ls -i
 198049 ./   160321 ../   198054 hijklmn

ntec5:/tmp/tt> ils /dev/hda3 198054
class|host|start_time
ils|ntec5|960574631
inum|allocation|uid|gid|m_time|a_time|c_time|dtime|mode|links|size|block0|block1
198054|a|0|0|960574099|960574099|960574099|0|100644|1|25|418631|0
Another examples
Make a subdirectory tt in /tmp ntec15-36:/tmp> mkdir tt ntec15-36:/tmp> cd tt ntec15-36:/tmp/tt> ls ./ ../ Copy the /etc/passwd to a file "abcdefg" ntec15-36:/tmp/tt> cp /etc/passwd abcdefg Look for the current directory inode "./" 
ntec15-36:/tmp/tt> ls -i
 113711I ./   159681 ../   113712 abcdefg
icat the current directory inode content 
ntec15-36:/tmp/tt> icat /dev/sda1 113711 | od -cl
0000000   /   ¼ 001  \0  \f  \0 001 002   .  \0  \0  \0   Á   o 002  \0
             113711    33619980          46      159681
0000020  \f  \0 002 002   .   .  \0  \0   0   ¼ 001  \0   è 017  \a 001
           33685516       11822      113712    17240040
0000040   a   b   c   d   e   f   g  \0  \0  \0  \0  \0  \0  \0  \0  \0
         1684234849     6776421           0           0
0000060  \0  \0  \0  \0  \0  \0  \0  \0  \0  \0  \0  \0  \0  \0  \0  \0
                  0           0           0           0
*
0010000
Remove the abcdefg file ntec15-36:/tmp/tt> rm abc* rm: remove `abcdefg'? y <xmp> Dump the current directory inode content again.<br> The inode index is still there even after the remove <pre> ntec15-36:/tmp/tt> icat /dev/sda1 113711 | od -cl 0000000 / ¼ 001 \0 \f \0 001 002 . \0 \0 \0 Á o 002 \0 113711 33619980 46 159681 0000020 ô 017 002 002 . . \0 \0 0 ¼ 001 \0 è 017 \a 001 33689588 11822 <font color=red>113712</font> 17240040 0000040 a b c d e f g \0 \0 \0 \0 \0 \0 \0 \0 \0 1684234849 6776421 0 0 0000060 \0 \0 \0 \0 \0 \0 \0 \0 \0 \0 \0 \0 \0 \0 \0 \0 0 0 0 0 * 0010000 We icat the removed file by the inode 
ntec15-36:/tmp/tt> icat /dev/sda1 113712
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:
daemon:x:2:2:daemon:/sbin:
adm:x:3:4:adm:/var/adm:
lp:x:4:7:lp:/var/spool/lpd:
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:
news:x:9:13:news:/var/spool/news:
uucp:x:10:14:uucp:/var/spool/uucp:
operator:x:11:0:operator:/root:
games:x:12:100:games:/usr/games:
gopher:x:13:30:gopher:/usr/lib/gopher-data:
ftp:x:14:50:FTP User:/home/ftp:
nobody:x:99:99:Nobody:/:
xfs:x:43:43:X Font Server:/etc/X11/fs:/bin/false
named:x:25:25:Named:/var/named:/bin/false
gdm:x:42:42::/home/gdm:/bin/bash
piranha:x:60:60::/home/httpd/html/piranha:/dev/null
postgres:x:26:26:PostgreSQL Server:/var/lib/pgsql:/bin/bash
pvm:x:24:24::/usr/share/pvm3:/bin/bash
squid:x:23:23::/var/spool/squid:/dev/null
peter:x:500:500:peter:/home/peter:/bin/bash
admin:x:501:501::/home/admin:/bin/bash
ntec15-36:/tmp/tt>

You can also use the "recover ext2 filesystem" tool to recover a deleted file

recover -all /dev/hda3 Recover v1.2 by Tom Pycke <Tom.Pycke@advalvas.be> Getting inodes (this can take some time)... debugfs 1.18, 11-Nov-1999 for EXT2 FS 0.5b, 95/08/09 In what year did you delete the file? (eg. 1999): 2001 In what month did you delete the file? (Jan, Feb, Mar, Apr, May, Jun, Jul, Aug, Sep, Oct, Nov, Dec or -1=unknown): Apr On which day of the week did you delete the file? (Mon, Tue, Wed, Thu, Fri, Sat, Sun or -1=unknown): Fri What was the first possible day of the month on which you deleted the file? (1 - 31): 27 What was the last possible day of the month on which you deleted the file? (1 - 31): 27 What was the soonest possible hour(0-23) when you deleted the file? 0 What was the latest possible hour(0-23) when you deleted the file? 23 What was the soonest possible minute(0-59) when you deleted the file? 0 What was the latest possible minute(0-59) when you deleted the file? 59 What was the minimum possibly file size in bytes? (0-2147483640): 2 What was the maximum possibly file size in bytes? (0-2147483640): 100 Name : User ID | Name : User ID | Name : User ID | ---------------------- |---------------------- |---------------------- | root : 0 | bin : 1 | daemon : 2 | adm : 3 | lp : 4 | sync : 5 | shutdown : 6 | halt : 7 | mail : 8 | news : 9 | uucp : 10 | operator : 11 | games : 12 | gopher : 13 | ftp : 14 | nobody : 99 | xfs : 43 | named : 25 | gdm : 42 | piranha : 60 | postgres : 26 | pvm : 24 | squid : 23 | admin : 500 | admin_a : 21669 | admin_b : 21670 | ss-admin_a : 21671 | ss-admin_b : 21672 | majordomo : 300 | What was the user ID of the deleted the file? (-1 if you have no idea): -1 => 32048 8 APR FRI 27 11:28:56 2001 => 160183 52 APR FRI 27 12:15:16 2001 2 inodes found. Where shall i dump them? (directory): /tmp/dump3 Please type some text the deleted file should have included (type: * if you don't know it): * Please wait... Dumping inode 32048 to /tmp/dump3 Dumping inode 160183 to /tmp/dump3 Do you want to refilter the inodes? [yn] n

Exercise
  1. Writing a computer forensics analysis report for a break-in host
    1. Read /usr/local2/share/forensics/README file and follow the instructions in this REAME file to conduct the investigation
    2. Write your computer forensics analysis report and post it to your web page
    Computer Forensics Analysis Exercise Guidelines

  2. Writing a Vulnerability Analysis report for two hosts
    1. Use the techniques that you learn from this workshop to analyze the vulnerability of host ntec81 and victim
    2. Write your Vulnerability Analysis report and post it to your web page

References