Unix/Linux Forensics 1

Simple Linux Commands

• date – display the date

• ls – list the files in the current directory • more – display files one screen at a time • cat – display the contents of a file

• wc – displays lines, words, and characters • cp, mv, rm, pwd, mkdir, cd, rmdir, chmod, • head – show the first few lines of a file • file – determine a file type

• tail – show the last few lines of a file • cal – display calendar

• kill – terminate a running command • lpr – send a job to the printer

• grep – searches a file for a specific pattern • chmod – change file permissions

• fdisk

Basic Concepts

• shell

• shell scripts

• background and foreground

– &

– Ctrl-Z, bg, fg, jobs

• Environment variables

– env

The Linux Filesystem Layout

• The basic layout of the filesystem starts with the root directory.

–root directory : this is the base of the file system's tree structure.

–/bin : binary files for the OS –/dev : the device files

–/etc : system configuration files

–/sbin: system administrative binaries

Commonly used command/concepts

• cksum

– checksum and count the bytes in a file

• sum

– checksum and count the blocks in a file

• diff

– Provide a list of each line that differs

Commonly used command/concepts

• Every file is managed by a data structure

called an inode

– File location and size – Owner, permission,

– Time of creation, time of last access, time of last modification

– stat

• SUID root

Network Information System

Four basic steps

• Collect

• Preserve

• Analyze

Investigating A Unix Host

• Filesystem integrity-checking program

– Tripwire: http://sourceforge.net/projects/tripwire/

• TCT

– Examining hacked Unix systems

– http://www.porcupine.org/forensics/tct.html

Order of Volatility

• The more volatile the data is, the more difficult it is to capture, and the less time you have to do it.

• The descending order:

TCT (1)

• TCT – The Coroner’s Toolkit

– http://www.porcupine.org/forensics/

• Mostly perl but some C as well

• A STATIC tool!

– e.g. changes to filesystem during analysis will NOT be noticed by TCT

TCT (2)

– grave-robber: captures forensics data – The C-tools (ils, icat, pcat, file, etc)

• pcat – low-level memory utilities: copy process memory

– pcat PID

• file: determine file type

• icat: copies files by inode number

• ils: list inode info (usually removed files)

– lazarus

• Lazarus: create structure from unstructured data

– mactime

The C-tools

(ils, icat, pcat, file, etc)

• pcat – gathers process memory from live

system

• ils – gathers inode information

– ./ils /dev/sda6

• icat – copy files using inode information to

standard out

– ./icat /dev/sda6 1405802 (you can use stat to obtain the inode number)

lazarus

• Lazarus – classify raw information for

analyzing (brings back info from the dead)

mactime

• Three times on ext f/sys:

– Modification time – Access time

– Change time

• collects information on all three times for

specific files

Be nice to your MAC times

system)

• Running a single command may change last Access time of a file

• Should grab MACtime info before running any further commands on system.

Sleuth kit

• Expands TCT data

The Sleuth Kit

• File System Category • Content Category

– dls –f ext –e –l sda6.img

» a: the data unit is allocated » f: the data unit is unallocated – dcat –f ext sda6.img 23456

» View the contents of any data unit

• Metadata category

» Include data that describe a file: for example, temporal information, the addresses of the data units, the size of the file.

» istat –f ext sda6.img 163199 - to get the specific metadata entry

The Sleuth Kit

• File Name Category

» Includes the data that associates a name with a metadata entry » fls: list file names in a given directory

» ffind: list which file name corresponds to a given metadata address

• Application Category

» A file system journal records updates to the file system so that the file system can be recovered more quickly after a crash

» jls – list the contents of the journal and show which file system blocks are saved in the journal blocks

• Multiple category

The Sleuth Kit

• sigfind – find binary signature in a file – Disk tools

• disk_stat

Autopsy

• Developed to automate the investigation

process when TSK is being used

Capture Filesystem

– Wipe out analysis drive

• dd if=/dev/zero of=/dev/fd0

– One more example

• nc –l –p 10001 > syspect.hdb5.image.1of3& • nc –l –p 10002 > syspect.hdb5.image.2of3& • nc –l –p 10003 > syspect.hdb5.image.3of3&

• dd if =/dev/hdb5 count 2000000 bs=1024 | nc 192.168.0.4 10001 –w 3

• dd if =/dev/hdb5 skip 2000000 count 2000000 bs=1024 | nc 192.168.0.4 10002 –w 3

• dd if =/dev/hdb5 skip 4000000 count 2000000 bs=1024 | nc 192.168.0.4 10003 –w 3

md5

• Create the hash value of collected data and

record it

– md5 from tct: md5 /dev/sda6

Accessing Captured Filesystems for

Examination

• Copy the image into a partition that is the same

size as the image (partition cleaned using dd)

• Another approach

– mkdir /mnt/suspecthost

logs

logs

• /var/log/secure

– authpriv.*

• HTTP

Invisible Files and Directories

• Find invisible files and directories

– find . –type d –name “.*” –print0 | cat –a

• Search SUID root executables

– find / -user root –perm -4000 –print0 | xargs -0 ls

-l

• Search SGID programs

RootKit

• http://www.securityfocus.com/infocus/1811

• Increase privileges • Hide activities

– To manipulate the environment and hide evidence

• Gather information

– To extend attacks

• One example

Detecting Trojan LKMs on Live System

• Detecting trojan LKMs on a live system

– Complicated

Miscellaneous

• To determine listing applications associated

with open ports

– netstat –anp

• To determine whether a sniffer is running on a

system (promiscuous mode)

– ifconfig eth0

• /proc

Miscellaneous

• lsof (list open files)

– Lists processes with all their open files, network ports, current directories, and other file system-related information

– An open file can be a regular file, a directory, a library, a stream, or a network socket.

– Example:

• For root user: lsof –p PID_of_SSHD

Miscellaneous

• ltrace

– Library call monitoring programs – ltrace date > /dev/null

• Show fragment of a library-call trace of the date command

• strace

– System call monitoring – strace date > /dev/null

• sysctl

Prepare Analysis Machines

• Boot into Knoppix-STD (or your favorite

Linux OS with all the right tools)

A Summary of the Steps in a Unix Investigation

• Review all pertinent logs • Perform keyword searches • Review relevant files

• Identify unauthorized user accounts or groups • Identify rogue processes

• Check for unauthorized access points • Analyze trust relationships

Attack Steps

• Intelligence Gathering

– Password sniffing and guessing – Compromise network service

• Initial Compromise • Privilege Escalation

– Gain root access

• Reconnaissance

– Attackers perform their own forensic examination – Look for security programs

– Analyze system and user activities

• Covering the Tracks