search

PersistenceIsFutile

hashtag
Description

Hackers made it onto one of our production servers 😅. We've isolated it from the internet until we can clean the machine up. The IR team reported eight difference backdoors on the server, but didn't say what they were and we can't get in touch with them. We need to get this server back into prod ASAP - we're losing money every second it's down. Please find the eight backdoors (both remote access and privilege escalation) and remove them. Once you're done, run /root/solveme as root to check. You have SSH access and sudo rights to the box with the connections details attached below.

username: user password: hackthebox

hashtag
Solution

First backdoor is found in user's home directory, remove it.

➜ ssh user@94.237.56.229 -p 50833
user@ng-932570-forensicspersistence-otmee-684b4558c4-hjl2v:~$ ls -alh
total 1.2M
drwxr-xr-x 1 user user 4.0K Sep 29 11:12 .
drwxr-xr-x 1 root root 4.0K May 14  2021 ..
-rwsr-xr-x 1 root root 1.2M May 14  2021 .backdoor
-rw-r--r-- 1 user user  220 Feb 25  2020 .bash_logout
-rw-rw-r-- 1 root root 3.8K Apr 23  2021 .bashrc
drwx------ 2 user user 4.0K Sep 29 11:12 .cache
-rw-r--r-- 1 user user  807 Feb 25  2020 .profile
user@ng-932570-forensicspersistence-otmee-684b4558c4-hjl2v:~$ file .backdoor
.backdoor: setuid ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=a6cb40078351e05121d46daa768e271846d5cc54, for GNU/Linux 3.2.0, stripped
user@ng-932570-forensicspersistence-otmee-684b4558c4-hjl2v:~$ rm .backdoor -f

Find SUID binaries:

dlxcrw, mgxttm, afdluk have same md5sum, meaning they are the same files. The names seem randomly generated so

strings display's huge chunk of binary description, which seemed like bash manual. Checking the md5sum of bash it's revealed that binaries are indeed copies of bash, but with suid bit.

Remove them

ppppd also is an odd name and I suspected since it's different from bash hash it must be some other shell, like sh

Hashes match, binary is masked /bin/sh with suid bit.

The user has a cronjob which executes every minute

Remove cronjob backdoor

cat is alias for reverse shell:

Remove the line from .bashrc

Root has the same backdoor.

alertd has same syntax as nc, remove it.

After checking ps again the processes are still running, kill the processes:

crontab only showed 1 job for user and none for root, but clearly there's more.

access-up is a script that created masked suid bash files:

pyssh seemed like a normal cronjob, but after quick analysis it's definitely malicious.

Remove last line:

Remove the dist file:

Remove the cronjob:

connectivity-check backdoor was removed, but what was running it?

Search for string with grep, /etc is first most likely place it's in.

Lastly check for odd users:

gnatsarrow-up-right is a legitimate software, but it's a service. Service accounts shouldn't have shell access. And also they should definitely not be part of root group.

Update shell and group:

Get flag:

circle-check

Flag: HTB{7tr3@t_hUntIng_4TW}

PreviousObscureNextRedTrails

Last updated