StellarTech Blog

So you get the call from a client that their MS Windows server isn’t responding and it’s been randomly crashing as of late. If you are not seeing anything in eventvwr.msc your first instinct might be to grab a few sticks of RAM and a couple of diagnostic disks. Wait! Don’t forget to check for a DDoS/DoS attack. I’ve seen many cases where customers and clients have missed diagnosed a denial of service attack for a hardware problem when confirmation is just a netstat command away.

If you don’t have any network graphs available and surmising that the machine is available either through IP-over-KVM or you have physical access you can run the following command:
C:\> netstat -an | sort /+33

This will sort connections by the connecting IP. If you see a hundreds of concurrent connections from one IP and and the connections statuses are all syn_received, fin_wait, or time_wait then you probably have a denial of service going on.

As you can see MSSQL port 1433 is getting hammered. It’s always wise to firewall off ports like 1433 so that they are not exposed to the world.

Another fun way to verify a DoS attack, assuming you have a monitor/crash cart on the server, is to simple unplug the network cable. If the server instantly recovers and becomes responsive you’ve found the problem. Now it’s time to use you’re firewall kung-fu and deny the IP from further access.

Below are a few other helpful information gathering commands.

Find out what IPs are sending syn_received flags to your server on http 80. Any flag can go here.
C:\> netstat -an | findstr /i ":80.*syn_received$"

Get a count of how many times 111.222.333.444 is connecting to smtp 25.
C:\> netstat -an | find ":25 " | find /c "111.222.333.444"

It never hurts to do a little prevention by firewalling off any service that doesn’t need to touch the Internet and harden that TCP/IP stack.

One of my favorite and most often used services is openSSH. While openSSH is generally known as being secure it never hurts to tweak a few extra settings.

Here are a few changes I generally do to help ensure openSSH is in tip top shape.

1. Use a strong password. My preference is to use randomly generated passwords of 20 plus alphanumeric characters with their own special blend of special characters. That should thwart most password crackers.
2. Change the port sshd listens on. Using port 22 hangs a sign out on your server saying I use sshd. While changing the port won’t stop anyone from figuring out you are running the service it will make them work harder. You can do this by changing the following in /etc/ssh/sshd_config:

   Port 1234

3. Get rid of root logins. There is absolutely no reason to log in as root when you can use ‘sudo’ or ‘su’ to elevate a wheel user to root privileges. To set this change the following line in /etc/ssh/sshd_config:

   PermitRootLogin no

4. Disable the antiquated Protocol 1 by changing to the Protocol line in /etc/ssh/sshd_config from ‘Protocol 1,2′ to the following:

   Protocol 2

5. Another option would be to block lame dictionary attacks with denyhosts or ConfigServer Firewall/Login Failure Dameon. ConfigServer firewall has the added benefit of adding a friendly interface to help managing IPtables. Blocking login failures can sometimes be overkill if you are already have other restrictions in place like using keys only or using the AllowUsers directive in your /etc/ssh/sshd_config
6. If you prefer to use keys instead of password the following changes to /etc/ssh/sshd_config are a good start in tightening things up. If you are going to have any accounts that use password authentication you’ll be locked out of the server making these changes. So only do so if you are using keys to log in:
   
PubkeyAuthentication yes
AuthorizedKeysFile .ssh/authorized_keys
PasswordAuthentication no

7. If you prefer to leave password authentication on then the AllowUser directive is for you. Below are a few examples this directive in play.
   
AllowUsers iizwheel@*
AllowUsers fjones@*
AllowUsers *@123.456.7.8
AllowUsers *@222.333.444.*


If anyone has further suggestions on securing openSSH please let me know.

Later I plan on doing posts on creating and using ssh keys, setting up DenyHosts, and setting up ConfigServer Firewall in future.

When looking into possibly compromised sites I find the use of phpshells to be a growing trend in attacks especially as a secondary attack. While I’m sure the phpshell can be used as a main attack against sloppy configurations, vulnerable and neglected applications,  the phpshell is a great tool in deeping your hold on a server especially when used on shared hosting since you can pop the shell on other sites that you’ve not directly attacked. It’s also a great tool to help pull data from databases since you can read db config files and can even be used to take root of the server when used to get netcat shells that overcome the statelessness of the shell.

To find and combat against the phpshell I’ve I’ve been using the following oneliner:

find . -size -200k -type f -print0 | xargs -0 grep -iE "r57|c99|g00nshell|phpjackal" | uniq -c | sort -u | cut -d":" -f1 | awk '{ print $2 }' | uniq

This isn’t a a perfect solution, can take a while on servers with many sites, and will pop up a few false positives, it has helped me in preventing sites from spamming and obeying their bot leaders 30 minutes after you’ve “fixed” the problem.

I had a client who needed me to verify if a site he was hosting had indeed been hacked. The site had several obfuscated lines of JavaScript throughout most if not all of the pages of the site.

I was able to confirm the site was compromised without running the code on a VM or changing with noscript on my machine by replacing all document.write() calls with alert().

Just as expected there was a nice iframe. Using wget I then confirmed that the iframe redirected to another iframe which redirected to a payload. The same network delivering the payload had also uploaded the modified files via ftp a few days earlier.

Since I found no cracking attempts on the sites ftp account I’m thinking the client’s client machine is part of the happy botnet.

This is the first time I’ve ran into an encrypted iframe and thought it was interesting.