Detecting outgoing http attacks
If your server or website has already been compromised and your server is sending out malicious HTTP requests like scans, brute force attempts, etc. You can detect and log the outgoing packets and find out which user caused the problem by adding the following iptables rule.
This rule will log any packet that leaves your server and targets port 80. It also logs the user id so you can identify which user initiated the request. To avoid flooding, we limit the number of logs to 5 per minute. You can increase or decrease this number if you need to fine tune.
iptables -I OUTPUT -p tcp -m tcp --dport 80 -j LOG --log-uid -m limit --limit=5/minute --log-prefix BITNINJA
After running this command, you have to monitor the kernel log for any captured packets. You can see the kernel logs with this command:
dmesg -T
Note
On some older versions of dmesg the -T option is not supported. In this case you can simply run dmesg.
An example of packets made by root. (UID=0 GID=0)
[Wed Jan 20 09:57:00 2016] BITNINJAIN= OUT=lo SRC=10.0.3.131 DST=14.321.31.11 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=63055 DF PROTO=TCP SPT=48430 DPT=80 WINDOW=256 RES=0x00 ACK URGP=0 UID=0 GID=0 MARK=0x1
An example of packets initiated by a user (UID=13576 GID=13576)
[Wed Jan 20 10:00:13 2016] BITNINJAIN= OUT=lo SRC=X.X.35.131 DST=Y.Y.110.40 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=22964 DF PROTO=TCP SPT=38694 DPT=80 WINDOW=32792 RES=0x00 SYN URGP=0 UID=13576 GID=13576 MARK=0x1
You can delete the log iptables rule with this command:
iptables -D OUTPUT -p tcp -m tcp --dport 80 -j LOG --log-uid -m limit --limit=5/minute --log-prefix BITNINJA
just grep this UID and GID from /etc/passwd file
grep /etc/passwd | grep UID
you will see the username there.
also check all crontab -e for that user and
ps -ef |grep nohup
to check nohup process in server that will auto start in reboot alsoA restart/reboot will kill all running processes, using nohup and/or putting it in the background (&) will not protect you from this.
Comments
Post a Comment