Mitigating and Investigating Malicious Activity on the System

1. Identify Unauthorized or Suspicious Accounts

Command Used:

cat /etc/passwd | grep "/bin/bash"

Purpose:

• Lists all user accounts with shell access.

• From the output, an unexpected user, hakor, is identified.

Action:

• Remove the suspicious account:

  userdel -r hakor

• Validate the legitimacy of other accounts, ensuring only authorized users remain.

2. Inspect User Command History

Command Used:

history

Purpose:

• Reveals executed commands by the current user.

• Notable findings include:

  • Editing and executing suspicious scripts, cron.sh and cron2.sh.

  • Applying execution permissions to cron2.sh.

Action:

• Locate and remove these scripts:

  rm /path/to/cron.sh
  rm /path/to/cron2.sh

• Review the contents of the scripts before deletion to understand their purpose:

  cat /path/to/cron.sh

3. Scan for Open Ports and Services

Command Used:

nmap 127.0.0.1

Purpose:

• Reveals open ports and associated services running locally.

• Open ports include:

  • 21 (FTP): File Transfer Protocol.

  • 25 (SMTP): Email services.

  • 4444 (Unknown): This port could be indicative of a backdoor or unauthorized service.

Action:

• Investigate unknown or unnecessary ports (e.g., 4444):

  netstat -tuln | grep 4444

• Stop services associated with these ports:

  systemctl stop [SERVICE_NAME]

• Disable the service permanently if unnecessary:

  systemctl disable [SERVICE_NAME]

4. Monitor Active Users and Processes

Command Used:

w

Purpose:

• Shows currently logged-in users and their activities.

• Indicates that the hakor user is actively logged in.

Action:

• Immediately terminate all processes owned by the suspicious user:

  pkill -u hakor

• Verify no remaining activity from the user:

  ps -u hakor

5. Review Cron Jobs for Persistence

Command to List Cron Jobs:

crontab -l

or system-wide:

cat /etc/crontab

Purpose:

• Check for malicious scripts or scheduled tasks (e.g., periodic execution of cron2.sh).

Action:

• Remove unauthorized entries:

  crontab -e

Summary of Actions Taken

1. Account Removal:

   • Deleted the unauthorized user hakor and their associated files.

2. Script Cleanup:

   • Removed suspicious scripts cron.sh and cron2.sh after reviewing their contents.

3. Port Investigation:

   • Investigated and stopped unnecessary or suspicious services running on open ports (e.g., 4444).

4. Session Termination:

   • Terminated active sessions and processes associated with the suspicious user.

5. Cron Job Audit:

   • Inspected and removed unauthorized scheduled tasks.

Key Takeaways

• Always validate accounts with shell access to ensure legitimacy.

• Monitor and investigate unusual processes or open ports that could indicate malicious activity.

• Regularly review command history and scheduled tasks to detect persistent threats.

• Immediate action, such as terminating processes and removing files, is critical to contain and mitigate the impact of unauthorized access.