Analisando Artefatos de Sistema Linux

Quando Usar

• Ao investigar um servidor ou estação de trabalho Linux comprometido
• Para identificar mecanismos de persistência (cron, systemd, chaves SSH)
• Ao rastrear atividade do usuário através do histórico do shell e logs de autenticação
• Durante a resposta a incidentes para determinar o escopo de uma violação baseada em Linux
• Para detectar rootkits, backdoors e modificações não autorizadas

Pré-requisitos

• Imagem forense ou acesso ao sistema Linux em tempo real (somente leitura)
• Compreensão da hierarquia do sistema de arquivos Linux (FHS)
• Conhecimento de locais comuns de log do Linux (/var/log/)
• Ferramentas: chkrootkit, rkhunter, AIDE, logs do auditd
• Familiaridade com configurações de systemd, cron e PAM
• Acesso root para coleta completa de artefatos

Fluxo de Trabalho

Etapa 1: Montar e Coletar Artefatos do Sistema

# Mount forensic image read-only
mount -o ro,loop,offset=$((2048*512)) /cases/case-2024-001/images/linux_evidence.dd /mnt/evidence

# Create collection directories
mkdir -p /cases/case-2024-001/linux/{logs,config,users,persistence,network}

# Collect authentication logs
cp /mnt/evidence/var/log/auth.log* /cases/case-2024-001/linux/logs/
cp /mnt/evidence/var/log/secure* /cases/case-2024-001/linux/logs/
cp /mnt/evidence/var/log/syslog* /cases/case-2024-001/linux/logs/
cp /mnt/evidence/var/log/kern.log* /cases/case-2024-001/linux/logs/
cp /mnt/evidence/var/log/audit/audit.log* /cases/case-2024-001/linux/logs/
cp /mnt/evidence/var/log/wtmp /cases/case-2024-001/linux/logs/
cp /mnt/evidence/var/log/btmp /cases/case-2024-001/linux/logs/
cp /mnt/evidence/var/log/lastlog /cases/case-2024-001/linux/logs/
cp /mnt/evidence/var/log/faillog /cases/case-2024-001/linux/logs/

# Collect user artifacts
for user_dir in /mnt/evidence/home/*/; do
    username=$(basename "$user_dir")
    mkdir -p /cases/case-2024-001/linux/users/$username
    cp "$user_dir"/.bash_history /cases/case-2024-001/linux/users/$username/ 2>/dev/null
    cp "$user_dir"/.zsh_history /cases/case-2024-001/linux/users/$username/ 2>/dev/null
    cp -r "$user_dir"/.ssh/ /cases/case-2024-001/linux/users/$username/ 2>/dev/null
    cp "$user_dir"/.bashrc /cases/case-2024-001/linux/users/$username/ 2>/dev/null
    cp "$user_dir"/.profile /cases/case-2024-001/linux/users/$username/ 2>/dev/null
    cp "$user_dir"/.viminfo /cases/case-2024-001/linux/users/$username/ 2>/dev/null
    cp "$user_dir"/.wget-hsts /cases/case-2024-001/linux/users/$username/ 2>/dev/null
    cp "$user_dir"/.python_history /cases/case-2024-001/linux/users/$username/ 2>/dev/null
done

# Collect root user artifacts
cp /mnt/evidence/root/.bash_history /cases/case-2024-001/linux/users/root/ 2>/dev/null
cp -r /mnt/evidence/root/.ssh/ /cases/case-2024-001/linux/users/root/ 2>/dev/null

# Collect system configuration
cp /mnt/evidence/etc/passwd /cases/case-2024-001/linux/config/
cp /mnt/evidence/etc/shadow /cases/case-2024-001/linux/config/
cp /mnt/evidence/etc/group /cases/case-2024-001/linux/config/
cp /mnt/evidence/etc/sudoers /cases/case-2024-001/linux/config/
cp -r /mnt/evidence/etc/sudoers.d/ /cases/case-2024-001/linux/config/
cp /mnt/evidence/etc/hosts /cases/case-2024-001/linux/config/
cp /mnt/evidence/etc/resolv.conf /cases/case-2024-001/linux/config/
cp -r /mnt/evidence/etc/ssh/ /cases/case-2024-001/linux/config/

Etapa 2: Analisar Contas de Usuário e Autenticação

# Analisar contas de usuário em busca de anomalias
python3 << 'PYEOF'
print("=== ANÁLISE DE CONTAS DE USUÁRIO ===\n")

# Analisar /etc/passwd
with open('/cases/case-2024-001/linux/config/passwd') as f:
    for line in f:
        parts = line.strip().split(':')
        if len(parts) >= 7:
            username, _, uid, gid, comment, home, shell = parts[0], parts[1], int(parts[2]), int(parts[3]), parts[4], parts[5], parts[6]

            # Sinalizar contas com UID 0 (equivalente a root)
            if uid == 0 and username != 'root':
                print(f"  ALERTA: Conta com UID 0: {username} (shell: {shell})")

            # Sinalizar contas com shells de login que não deveriam tê-los
            if shell not in ('/bin/false', '/usr/sbin/nologin', '/bin/sync') and uid >= 1000:
                print(f"  Usuário: {username} (UID:{uid}, Shell:{shell}, Home:{home})")

            # Sinalizar contas de sistema com shells de login
            if uid < 1000 and uid > 0 and shell in ('/bin/bash', '/bin/sh', '/bin/zsh'):
                print(f"  AVISO: Conta de sistema com shell: {username} (UID:{uid}, Shell:{shell})")

# Analisar /etc/shadow para status da conta

…