T9

T6-24–01–S–E–FH

SU-BruteForce

To gain administrator privileges in a Linux environment, a randomized brute force attack is executed using a predefined list of 12,646 commonly used passwords.

This attack is executed to obtain escalating privileges by cracking the root's password. By running Python script, Brute-Force attack using su command in Linux with the list of passwords and check response. If the command succeeds, the root's password can be obtained. With the root's password successfully obtained, the attacker is able to perform diverse malicious actions. Therefore to prevent this, specifying the number of attempts to access su command is needed as a countermeasure.

	OS	IP	Software	Log collection time	Program runtime
Attacker	-	-	-	65 sec	101 sec
Victim	Ubuntu 20.04.1	10.0.2.15	python	65 sec	101 sec

Installing

python3 -m pip install -r requirements.txt

Using

python3 run.py

MITRE ATT&CK Framework

Attack Tactic
Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion
Credential	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact

Logs

./log/2024_01_T6_{time}.log # YYmmdd_HHMMSS

References

[1] MITRE [Brute Force: Password Guessing]
[2] MITRE [Privilege Escalation]

※ Click on the attack name to see a description and scenario for the attack