{"id":22230,"date":"2025-03-09T00:05:00","date_gmt":"2025-03-09T03:05:00","guid":{"rendered":"https:\/\/www.ethicalhacker.com.br\/site\/?p=22230"},"modified":"2025-03-08T00:03:59","modified_gmt":"2025-03-08T03:03:59","slug":"forense-digital-com-linux-tecnicas-praticas-parte-15","status":"publish","type":"post","link":"https:\/\/www.ethicalhacker.com.br\/site\/2025\/03\/exploits\/forense-digital-com-linux-tecnicas-praticas-parte-15\/","title":{"rendered":"Forense Digital com Linux \u2013 T\u00e9cnicas Pr\u00e1ticas \u2013 Parte 15"},"content":{"rendered":"\n<p>\u00a0<\/p>\n<p style=\"text-align: justify;\">No artigo anterior, exploramos como o\u00a0<strong>AIDE (Advanced Intrusion Detection Environment)<\/strong>\u00a0pode ser usado para an\u00e1lises forenses no\u00a0<strong>Rocky Linux 9<\/strong>. Agora, vamos apresentar mais\u00a0<strong>5 exemplos pr\u00e1ticos<\/strong> que demonstram a versatilidade e efic\u00e1cia do AIDE em cen\u00e1rios reais de seguran\u00e7a cibern\u00e9tica.\u00a0<\/p>\n<p>\u00a0<\/p>\n<p>\u00a0<\/p>\n<p>\u00a0<\/p>\n<p><strong>1. Detec\u00e7\u00e3o de backdoors em bin\u00e1rios<\/strong><\/p>\n<p><strong>Cen\u00e1rio<\/strong>: Um invasor pode ter injetado um backdoor em bin\u00e1rios do sistema, como\u00a0<code>\/usr\/bin\/ssh<\/code>.<\/p>\n<p><strong>Passos<\/strong>:<\/p>\n<ul>\n<li>\n<p>Execute uma verifica\u00e7\u00e3o com o AIDE:<\/p>\n<div class=\"md-code-block\">\n<div class=\"md-code-block-banner-wrap\">\n<div class=\"md-code-block-banner\">\u00a0<\/div>\n<\/div>\n<pre><strong><span class=\"token function\">sudo<\/span> aide <span class=\"token parameter variable\">--check<\/span><\/strong><\/pre>\n<\/div>\n<\/li>\n<li>\n<p>Analise o relat\u00f3rio para identificar altera\u00e7\u00f5es em bin\u00e1rios:<\/p>\n<div class=\"md-code-block\">\n<div class=\"md-code-block-banner-wrap\">\n<div class=\"md-code-block-banner\">\u00a0<\/div>\n<\/div>\n<pre><strong>Changed files:\n\/usr\/bin\/ssh<\/strong><\/pre>\n<\/div>\n<\/li>\n<li>\n<p>Compare o bin\u00e1rio atual com uma vers\u00e3o limpa:<\/p>\n<div class=\"md-code-block\">\n<div class=\"md-code-block-banner-wrap\">\n<div class=\"md-code-block-banner\">\u00a0<\/div>\n<\/div>\n<pre><strong><span class=\"token function\">sudo<\/span> <span class=\"token function\">rpm<\/span> <span class=\"token parameter variable\">-Vf<\/span> \/usr\/bin\/ssh<\/strong><\/pre>\n<\/div>\n<\/li>\n<li>\n<p>Se houver discrep\u00e2ncias, reinstale o pacote afetado:<\/p>\n<div class=\"md-code-block\">\n<div class=\"md-code-block-banner-wrap\">\n<div class=\"md-code-block-banner\">\u00a0<\/div>\n<\/div>\n<pre><strong><span class=\"token function\">sudo<\/span> dnf reinstall openssh-clients<br \/><br \/><br \/><\/strong><\/pre>\n<\/div>\n<\/li>\n<\/ul>\n<p><strong>2. Monitoramento de arquivos de log<\/strong><\/p>\n<p><strong>Cen\u00e1rio<\/strong>: Um invasor pode ter adulterado arquivos de log para ocultar suas atividades.<\/p>\n<p><strong>Passos<\/strong>:<\/p>\n<ul>\n<li>\n<p>Configure o AIDE para monitorar diret\u00f3rios de log, como\u00a0<code>\/var\/log<\/code>:<\/p>\n<ul>\n<li>\n<p>Edite\u00a0<code>\/etc\/aide.conf<\/code>\u00a0e adicione:<\/p>\n<div class=\"md-code-block\">\n<div class=\"md-code-block-banner-wrap\">\n<div class=\"md-code-block-banner\">\u00a0<\/div>\n<\/div>\n<pre><strong>\/var\/log  NORMAL<\/strong><\/pre>\n<\/div>\n<\/li>\n<\/ul>\n<\/li>\n<li>\n<p>Execute uma verifica\u00e7\u00e3o:<\/p>\n<div class=\"md-code-block\">\n<div class=\"md-code-block-banner-wrap\">\n<div class=\"md-code-block-banner\">\u00a0<\/div>\n<\/div>\n<pre><strong><span class=\"token function\">sudo<\/span> aide <span class=\"token parameter variable\">--check<\/span><\/strong><\/pre>\n<\/div>\n<\/li>\n<li>\n<p>Verifique o relat\u00f3rio para identificar altera\u00e7\u00f5es:<\/p>\n<div class=\"md-code-block\">\n<div class=\"md-code-block-banner-wrap\">\u00a0<\/div>\n<pre><strong>Changed files:\n\/var\/log\/secure<\/strong><\/pre>\n<\/div>\n<\/li>\n<li>\n<p>Analise os logs suspeitos e restaure-os a partir de backups, se necess\u00e1rio.<\/p>\n<\/li>\n<\/ul>\n<h2>\u00a0<\/h2>\n<p><strong>3. Detec\u00e7\u00e3o de arquivos de configura\u00e7\u00e3o alterados<\/strong><\/p>\n<p><strong>Cen\u00e1rio<\/strong>: Um invasor pode ter modificado arquivos de configura\u00e7\u00e3o, como\u00a0<code>\/etc\/sudoers<\/code>, para escalar privil\u00e9gios.<\/p>\n<p><strong>Passos<\/strong>:<\/p>\n<ul>\n<li>\n<p>Execute uma verifica\u00e7\u00e3o com o AIDE:<\/p>\n<div class=\"md-code-block\">\n<div class=\"md-code-block-banner-wrap\">\n<div class=\"md-code-block-banner\">\u00a0<\/div>\n<\/div>\n<pre><strong><span class=\"token function\">sudo<\/span> aide <span class=\"token parameter variable\">--check<\/span><\/strong><\/pre>\n<\/div>\n<\/li>\n<li>\n<p>Analise o relat\u00f3rio para identificar altera\u00e7\u00f5es:<\/p>\n<div class=\"md-code-block\">\n<div class=\"md-code-block-banner-wrap\">\n<div class=\"md-code-block-banner\">\u00a0<\/div>\n<\/div>\n<pre><strong>Changed files:\n\/etc\/sudoers<\/strong><\/pre>\n<\/div>\n<\/li>\n<li>\n<p><strong>Compare o arquivo atual com uma c\u00f3pia de backup:<\/strong><\/p>\n<div class=\"md-code-block\">\n<div class=\"md-code-block-banner-wrap\">\n<div class=\"md-code-block-banner\">\u00a0<\/div>\n<\/div>\n<pre><strong><span class=\"token function\">sudo<\/span> <span class=\"token function\">diff<\/span> \/etc\/sudoers \/backup\/sudoers.backup<\/strong><\/pre>\n<\/div>\n<\/li>\n<li>\n<p>Corrija as altera\u00e7\u00f5es e investigue como o invasor obteve acesso.<\/p>\n<\/li>\n<\/ul>\n<h2>\u00a0<\/h2>\n<p><strong>4. Verifica\u00e7\u00e3o de permiss\u00f5es de arquivos<\/strong><\/p>\n<p><strong>Cen\u00e1rio<\/strong>: Um invasor pode ter alterado permiss\u00f5es de arquivos para obter acesso n\u00e3o autorizado.<\/p>\n<p><strong>Passos<\/strong>:<\/p>\n<ul>\n<li>\n<p>Configure o AIDE para monitorar permiss\u00f5es de arquivos:<\/p>\n<ul>\n<li>\n<p>Edite\u00a0<code>\/etc\/aide.conf<\/code>\u00a0e adicione:<\/p>\n<div class=\"md-code-block\">\n<div class=\"md-code-block-banner-wrap\">\n<div class=\"md-code-block-banner\">\u00a0<\/div>\n<\/div>\n<pre><strong>\/etc  p+i+u+g<\/strong><\/pre>\n<\/div>\n<\/li>\n<\/ul>\n<\/li>\n<li>\n<p>Execute uma verifica\u00e7\u00e3o:<\/p>\n<div class=\"md-code-block\">\n<div class=\"md-code-block-banner-wrap\">\n<div class=\"md-code-block-banner\">\u00a0<\/div>\n<\/div>\n<pre><strong><span class=\"token function\">sudo<\/span> aide <span class=\"token parameter variable\">--check<\/span><\/strong><\/pre>\n<\/div>\n<\/li>\n<li>\n<p>Verifique o relat\u00f3rio para identificar altera\u00e7\u00f5es de permiss\u00f5es:<\/p>\n<div class=\"md-code-block\">\n<div class=\"md-code-block-banner-wrap\">\u00a0<\/div>\n<pre><strong>Changed files:\n\/etc\/shadow<\/strong><\/pre>\n<\/div>\n<\/li>\n<li>\n<p>Restaure as permiss\u00f5es corretas:<\/p>\n<div class=\"md-code-block\">\n<div class=\"md-code-block-banner-wrap\">\n<div class=\"md-code-block-banner\">\u00a0<\/div>\n<\/div>\n<pre><strong><span class=\"token function\">sudo<\/span> <span class=\"token function\">chmod<\/span> <span class=\"token number\">600<\/span> \/etc\/shadow<br \/><br \/><br \/><\/strong><\/pre>\n<\/div>\n<\/li>\n<\/ul>\n<p><strong>5. Detec\u00e7\u00e3o de arquivos ocultos<\/strong><\/p>\n<p><strong>Cen\u00e1rio<\/strong>: Um invasor pode ter criado arquivos ocultos em diret\u00f3rios como\u00a0<code>\/tmp<\/code>\u00a0ou\u00a0<code>\/root<\/code>.<\/p>\n<p><strong>Passos<\/strong>:<\/p>\n<ul>\n<li>\n<p>Configure o AIDE para monitorar diret\u00f3rios suspeitos:<\/p>\n<ul>\n<li>\n<p>Edite\u00a0<code>\/etc\/aide.conf<\/code>\u00a0e adicione:<\/p>\n<div class=\"md-code-block\">\n<div class=\"md-code-block-banner-wrap\">\u00a0<\/div>\n<pre><strong>\/tmp  NORMAL\n\/root NORMAL<\/strong><\/pre>\n<\/div>\n<\/li>\n<\/ul>\n<\/li>\n<li>\n<p>Execute uma verifica\u00e7\u00e3o:<\/p>\n<div class=\"md-code-block\">\n<div class=\"md-code-block-banner-wrap\">\n<div class=\"md-code-block-banner\">\u00a0<\/div>\n<\/div>\n<pre><strong><span class=\"token function\">sudo<\/span> aide <span class=\"token parameter variable\">--check<\/span><\/strong><\/pre>\n<\/div>\n<\/li>\n<li>\n<p>Analise o relat\u00f3rio para identificar arquivos ocultos:<\/p>\n<div class=\"md-code-block\">\n<div class=\"md-code-block-banner-wrap\">\u00a0<\/div>\n<pre><strong>Added files:\n\/tmp\/.hidden-file\n\/root\/.malware<\/strong><\/pre>\n<\/div>\n<\/li>\n<li>\n<p>Investigue e remova os arquivos suspeitos.<\/p>\n<\/li>\n<\/ul>\n<p>\u00a0<\/p>\n<p><strong>Conclus\u00e3o<\/strong><\/p>\n<p style=\"text-align: justify;\">O AIDE \u00e9 uma ferramenta indispens\u00e1vel para an\u00e1lises forenses, permitindo a detec\u00e7\u00e3o de altera\u00e7\u00f5es suspeitas em arquivos do sistema. Com os\u00a0<strong>5 exemplos pr\u00e1ticos adicionais<\/strong>\u00a0apresentados neste artigo, voc\u00ea pode expandir suas habilidades em forense digital e seguran\u00e7a cibern\u00e9tica no Rocky Linux 9. Al\u00e9m disso, as\u00a0<strong>refer\u00eancias bibliogr\u00e1ficas<\/strong>\u00a0oferecem um ponto de partida para estudos mais aprofundados.<\/p>\n<p>\u00a0<\/p>\n<p><strong>Refer\u00eancias Bibliogr\u00e1ficas<\/strong><\/p>\n<p style=\"text-align: justify;\">Aqui est\u00e3o tr\u00eas refer\u00eancias bibliogr\u00e1ficas que podem ajud\u00e1-lo a aprofundar seus conhecimentos sobre forense digital e seguran\u00e7a de sistemas:<\/p>\n<ul>\n<li>\n<p><strong>Carrier, B. (2005).\u00a0<em>File System Forensic Analysis<\/em>. Addison-Wesley Professional.<\/strong><\/p>\n<ul>\n<li>\n<p style=\"text-align: justify;\">Este livro \u00e9 uma refer\u00eancia cl\u00e1ssica sobre an\u00e1lise forense de sistemas de arquivos, cobrindo t\u00e9cnicas e ferramentas para investigar sistemas comprometidos.<\/p>\n<\/li>\n<\/ul>\n<\/li>\n<li>\n<p><strong>Casey, E. (2011).\u00a0<em>Digital Evidence and Computer Crime: Forensic Science, Computers, and the Internet<\/em>. Academic Press.<\/strong><\/p>\n<ul>\n<li>\n<p style=\"text-align: justify;\">Um guia abrangente sobre evid\u00eancias digitais e investiga\u00e7\u00e3o de crimes cibern\u00e9ticos, com foco em pr\u00e1ticas forenses e t\u00e9cnicas de an\u00e1lise.<\/p>\n<\/li>\n<\/ul>\n<\/li>\n<li>\n<p><strong>NIST Special Publication 800-86 (2006).\u00a0<em>Guide to Integrating Forensic Techniques into Incident Response<\/em>.<\/strong><\/p>\n<ul>\n<li>\n<p style=\"text-align: justify;\">Este guia do NIST fornece diretrizes para integrar t\u00e9cnicas forenses em respostas a incidentes, incluindo o uso de ferramentas como o AIDE.<\/p>\n<\/li>\n<li><a href=\"https:\/\/nvlpubs.nist.gov\/nistpubs\/legacy\/sp\/nistspecialpublication800-86.pdf\" target=\"_blank\" rel=\"noopener\">https:\/\/nvlpubs.nist.gov\/nistpubs\/legacy\/sp\/nistspecialpublication800-86.pdf<\/a><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n","protected":false},"excerpt":{"rendered":"<p>\u00a0 No artigo anterior, exploramos como o\u00a0AIDE (Advanced Intrusion Detection Environment)\u00a0pode ser usado para an\u00e1lises forenses no\u00a0Rocky Linux 9. Agora, vamos apresentar mais\u00a05 exemplos pr\u00e1ticos que demonstram a versatilidade e efic\u00e1cia do AIDE em cen\u00e1rios reais de seguran\u00e7a cibern\u00e9tica.\u00a0 \u00a0 \u00a0 \u00a0 1. Detec\u00e7\u00e3o de backdoors em bin\u00e1rios Cen\u00e1rio: Um invasor pode ter injetado um [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":22226,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[89,100,21],"tags":[],"class_list":["post-22230","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-basico","category-diversos","category-exploits"],"_links":{"self":[{"href":"https:\/\/www.ethicalhacker.com.br\/site\/wp-json\/wp\/v2\/posts\/22230","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ethicalhacker.com.br\/site\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.ethicalhacker.com.br\/site\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.ethicalhacker.com.br\/site\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ethicalhacker.com.br\/site\/wp-json\/wp\/v2\/comments?post=22230"}],"version-history":[{"count":8,"href":"https:\/\/www.ethicalhacker.com.br\/site\/wp-json\/wp\/v2\/posts\/22230\/revisions"}],"predecessor-version":[{"id":22241,"href":"https:\/\/www.ethicalhacker.com.br\/site\/wp-json\/wp\/v2\/posts\/22230\/revisions\/22241"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.ethicalhacker.com.br\/site\/wp-json\/wp\/v2\/media\/22226"}],"wp:attachment":[{"href":"https:\/\/www.ethicalhacker.com.br\/site\/wp-json\/wp\/v2\/media?parent=22230"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.ethicalhacker.com.br\/site\/wp-json\/wp\/v2\/categories?post=22230"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.ethicalhacker.com.br\/site\/wp-json\/wp\/v2\/tags?post=22230"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}