Mirrors/hacktricks
2
0
Fork 0
mirror of https://github.com/carlospolop/hacktricks synced 2024-11-22 04:33:28 +00:00
Code Issues Projects Releases Packages Wiki Activity
hacktricks/forensics/basic-forensic-methodology/pcap-inspection
History
Translator workflow b442ae90c4 Translated to Klingon
2024-02-10 17:52:19 +00:00
..
dnscat-exfiltration.md Translated to Klingon 2024-02-10 17:52:19 +00:00
README.md Translated to Klingon 2024-02-10 17:52:19 +00:00
usb-keyboard-pcap-analysis.md Translated to Klingon 2024-02-10 17:52:19 +00:00
usb-keystrokes.md Translated to Klingon 2024-02-10 17:52:19 +00:00
wifi-pcap-analysis.md Translated to Klingon 2024-02-10 17:52:19 +00:00
wireshark-tricks.md Translated to Klingon 2024-02-10 17:52:19 +00:00

README.md

Pcap Inspection

htARTE (HackTricks AWS Red Team Expert) !HackTricks!

Other ways to support HackTricks:

RootedCON is the most relevant cybersecurity event in Spain and one of the most important in Europe. With the mission of promoting technical knowledge, this congress is a boiling meeting point for technology and cybersecurity professionals in every discipline.

{% embed url="https://www.rootedcon.com/" %}

{% hint style="info" %} A note about PCAP vs PCAPNG: there are two versions of the PCAP file format; PCAPNG is newer and not supported by all tools. You may need to convert a file from PCAPNG to PCAP using Wireshark or another compatible tool, in order to work with it in some other tools. {% endhint %}

Online tools for pcaps

Extract Information

The following tools are useful to extract statistics, files, etc.

Wireshark

{% hint style="info" %} If you are going to analyze a PCAP you basically must to know how to use Wireshark {% endhint %}

You can find some Wireshark tricks in:

{% content-ref url="wireshark-tricks.md" %} wireshark-tricks.md {% endcontent-ref %}

Xplico Framework

Xplico (only linux) can analyze a pcap and extract information from it. For example, from a pcap file Xplico, extracts each email (POP, IMAP, and SMTP protocols), all HTTP contents, each VoIP call (SIP), FTP, TFTP, and so on.

Install

sudo bash -c 'echo "deb http://repo.xplico.org/ $(lsb_release -s -c) main" /etc/apt/sources.list'
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 791C25CE
sudo apt-get update
sudo apt-get install xplico

Qap

/etc/init.d/apache2 restart
/etc/init.d/xplico start

Access to 127.0.0.1:9876 with credentials xplico:xplico

Then create a new case, create a new session inside the case and upload the pcap file.

NetworkMiner

Like Xplico it is a tool to analyze and extract objects from pcaps. It has a free edition that you can download here. It works with Windows.
This tool is also useful to get other information analysed from the packets in order to be able to know what was happening in a quicker way.

NetWitness Investigator

You can download NetWitness Investigator from here (It works in Windows).
This is another useful tool that analyses the packets and sorts the information in a useful way to know what is happening inside.

BruteShark

  • Extracting and encoding usernames and passwords (HTTP, FTP, Telnet, IMAP, SMTP...)
  • Extract authentication hashes and crack them using Hashcat (Kerberos, NTLM, CRAM-MD5, HTTP-Digest...)
  • Build a visual network diagram (Network nodes & users)
  • Extract DNS queries
  • Reconstruct all TCP & UDP Sessions
  • File Carving

Capinfos

capinfos capture.pcap

Ngrep

ngrep vItlhutlh pcap vaj ghaH ngrep. ngrep vaj example ghaH main filters using.

ngrep -I packets.pcap "^GET" "port 80 and tcp and host 192.168 and dst host 192.168 and src host 192.168"

Carving

Using common carving techniques can be useful to extract files and information from the pcap:

{% content-ref url="../partitions-file-systems-carving/file-data-carving-recovery-tools.md" %} file-data-carving-recovery-tools.md {% endcontent-ref %}

Capturing credentials

You can use tools like https://github.com/lgandx/PCredz to parse credentials from a pcap or a live interface.

RootedCON is the most relevant cybersecurity event in Spain and one of the most important in Europe. With the mission of promoting technical knowledge, this congress is a boiling meeting point for technology and cybersecurity professionals in every discipline.

{% embed url="https://www.rootedcon.com/" %}

Check Exploits/Malware

Suricata

Install and setup

apt-get install suricata
apt-get install oinkmaster
echo "url = http://rules.emergingthreats.net/open/suricata/emerging.rules.tar.gz" >> /etc/oinkmaster.conf
oinkmaster -C /etc/oinkmaster.conf -o /etc/suricata/rules

Qap pcap

To inspect a pcap file, you can use tools like Wireshark or tcpdump. These tools allow you to analyze network traffic captured in the pcap file.

Here are some steps you can follow to check a pcap file:

  1. Open the pcap file in Wireshark or tcpdump.
  2. Analyze the captured packets to understand the network traffic.
  3. Look for any suspicious or abnormal behavior in the packets.
  4. Filter the packets based on specific criteria, such as source or destination IP address, protocol, or port number.
  5. Use the built-in features of the tool to extract relevant information from the packets, such as HTTP requests, DNS queries, or email conversations.
  6. Follow the network flow to identify the source and destination of the traffic.
  7. Look for any signs of malicious activity, such as unusual network connections, unauthorized access attempts, or data exfiltration.
  8. Take note of any findings or evidence that may be relevant to your investigation.

By carefully inspecting the pcap file, you can gain valuable insights into the network traffic and identify any potential security issues or breaches.

suricata -r packets.pcap -c /etc/suricata/suricata.yaml -k none -v -l log

YaraPcap

YaraPCAP jup 'oH tool vItlhutlh

  • PCAP File vItlhutlh Http Streams.
  • gzip deflates vItlhutlh compressed streams
  • yara vItlhutlh file Scan
  • report.txt vItlhutlh vItlhutlh
  • matching files vItlhutlh Dir vItlhutlh

Malware Analysis

known malware fingerprint vItlhutlh 'oH 'oH:

{% content-ref url="../malware-analysis.md" %} malware-analysis.md {% endcontent-ref %}

Zeek

Zeek passive, open-source network traffic analyzer. Many operators Zeek Network Security Monitor (NSM) support investigations suspicious malicious activity. Zeek supports wide range traffic analysis tasks security domain, performance measurement troubleshooting.

Basically, logs created zeek aren't pcaps. Therefore logs information pcaps analysis other tools vItlhutlh.

#Get info about longest connections (add "grep udp" to see only udp traffic)
#The longest connection might be of malware (constant reverse shell?)
cat conn.log | zeek-cut id.orig_h id.orig_p id.resp_h id.resp_p proto service duration | sort -nrk 7 | head -n 10

10.55.100.100   49778   65.52.108.225   443     tcp     -       86222.365445
10.55.100.107   56099   111.221.29.113  443     tcp     -       86220.126151
10.55.100.110   60168   40.77.229.82    443     tcp     -       86160.119664


#Improve the metrics by summing up the total duration time for connections that have the same destination IP and Port.
cat conn.log | zeek-cut id.orig_h id.resp_h id.resp_p proto duration | awk 'BEGIN{ FS="\t" } { arr[$1 FS $2 FS $3 FS $4] += $5 } END{ for (key in arr) printf "%s%s%s\n", key, FS, arr[key] }' | sort -nrk 5 | head -n 10

10.55.100.100   65.52.108.225   443     tcp     86222.4
10.55.100.107   111.221.29.113  443     tcp     86220.1
10.55.100.110   40.77.229.82    443     tcp     86160.1

#Get the number of connections summed up per each line
cat conn.log | zeek-cut id.orig_h id.resp_h duration | awk 'BEGIN{ FS="\t" } { arr[$1 FS $2] += $3; count[$1 FS $2] += 1 } END{ for (key in arr) printf "%s%s%s%s%s\n", key, FS, count[key], FS, arr[key] }' | sort -nrk 4 | head -n 10

10.55.100.100   65.52.108.225   1       86222.4
10.55.100.107   111.221.29.113  1       86220.1
10.55.100.110   40.77.229.82    134       86160.1

#Check if any IP is connecting to 1.1.1.1
cat conn.log | zeek-cut id.orig_h id.resp_h id.resp_p proto service | grep '1.1.1.1' | sort | uniq -c

#Get number of connections per source IP, dest IP and dest Port
cat conn.log | zeek-cut id.orig_h id.resp_h id.resp_p proto | awk 'BEGIN{ FS="\t" } { arr[$1 FS $2 FS $3 FS $4] += 1 } END{ for (key in arr) printf "%s%s%s\n", key, FS, arr[key] }' | sort -nrk 5 | head -n 10


# RITA
#Something similar can be done with the tool rita
rita show-long-connections -H --limit 10 zeek_logs

+---------------+----------------+--------------------------+----------------+
|   SOURCE IP   | DESTINATION IP | DSTPORT:PROTOCOL:SERVICE |    DURATION    |
+---------------+----------------+--------------------------+----------------+
| 10.55.100.100 | 65.52.108.225  | 443:tcp:-                | 23h57m2.3655s  |
| 10.55.100.107 | 111.221.29.113 | 443:tcp:-                | 23h57m0.1262s  |
| 10.55.100.110 | 40.77.229.82   | 443:tcp:-                | 23h56m0.1197s  |

#Get connections info from rita
rita show-beacons zeek_logs | head -n 10
Score,Source IP,Destination IP,Connections,Avg Bytes,Intvl Range,Size Range,Top Intvl,Top Size,Top Intvl Count,Top Size Count,Intvl Skew,Size Skew,Intvl Dispersion,Size Dispersion
1,192.168.88.2,165.227.88.15,108858,197,860,182,1,89,53341,108319,0,0,0,0
1,10.55.100.111,165.227.216.194,20054,92,29,52,1,52,7774,20053,0,0,0,0
0.838,10.55.200.10,205.251.194.64,210,69,29398,4,300,70,109,205,0,0,0,0

DNS info

DNS (Domain Name System) is a fundamental component of the internet that translates domain names into IP addresses. It allows users to access websites and other online resources using easy-to-remember domain names instead of complex IP addresses.

When conducting a forensic analysis of network traffic captured in a PCAP file, inspecting DNS information can provide valuable insights. Here are some key details to look for:

  • DNS Queries: These are requests made by a client to resolve a domain name into an IP address. They typically include the domain name being queried and the type of record being requested (e.g., A, AAAA, MX, NS).

  • DNS Responses: These are the replies from DNS servers to the client's queries. They contain the resolved IP address or other relevant information, such as the time-to-live (TTL) value.

  • DNS Resource Records: These are the individual entries in a DNS response that provide specific information about a domain. Common types include A records (IPv4 address), AAAA records (IPv6 address), MX records (mail server), and NS records (name server).

By analyzing DNS information in a PCAP file, you can gain insights into the communication patterns, identify potential malicious activities (e.g., domain generation algorithms, command and control servers), and uncover valuable information for further investigation.

Remember to consider the context and cross-reference DNS information with other network artifacts to get a comprehensive understanding of the network traffic and potential security incidents.

#Get info about each DNS request performed
cat dns.log | zeek-cut -c id.orig_h query qtype_name answers

#Get the number of times each domain was requested and get the top 10
cat dns.log | zeek-cut query | sort | uniq | rev | cut -d '.' -f 1-2 | rev | sort | uniq -c | sort -nr | head -n 10

#Get all the IPs
cat dns.log | zeek-cut id.orig_h query | grep 'example\.com' | cut -f 1 | sort | uniq -c

#Sort the most common DNS record request (should be A)
cat dns.log | zeek-cut qtype_name | sort | uniq -c | sort -nr

#See top DNS domain requested with rita
rita show-exploded-dns -H --limit 10 zeek_logs

vItlhutlh

{% content-ref url="dnscat-exfiltration.md" %} dnscat-exfiltration.md {% endcontent-ref %}

{% content-ref url="wifi-pcap-analysis.md" %} wifi-pcap-analysis.md {% endcontent-ref %}

{% content-ref url="usb-keystrokes.md" %} usb-keystrokes.md {% endcontent-ref %}

​

RootedCON vItlhutlh Spain DaH Europe Daq yIqIm. technical knowledge promote vItlhutlh, 'ej 'oH congress 'e' vItlhutlh 'e' vItlhutlh 'e' technology 'ej cybersecurity professionals Hoch 'ej Hoch.

{% embed url="https://www.rootedcon.com/" %}

Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!

Other ways to support HackTricks: