Sans Forensics Challenge Puzzle - 6

Had been switching jobs which has kept myself busy from updating the blog. But this time around I had made myself up with yet another post. Sans has hosted a fantastic puzzle, this time around on APT. The puzzle is a pcap file that contains a zero day exploit for IE (most commonly AURORA - ms_10_002). Quite an exciting puzzle I must say. Lets get things rolling,

Q1. What was the full URI of Vick Timmes' original web request? (Please include the port in your URI.)

When we first load the pcap in the wireshark we see that there are two hosts (ignoring those broadcasts address) - 10.10.10.10 (the attacker) and 10.10.10.70 (the victim).

At first glance we see that in the first we can see that the victim is requesting for index.php. We the request is constructed as http://10.10.10.10/index.php.And that particular is request is sent over the port 8080. Reconstructing the request by port will lead us to the answer for the first question - http://10.10.10.10:8080/index.php.

Q2.In response, the malicious web server sent back obfuscated JavaScript. Near the beginning of this code, the attacker created an array with 1300 elements labeled "COMMENT", then filled their data element with a string. What was the value of this string?

As a result of the request that was sent over the port 8080, the server responds with an html file with a certain javascript in it ;) The javascript starts with declaring an array as,

var qSNgVkOrdIjaiFpPTfDjbPHQppHSGtzpmOOyqEbLEFxNqAxicRyZKKWiRWmUaDHFOuzHPHqLrRFSzQuPusTnQyqpQwVpARdlR = new Array();

following that inside a for loop it's data element is filled with a string like,

qSNgVkOrdIjaiFpPTfDjbPHQppHSGtzpmOOyqEbLEFxNqAxicRyZKKWiRWmUaDHFOuzHPHqLrRFSzQuPusTnQyqpQwVpARdlR[i].data = "vEI";

that answers our second question - vEI
Q3.Vick's computer made a second HTTP request for an object.

1. What was the filename of the object that was requested?
2. What is the MD5sum of the object that was returned?

Followed by the initial /index.php request another request is sent to the same server on the same port. This time around /index.phpmfKSxSANkeTeNrah.gif is requested. That answers Q3.a. The server responds with a series of data following the request from the client. If you filter the conversation and rip the hex data from the packet you should be getting the md5 hash as - df3e567d6f16d040326c7a0ea29a4f41 which answer Q3.b. Below is that data that is ripped from the packet.

0000000: 4749 4638 3961 0100 0100 8000 0000 0000 GIF89a..........
0000010: 0000 0021 f904 0100 0000 002c 0000 0000 ...!.......,....
0000020: 0100 0100 0002 0244 0100 3b .......D..;

Q4.When was the TCP session on port 4444 opened? (Provide the number of seconds since the beginning of the packet capture, rounded to tenths of a second. ie, 49.5 seconds)

Wireshark will help with with this ;) To filter off those communication that happened over port 4444 use the filter tcp.port eq 4444 and the first packet will tell us the answer ;) - 1.3

Q5.When was the TCP session on port 4444 closed? (Provide the number of seconds since the beginning of the packet capture, rounded to tenths of a second. ie, 49.5 seconds)

Again the same filter as used in Q4 will suffice for this question as well. The last packet in the window (when the filter tcp.port eq 4444 is used) is the answer to the question - 87.6

Q6.In packet 17, the malicious server sent a file to the client.

1. What type of file was it? Choose one:
   • Windows executable
   • GIF image
   • PHP script
   • Zip file
   • Encrypted data
2. What was the MD5sum of the file?

We move on to packet 17 in the wireshark window. Clicking on the packet and viewing the data tells us that the file that was transferred was a windows executable. The MZ header in the data stream gives that away indeed. So that answers Q6.a.

To answer Q6.b we got to extract the executable (dll to be specific ;)) from the data stream. There are lot of tools out there. But still preferring the manual way I just filter of the data stream from the server end to the client end and then manually carve out the file.



And you may question about the file size? That stream easily gives that away in the start - 00 6a 0b 00. When you convert them to decimal it should be 748032 bytes. That's the size of our file. When the complete dll is carved out you may notice that it is metsrv.dll (component of metasploit meterpreter). You may very well search for the text metsrv.dll in the packet and you are sure to hit atleast couple of them.

The MD5 hash is - b062cb8344cd3e296d8868fbef289c7c

Q7.Vick's computer repeatedly tried to connect back to the malicious server on port 4445, even after the original connection on port 4444 was closed. With respect to these repeated failed connection attempts:

a.How often does the TCP initial sequence number (ISN) change? (Choose one.)

• Every packetEvery 60 seconds
• Every third packet
• Every 10-15 seconds
• Every 30-35 seconds

The answer is Every Third Packet. Look at the picture from wireshark for yourself.



b. How often does the IP ID change? (Choose one.)

• Every packet
• Every third packet
• Every 10-15 seconds
• Every 30-35 seconds
• Every 60 seconds

That happens on Every packet. when you look into each packet IP ID you can see that it changes from 0x01b3 to 0x01b4 and so on.

c.How often does the source port change? (Choose one.)

• Every packet
• Every third packet
• Every 10-15 seconds
• Every 30-35 seconds
• Every 60 seconds

When you filter those packets that are communicating over port 4445 you can see that from packet 1503 the source port remains to be on the same port 1040 till 1532 and changes the port on the packet 1533. If we calculate the time between those packet range we would get 82.9 - 71.2 which is like 10-15 seconds difference between the switch over of ports.

Q8.Eventually, the malicious server responded and opened a new connection. When was the TCP connection on port 4445 first successfully completed? (Provide the number of seconds since the beginning of the packet capture, rounded to tenths of a second. ie, 49.5 seconds)

We prepare another filter for this purpose to check when did the compelete 3 way handshake complete between the two hosts on port 4445. The below filter when applied on wireshark will get you the result.

tcp.port eq 4445 and tcp.flags eq 18

That returns a single packet which has the timestamp as 123.7 which answers Q.8

Q9.Subsequently, the malicious server sent an executable file to the client on port 4445. What was the MD5 sum of this executable file?

The executable that was sent over on port 4445 is same as the earlier executable. The MD5 hash is - b062cb8344cd3e296d8868fbef289c7c

Q10.When was the TCP connection on port 4445 closed? (Provide the number of seconds since the beginning of the packet capture, rounded to tenths of a second. ie, 49.5 seconds)

The connection was closed at 198.4
You may very well use the below filter to fetch the answer, but then only the 2nd packet (when the filter is applied) to be considered
tcp.port eq 4445 and tcp.flags eq 17
That answers all the question, meet you in another post.

-binaryhax0r

Ann's Bail - ForensicContest.com

After quite a long time I’m writing my next blog post. This time it’s around analyzing packets that was part of puzzle that was posted as a part of the Network Forensics contest in http://forensicscontest.com/2009/10/10/puzzle-2-ann-skips-bail.

Below are the questions that were raised as a part of the contest and the answers for those are found within the pcap file that was posted in the same site. Let’s try and find those answers as well! Quickly we load the pcap file onto Wireshark and we find that there is quite an amount of noise that distracts us. To answer the first question,

What is Ann’s email address?

We dig the pcap file deeper and find that there’s a connection that is established with an ESMTP server (64.12.102.142) as below

This should clarify the first question that was asked, further digging deeper we find that there’s authentication that is happening with the ESMTP server on port 587 (Refer RFC 2476).

Quickly referring to the RFC 4954 regarding SMTP Service Extension for Authentication we can understand that the server sends 334 reply with the text part containing the BASE64 encoded string. Now we log on to our favorite site and convert the text returned by the server - VXNlcm5hbWU6. We find that the server is looking for a Username:. The user then inputs the value c25lYWt5ZzMza0Bhb2wuY29t which is converted to plain text as sneakyg33k@aol.com. That answers our first question! Let’s move one, the next question is,

What is Ann’s email password?

We still follow the same TCP stream and get to a point where the server looks for a Password: by returning the BASE64 encoded string - UGFzc3dvcmQ6. The client (Ann) then types in her password which in the pcap file is BASE64 encoded as NTU4cjAwbHo= which resolves to plain text - 558r00lz which has answered the second question!

We move on to the next question,

What is Ann’s secret lover’s email address?

We continue digging into the pcap file and find a second session that has Ann has made with the ESMTP server. This time may be to send some information to her secret lover? Let’s find,

We could see the same kind of traffic that we encountered and then we could witness that Ann has specified the recipient address as mistersecretx@aol.com that answers our 3^rd question. Moving on….

What two items did Ann tell her secret lover to bring?

We drill into the details of the conversation between Ann and the server and we follow the TCP Stream and we find this

We could see that she has asked him to bring the fake passport and a bathing suit. We also could see that she has attached the address with the email. That answers the 4^th question. Next question is a bit easy for which we seek the help of same Follow TCP Stream in Wireshark.

What is the NAME of the attachment Ann sent to her secret lover?

From the above figure we can understand the attached file to be secretrendezvous.docx. The next part is a bit tricky but an easy one if you have read the RFC that was pointed out earlier in this blog.

What is the MD5sum of the attachment Ann sent to her secret lover?

Beneath the filename (still in Follow TCP Stream) we notice a strange set of characters which is nothing but plain text encoded in BASE64 format. We copy all of them but them in our favorite converter and the result is a DOCX file. I use an online converter - http://www.motobit.com/util/base64-decoder-encoder.asp

When we get the complete DOCX file we do an MD5sum of it and get the result

9e423e11db88f01bbff81172839e1923 *AnnSecretDoc.docx

And inside the DOC is the answer to the next question,

In what CITY and COUNTRY is their rendez-vous point?

We are still left with the last question,

What is the MD5sum of the image embedded in the document?

For this particular question we either carve the image out of the DOCX file or we use an automated tool that could do the job for us. In this case Foremost. We carve out the file using Foremost like,

Foremost AnnSecretDoc.docx

Which will result in a png file worth 189KB that has an MD5 hash aadeace50997b1ba24b09ac2ef1940b7.

That concludes this post in the blog. See you soon in another post, till then cya – binaryhax0r