View difference between Paste ID: 4kEaB1x5 and SwgnkAhQ

-##########
+##############################
-# VMWare #
+# Intro to Routing/Switching #
-##########
+##############################
-- For this workshop you'll need the latest version of VMWare Workstation (Windows), Fusion (Mac), or Player.
+
 http://www.brianlinkletter.com/imunes-on-linux/
-- http://www.vmware.com/ap/products/player.html
+
 
 sudo apt-get install -y openvswitch-switch xterm wireshark ImageMagick tcl tcllib tk user-mode-linux
-- Although you can get the VM to run in VirtualBox, I will not be supporting this configuration for this class.
+
 wget -qO- https://get.docker.com/ | sh
 
 sudo usermod -aG docker strategicsec
-#########################
+
-# Class Virtual Machine #
+sudo service docker start
-#########################
+
 sudo docker run -v /usr/local/bin:/target jpetazzo/nsenter
 
-Here is the VMWare virtual machine for the class:
+sudo git clone https://github.com/imunes/imunes.git
 
-https://s3.amazonaws.com/infosecaddictsvirtualmachines/InfoSecAddictsVM.zip
+cd imunes
-user:      infosecaddicts
+
-pass:      infosecaddicts
+sudo make install
 
 sudo imunes -p
 
 sudo imunes
 
----------------------------Type This-----------------------------------
+
-cd ~/Desktop/
+
 Now build the following topologies referenced here:
-mkdir suspiciouspcap/
+http://www.technig.com/packet-tracer-ccna-practical-labs/
 
-cd suspiciouspcap/
+
 
-wget https://s3.amazonaws.com/infosecaddictsfiles/suspicious-time.pcap
+
 # Intro to IPv6 #
-wget https://s3.amazonaws.com/infosecaddictsfiles/chaosreader.pl
+
 Reference:
 https://www.linux.com/learn/ipv6-crash-course-linux
 https://www.digitalocean.com/community/tutorials/how-to-configure-tools-to-use-ipv6-on-a-linux-vps
 http://www.tomicki.net/ipv6.router.php
 
 ####################
 # Intro to TCPDump #
 ####################
 http://www.binarytides.com/tcpdump-tutorial-sniffing-analysing-packets/
 
 sudo apt-get install tcpdump
-for i in session_00[0-9]*.http.html; do srcip=`cat "$i" | grep 'http:\ ' | awk '{print $2}' |  cut -d ':' -f1`; dstip=`cat "$i" | grep 'http:\ ' | awk '{print $4}' |  cut -d ':' -f1`; host=`cat "$i" | grep 'Host:\ ' | sort -u | sed -e 's/Host:\ //g'`; echo "$srcip --> $dstip = $host";  done | sort -u
+
-------------------------------------------------------------------------
+
 
 Basic sniffing
 
 sudo tcpdump -n
 
 
----------------------------Type This-----------------------------------
+
 sudo tcpdump -v -n
 
 
 
 Getting the ethernet header (link layer headers)
---------------
+
----------------------------Type This-----------------------------------
+
 sudo tcpdump -vv -n -e
 
 
 Sniffing a particular interface
----------------------------Type This-----------------------------------
+
 In order to sniff a particular network interface we must specify it with the -i switch. First lets get the list of available interfaces using the -D switch.
 sudo tcpdump -D
 
 
 Filtering packets using expressions
-------------------------------------------------
+Selecting protocols
 
----------------------------Type This-----------------------------------
+
 
-------------------------------------------------------------------------
+
 Particular host or port
 
--------------------------------
+
 
----------------------------Type This-----------------------------------
+
 
-------------------------------------------------------------------------
+
 Next example picks up dns request packets, either those packets which originate from local machine and go to port 53 of some other machine.
-Filtering packets using expressions - Selecting protocols
+
----------------------------------------------------------
+
----------------------------Type This-----------------------------------
+
 
-------------------------------------------------------------------------
+
 
 $ sudo tcpdump 'src 192.168.1.100 and dst 192.168.1.2 and port ftp'
------------------------
+
 
----------------------------Type This-----------------------------------
+
 
-------------------------------------------------------------------------
+
 
 $ sudo tcpdump -n -A | grep -e 'POST'
----------------------------Type This-----------------------------------
+
 
-------------------------------------------------------------------------
+
 Here is quick example to sniff passwords using egrep
 
----------------------------Type This-----------------------------------
+
 tcpdump port http or port ftp or port smtp or port imap or port pop3 -l -A | egrep -i 'pass=|pwd=|log=|login=|user=|username=|pw=|passw=|passwd=|password=|pass:|user:|username:|password:|login:|pass |user ' --color=auto --line-buffered -B20
-------------------------------------------------------------------------
+
 
 ####################
 # Advanced TCPDump #
 ####################
----------------------------Type This-----------------------------------
+https://danielmiessler.com/study/tcpdump/
 
-------------------------------------------------------------------------
+-i any : Listen on all interfaces just to see if you’re seeing any traffic.
 -i eth0 : Listen on the eth0 interface.
 -D : Show the list of available interfaces
 -n : Don’t resolve hostnames.
 -nn : Don’t resolve hostnames or port names.
----------------------------Type This-----------------------------------
+-q : Be less verbose (more quiet) with your output.
 -X : Show the packet’s contents in both hex and ASCII.
-------------------------------------------------------------------------
+-XX : Same as -X, but also shows the ethernet header.
 -v, -vv, -vvv : Increase the amount of packet information you get back.
 -c : Only get x number of packets and then stop.
 icmp : Only get ICMP packets.
 -s : Define the snaplength (size) of the capture in bytes. Use -s0 to get everything, unless you are intentionally capturing less.
 -S : Print absolute sequence numbers.
 -e : Get the ethernet header as well.
 -q : Show less protocol information.
 -E : Decrypt IPSEC traffic by providing an encryption key.
----------------------------Type This-----------------------------------
+
 
-------------------------------------------------------------------------
+
 Basic communication // see the basics without many options
 # tcpdump -nS
----------------------------Type This-----------------------------------
+
 Basic communication (very verbose) // see a good amount of traffic, with verbosity and no name help
-------------------------------------------------------------------------
+# tcpdump -nnvvS
 
 A deeper look at the traffic // adds -X for payload but doesn’t grab any more of the packet
 # tcpdump -nnvvXS
 
 Heavy packet viewing // the final “s” increases the snaplength, grabbing the whole packet
 # tcpdump -nnvvXSs 1514
----------------------------Type This-----------------------------------
+
 Here’s a capture of exactly two (-c2) ICMP packets (a ping and pong) using some of the options described above. Notice how much we see about each packet.
-------------------------------------------------------------------------
+
 hermes root # tcpdump -nnvXSs 0 -c2 icmp
 
 
----------------------------Type This-----------------------------------
+host // look for traffic based on IP address (also works with hostname if you’re not using -n)
 # tcpdump host 1.2.3.4
-------------------------------------------------------------------------
+
 
 src, dst // find traffic from only a source or destination (eliminates one side of a host conversation)
 # tcpdump src 2.3.4.5
----------------------------Type This-----------------------------------
+# tcpdump dst 3.4.5.6
 
 
 net // capture an entire network using CIDR notation
-------------------------------------------------------------------------
+# tcpdump net 1.2.3.0/24
 
 
-(SMTP).
+proto // works for tcp, udp, and icmp. Note that you don’t have to type proto
----------------------------Type This-----------------------------------
+# tcpdump icmp
 
 
 port // see only traffic to or from a certain port
-------------------------------------------------------------------------
+# tcpdump port 3389
 
 src, dst port // filter based on the source or destination port
 # tcpdump src port 1025 # tcpdump dst port 389
 
 src/dst, port, protocol // combine all three
 # tcpdump src port 1025 and tcp
 # tcpdump udp and src port 53
 
----------------------------Type This-----------------------------------
+
 You also have the option to filter by a range of ports instead of declaring them individually, and to only see packets that are above or below a certain size.
 
 Port Ranges // see traffic to any port in a range
 tcpdump portrange 21-23
 
 Packet Size Filter // only see packets below or above a certain size (in bytes)
 tcpdump less 32
 tcpdump greater 128
 [ You can use the symbols for less than, greater than, and less than or equal / greater than or equal signs as well. ]
 
 // filtering for size using symbols
 tcpdump > 32
 tcpdump <= 128
 
 
 The traffic captured in this way is stored in tcpdump format, which is pretty much universal in the network analysis space. This means it can be read in by all sorts of tools, including Wireshark, Snort, etc.
 
 Capture all Port 80 Traffic to a File
 
 # tcpdump -s 1514 port 80 -w capture_file
 
 Then, at some point in the future, you can then read the traffic back in like so:
 
 Read Captured Traffic back into tcpdump
 
 # tcpdump -r capture_file
 
 Getting Creative
 
 Expressions are nice, but the real magic of tcpdump comes from the ability to combine them in creative ways in order to isolate exactly what you’re looking for. There are three ways to do combinations, and if you’ve studied computers at all they’ll be pretty familar to you:
 
 AND
 and or &&
 OR
 or or ||
 EXCEPT
 not or !
 More Examples
 
 # TCP traffic from 10.5.2.3 destined for port 3389
 
 tcpdump -nnvvS src 10.5.2.3 and dst port 3389
 
 # Traffic originating from the 192.168 network headed for the 10 or 172.16 networks
 
 tcpdump -nvX src net 192.168.0.0/16 and dst net 10.0.0.0/8 or 172.16.0.0/16
----------------------------Type This-----------------------------------
+
-cd ~/Desktop/suspiciouspcap/
+# Non-ICMP traffic destined for 192.168.0.2 from the 172.16 network
 
 tcpdump -nvvXSs 1514 dst 192.168.0.2 and src net and not icmp
 
-sudo pip install cmd2==0.7.9
+# Traffic originating from Mars or Pluto that isn’t to the SSH port
 
 tcpdump -vv src mars and not dst port 22
-python forensicPCAP.py suspicious-time.pcap
+
-------------------------------------------------------------------------
+As you can see, you can build queries to find just about anything you need. The key is to first figure out precisely what you’re looking for and then to build the syntax to isolate that specific type of traffic.
 
 Grouping
----------------------------Type This-----------------------------------
+
 Also keep in mind that when you’re building complex queries you might have to group your options using single quotes. Single quotes are used in order to tell tcpdump to ignore certain special characters — in this case the “( )” brackets. This same technique can be used to group using other expressions such as host, port, net, etc. Take a look at the command below:
-------------------------------------------------------------------------
+
 # Traffic that’s from 10.0.2.4 AND destined for ports 3389 or 22 (incorrect)
 
----------------------------Type This-----------------------------------
+tcpdump src 10.0.2.4 and (dst port 3389 or 22)
 
-------------------------------------------------------------------------
+If you tried to run this otherwise very useful command, you’d get an error because of the parenthesis. You can either fix this by escaping the parenthesis (putting a \ before each one), or by putting the entire command within single quotes:
 
 # Traffic that’s from 10.0.2.4 AND destined for ports 3389 or 22 (correct)
----------------------------Type This-----------------------------------
+
 tcpdump ‘src 10.0.2.4 and (dst port 3389 or 22)’
 
 Advanced
-------------------------------------------------------------------------
+
 You can also filter based on specific portions of a packet, as well as combine multiple conditions into groups. The former is useful when looking for only SYNs or RSTs, for example, and the latter for even more advanced traffic isolation.
 
----------------------------Type This-----------------------------------
+[ Hint: An anagram for the TCP flags: Unskilled Attackers Pester Real Security Folk ]
 
 Show me all URGENT (URG) packets…
 
----------------------------Type This-----------------------------------
+# tcpdump ‘tcp[13] & 32!=0‘
 
 Show me all ACKNOWLEDGE (ACK) packets…
----------------------------Type This-----------------------------------
+
 # tcpdump ‘tcp[13] & 16!=0‘
 
 Show me all PUSH (PSH) packets…
-------------------------------------------------------------------------
+
 # tcpdump ‘tcp[13] & 8!=0‘
 
 Show me all RESET (RST) packets…
 
 # tcpdump ‘tcp[13] & 4!=0‘
-------------------------------------------------------------------------
+
 Show me all SYNCHRONIZE (SYN) packets…
 
 # tcpdump ‘tcp[13] & 2!=0‘
----------------------------Type This-----------------------------------
+
 Show me all FINISH (FIN) packets…
 
 # tcpdump ‘tcp[13] & 1!=0‘
-------------------------------------------------------------------------
+
 Show me all SYNCHRONIZE/ACKNOWLEDGE (SYNACK) packets…
 
 # tcpdump ‘tcp[13]=18‘
 
 [ Note: Only the PSH, RST, SYN, and FIN flags are displayed in tcpdump‘s flag field output. URGs and ACKs are displayed, but they are shown elsewhere in the output rather than in the flags field ]
 
-# Understanding Snort rules #
+Keep in mind the reasons these filters work. The filters above find these various packets because tcp[13] looks at offset 13 in the TCP header, the number represents the location within the byte, and the !=0 means that the flag in question is set to 1, i.e. it’s on.
 
-Field 1: Action - Snort can process events in 1 of 3 ways (alert, log, drop)
+As with most powerful tools, however, there are multiple ways to do things. The example below shows another way to capture packets with specific TCP flags set.
 
-Field 2: Protocol - Snort understands a few types of traffic (tcp, udp, icmp)
+Capture TCP Flags Using the tcpflags Option…
 
-Field 3: Source IP (can be a variable like $External_Net, or an IP, or a range)
+# tcpdump ‘tcp[tcpflags] & & tcp-syn != 0‘
 
-Field 4: Source Port (can be a variable like $WebServer_Ports, or a port number, or a range of ports)
+Specialized Traffic
 
-Field 5: Traffic Direction (->)
+Finally, there are a few quick recipes you’ll want to remember for catching specific and specialized traffic, such as IPv6 and malformed/likely-malicious packets.
 
-Field 6: Destination IP (can be a variable like $External_Net, or an IP, or a range)
+IPv6 traffic
 
-Field 7: Destination Port (can be a variable like $WebServer_Ports, or a port number, or a range of ports)
+# tcpdump ip6
 
-Field 8: MSG - what is actually displayed on the analysts machine
+Packets with both the RST and SYN flags set (why?)
 
 # tcpdump ‘tcp[13] = 6’
-Let's look at 2 simple rules
+
-----------------------------------------------------------------------------------
+Traffic with the ‘Evil Bit’ Set
-alert tcp $EXTERNAL_NET any -> $HOME_NET 135 (msg:”NETBIOS DCERPC ISystemActivator \
+
-bind attempt”; flow:to_server,established; content:”|05|”; distance:0; within:1; \
+# tcpdump ‘ip[6] & 128 != 0‘
-content:”|0b|”; distance:1; within:1; byte_test:1,&,1,0,relative; content:”|A0 01 00 \
+
-00 00 00 00 00 C0 00 00 00 00 00 00 46|”; distance:29; within:16; \
+
-reference:cve,CAN-2003-0352; classtype:attempted-admin; sid:2192; rev:1;)
+
 # NGrep #
-alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:”NETBIOS SMB DCERPC ISystemActivator bind \
+
-attempt”; flow:to_server,established; content:”|FF|SMB|25|”; nocase; offset:4; \
+http://www.binarytides.com/search-network-traffic-ngrep-tutorial/
-depth:5; content:”|26 00|”; distance:56; within:2; content:”|5c \
+
-00|P|00|I|00|P|00|E|00 5c 00|”; nocase; distance:5; within:12; content:”|05|”; \
+
-distance:0; within:1; content:”|0b|”; distance:1; within:1; \
+
-byte_test:1,&,1,0,relative; content:”|A0 01 00 00 00 00 00 00 C0 00 00 00 00 00 00 \
+
-46|”; distance:29; within:16; reference:cve,CAN-2003-0352; classtype:attempted-admin; \
+
-sid:2193; rev:1;)
+
-----------------------------------------------------------------------------------
+
 
 In the above command :
 a) tcp and port 80 - is the bpf filter (Berkeley Packet Filter) , that sniffs only TCP packet with port number 80
-From your Linux machine ping your Windows machine
+
----------------------------Type This-----------------------------------
+
-ping 192.168.150.1
+
------------------------------------------------------------------------
+
 
 $ sudo ngrep -l -q -d eth0 "^GET |^POST " tcp and port 80
-Start wireshark and let's create some simple filters:
+
 The l option makes the output buffered and the q option is for quiet ( Be quiet; don't output any information other than packet headers and their payloads (if relevant) ).
-Filter 1:
+
----------------------------Type This-----------------------------------
+
-ip.addr==192.168.150.1
+
------------------------------------------------------------------------
+
 
-Filter 2:
+
----------------------------Type This-----------------------------------
+
-ip.addr==192.168.150.1 && icmp
+
------------------------------------------------------------------------
+
 $ sudo ngrep -d any port 25
 This will let you monitor all activity crossing source or destination port 25
-Filter 3:
+(SMTP).
----------------------------Type This-----------------------------------
+
-ip.addr==192.168.150.1 && !(tcp.port==22)
+
------------------------------------------------------------------------
+
-Now stop your capture and restart it (make sure you keep the filter)
+
 
 
 ###############
 # NTop Basics #
-Back to your Linux machine:
+###############
-[ CTRL-C ] - to stop your ping
+
----------------------------Type This-----------------------------------
+https://www.maketecheasier.com/install-configure-ntop/
-wget http://downloads.securityfocus.com/vulnerabilities/exploits/oc192-dcom.c
+
 
 
-gcc -o exploit oc192-dcom.c
+
 # PCAP Analysis #
-./exploit
+
 cd /home/malware/Desktop/Browser\ Forensics
 
-./exploit -d 192.168.150.1 -t 0
+ls | grep pcap
- -----------------------------------------------------------------------
+
 perl chaosreader.pl suspicious-time.pcap
 
 firefox index.html
-Now go back to WireShark and stop the capture.
+
 cat index.text | grep -v '"' | grep -oE "([0-9]+\.){3}[0-9]+.*\)"
 
 cat index.text | grep -v '"' | grep -oE "([0-9]+\.){3}[0-9]+.*\)" | awk '{print $4, $5, $6}' | sort | uniq -c | sort -nr
-###############################################
+
-# Packet Analysis/Network Forensics Challenge #
+
-###############################################
+     malware
 
-In order to receive your certificate of proficiency you must complete all of the tasks covered in the Packet Analysis/Network Forensics pastebin (http://pastebin.com/SwgnkAhQ).
+
 for i in session_00[0-9]*.www.html; do srcip=`cat "$i" | grep 'www:\ ' | awk '{print $2}' |  cut -d ':' -f1`; dstip=`cat "$i" | grep 'www:\ ' | awk '{print $4}' |  cut -d ':' -f1`; host=`cat "$i" | grep 'Host:\ ' | sort -u | sed -e 's/Host:\ //g'`; echo "$srcip --> $dstip = $host";  done | sort -u
-Submit the results via email in an MS Word document with (naming convention example: YourFirstName-YourLastName-PA-NF-Challenge.docx)
+
 
 
 
 
-IMPORTANT NOTE:
+
-Your homework/challenge must be submitted via email to both (joe-at-strategicsec-.-com and kasheia-at-strategicsec-.-com) by Sunday October 23rd at midnight EST.
+
 #############################
 tshark -r suspicious-time.pcap | grep 'NB.*20\>' | sed -e 's/<[^>]*>//g' | awk '{print $3,$4,$9}' | sort -u
 
 
 tshark -r suspicious-time.pcap | grep 'NB.*1e\>' | sed -e 's/<[^>]*>//g' | awk '{print $3,$4,$9}' | sort -u
 
 
 tshark -r suspicious-time.pcap arp | grep has | awk '{print $3," -> ",$9}' | tr -d '?'
 
 
 tshark -r suspicious-time.pcap -Tfields -e "eth.src" | sort | uniq
 
 
 tshark -r suspicious-time.pcap -R "browser.command==1" -Tfields -e "ip.src" -e "browser.server" | uniq
 
 tshark -r suspicious-time.pcap -Tfields -e "eth.src" | sort |uniq
 
 tshark -r suspicious-time.pcap -qz ip_hosts,tree
 
 tshark -r suspicious-time.pcap -R "http.request" -Tfields -e "ip.src" -e "http.user_agent" | uniq
 
 tshark -r suspicious-time.pcap -R "dns" -T fields -e "ip.src" -e "dns.flags.response" -e "dns.qry.name"
 
 
 whois rapidshare.com.eyu32.ru
 
 whois sploitme.com.cn
 
 
 tshark -r suspicious-time.pcap -R http.request  -T fields -e ip.src -e ip.dst -e http.host -e http.request.uri | awk '{print $1," -> ",$2, "\t: ","http://"$3$4}'
 
 tshark -r suspicious-time.pcap -R http.request  -T fields -e ip.src -e ip.dst -e http.host -e http.request.uri | awk '{print $1," -> ",$2, "\t: ","http://"$3$4}' | grep -v -e '\/image' -e '.css' -e '.ico' -e google -e 'honeynet.org'
 
 tshark -r suspicious-time.pcap -qz http_req,tree
 
 tshark -r suspicious-time.pcap -R "data-text-lines contains \"<script\"" -T fields -e frame.number -e ip.src -e ip.dst
 
 tshark -r suspicious-time.pcap -R http.request  -T fields -e ip.src -e ip.dst -e http.host -e http.request.uri | awk '{print $1," -> ",$2, "\t: ","http://"$3$4}' | grep -v -e '\/image' -e '.css' -e '.ico'  | grep 10.0.3.15 | sed -e 's/\?[^cse].*/\?\.\.\./g'
 
 
 
 ######################################
 # PCAP Analysis with forensicPCAP.py #
 ######################################
 cd ~/Desktop
 wget https://raw.githubusercontent.com/madpowah/ForensicPCAP/master/forensicPCAP.py
 
 sudo easy_install cmd2
      malware
 
 python forensicPCAP.py Browser\ Forensics/suspicious-time.pcap
 
 ForPCAP >>> help
 
 
 Prints stats about PCAP
 ForPCAP >>> stat
 
 
 Prints all DNS requests from the PCAP file. The id before the DNS is the packet's id which can be use with the "show" command.
 ForPCAP >>> dns
 
 ForPCAP >>> show
 
 
 Prints all destination ports from the PCAP file. The id before the DNS is the packet's id which can be use with the "show" command.
 ForPCAP >>> dstports
 
 ForPCAP >>> show
 
 
 Prints the number of ip source and store them.
 ForPCAP >>> ipsrc
 
 ForPCAP >>> show
 
 
 Prints the number of web's requests and store them
 ForPCAP >>> web
 
 ForPCAP >>> show
 
 Prints the number of mail's requests and store them
 ForPCAP >>> mail
 
 ForPCAP >>> show
 
 
 ###############
 # Snort Build #
 ###############
 http://computer-outlines.over-blog.com/article-nids-snort-barnyard2-apache2-base-with-ubuntu-14-04-lts-123532107.html
 
 
 ###################
 # Surricata Build #
 ###################
 https://gist.github.com/cleesmith/3ae872eb46d1ea102667