View difference between Paste ID: DfqiGN7u and SwgnkAhQ

 ##########
 # VMWare #
 ##########
 - For this workshop you'll need the latest version of VMWare Workstation (Windows), Fusion (Mac), or Player.
 
 - http://www.vmware.com/ap/products/player.html
 
 
 - Although you can get the VM to run in VirtualBox, I will not be supporting this configuration for this class.
 
 
 
 #########################
 # Class Virtual Machine #
 #########################
 
 
 Here is the VMWare virtual machine for the class:
 
 https://s3.amazonaws.com/infosecaddictsvirtualmachines/InfoSecAddictsVM.zip
 user:      infosecaddicts
 pass:      infosecaddicts
 
 
-#################
+
-# PCAP Analysis #
+###################################
-#################
+# Setting up your virtual machine #
 # Note: run as root user          #
-cd ~/Desktop/
+###################################
 
-mkdir suspiciouspcap/
+
 Here is where we will setup all of the required dependencies for the tools we plan to install
-cd suspiciouspcap/
+
 apt update
 apt-get install -y libpcre3-dbg libpcre3-dev autoconf automake libtool libpcap-dev libnet1-dev libyaml-dev libjansson4 libcap-ng-dev libmagic-dev libjansson-dev zlib1g-dev libnetfilter-queue-dev libnetfilter-queue1 libnfnetlink-dev cmake make gcc g++ flex bison libpcap-dev libssl-dev unzip python-dev swig zlib1g-dev sendmail sendmail-bin prads tcpflow python-scapy python-yara tshark whois jq
 -----------------------------------------------------------------------
 
 
 
 
 Now we install Suricata
-firefox index.html
+
 wget https://www.openinfosecfoundation.org/download/suricata-4.0.5.tar.gz
 
 tar -zxvf suricata-4.0.5.tar.gz
 
 cd suricata-4.0.5
 
 ./configure --enable-nfqueue --prefix=/usr --sysconfdir=/etc --localstatedir=/var
 
 make
 
 make install
-####################
+
-# Intro to TCPDump #
+make install-conf
-####################
+
 cd rules
-sudo apt-get install tcpdump
+
 cp *.rules /etc/suricata/rules/
 
 cd /etc/suricata/
-Basic sniffing
+
---------------
+wget https://rules.emergingthreats.net/open/suricata-4.0/emerging.rules.tar.gz
 
-sudo tcpdump -n
+tar -zxvf emerging.rules.tar.gz
 -----------------------------------------------------------------------
 
-Now lets increase the display resolution of this packet, or get more details about it. The verbose switch comes in handy
+
 
-sudo tcpdump -v -n
+
 
 ##################################################################
 # Analyzing a PCAP Prads                                         #
-Getting the ethernet header (link layer headers)
+# Note: run as regular user                                      #
-------------------------------------------------
+##################################################################
-In the above examples details of the ethernet header are not printed. Use the -e option to print the ethernet header details as well.
+
 ---------------------------Type This-----------------------------------
-sudo tcpdump -vv -n -e
+cd ~
 
 mkdir pcap_analysis/
-Sniffing a particular interface
+
--------------------------------
+cd ~/pcap_analysis/
-In order to sniff a particular network interface we must specify it with the -i switch. First lets get the list of available interfaces using the -D switch.
+
 mkdir prads
-sudo tcpdump -D
+
 cd ~/pcap_analysis/prads
 
-Filtering packets using expressions - Selecting protocols
+
----------------------------------------------------------
+
 prads -r suspicious-time.pcap -l prads-asset.log
-$ sudo tcpdump -n tcp
+
 cat prads-asset.log | less
 
-Particular host or port
+cat prads-asset.log | grep SYN | grep -iE 'windows|linux'
------------------------
+
-Expressions can be used to specify source ip, destination ip, and port numbers. The next example picks up all those packets with source address 192.168.1.101
+cat prads-asset.log | grep CLIENT | grep -iE 'safari|firefox|opera|chrome'
 
-$ sudo tcpdump -n 'src 192.168.1.101'
+cat prads-asset.log | grep SERVER | grep -iE 'apache|linux|ubuntu|nginx|iis'
 -----------------------------------------------------------------------
 
-Next example picks up dns request packets, either those packets which originate from local machine and go to port 53 of some other machine.
+
 
-$ sudo tcpdump -n 'udp and dst port 53'
+
 ##################################
 # PCAP Analysis with ChaosReader #
-To display the FTP packets coming from 192.168.1.100 to 192.168.1.2
+# Note: run as regular user      #
 ##################################
-$ sudo tcpdump 'src 192.168.1.100 and dst 192.168.1.2 and port ftp'
+
 cd ~
 
-Search the network traffic using grep
+mkdir -p pcap_analysis/chaos_reader/
 
-Grep can be used along with tcpdump to search the network traffic. Here is a very simple example
+cd ~/pcap_analysis/chaos_reader/
 
-$ sudo tcpdump -n -A | grep -e 'POST'
+
 
 wget https://s3.amazonaws.com/infosecaddictsfiles/chaosreader.pl
-So what is the idea behind searching packets. Well one good thing can be to sniff passwords.
+
-Here is quick example to sniff passwords using egrep
+
 
 cat index.text | grep -v '"' | grep -oE "([0-9]+\.){3}[0-9]+.*\)"
-tcpdump port http or port ftp or port smtp or port imap or port pop3 -l -A | egrep -i 'pass=|pwd=|log=|login=|user=|username=|pw=|passw=|passwd=|password=|pass:|user:|username:|password:|login:|pass |user ' --color=auto --line-buffered -B20
+
 cat index.text | grep -v '"' | grep -oE "([0-9]+\.){3}[0-9]+.*\)" | awk '{print $4, $5, $6}' | sort | uniq -c | sort -nr
 
 
 for i in session_00[0-9]*.http.html; do srcip=`cat "$i" | grep 'http:\ ' | awk '{print $2}' |  cut -d ':' -f1`; dstip=`cat "$i" | grep 'http:\ ' | awk '{print $4}' |  cut -d ':' -f1`; host=`cat "$i" | grep 'Host:\ ' | sort -u | sed -e 's/Host:\ //g'`; echo "$srcip --> $dstip = $host";  done | sort -u
-#########
+
-# NGrep #
+python -m SimpleHTTPServer
-#########
+          ****** Open a web browser and browse the the IP address of your Linux machine port 8000 for the web page *****
 
-Install ngrep on Ubuntu
+
 
-$ sudo apt-get install ngrep
+
 
 
-Search network traffic for string "User-Agent: "
+
 
-$ sudo ngrep -d eth0 "User-Agent: " tcp and port 80
+
 
-In the above command :
+
-a) tcp and port 80 - is the bpf filter (Berkeley Packet Filter) , that sniffs only TCP packet with port number 80
+
-b) The d option specifies the interface to sniff. eth0 in this case.
+# Note: run as regular user #
-c) "User-Agent: " is the string to search for. All packets that have that string are displayed.
+
 ---------------------------Type This-----------------------------------
-2. Search network packets for GET or POST requests :
+cd ~/pcap_analysis/
 
-$ sudo ngrep -l -q -d eth0 "^GET |^POST " tcp and port 80
+mkdir tshark
 
-The l option makes the output buffered and the q option is for quiet ( Be quiet; don't output any information other than packet headers and their payloads (if relevant) ).
+cd ~/pcap_analysis/tshark
 
-3. ngrep without any options would simply capture all packets.
+
 
-$ sudo ngrep
+tshark -i ens3 -r suspicious-time.pcap -qz io,phs
 
 tshark -r suspicious-time.pcap -qz ip_hosts,tree
-Reference:
+
-https://dl.packetstormsecurity.net/papers/general/ngreptut.txt
+tshark -r suspicious-time.pcap -Y "http.request" -Tfields -e "ip.src" -e "http.user_agent" | uniq
 
-$ sudo ngrep -d eth0 -n 3
+tshark -r suspicious-time.pcap -Y "dns" -T fields -e "ip.src" -e "dns.flags.response" -e "dns.qry.name"
 
-$ sudo ngrep -d any port 25
+
 tshark -r suspicious-time.pcap -Y http.request  -T fields -e ip.src -e ip.dst -e http.host -e http.request.uri | awk '{print $1," -> ",$2, "\t: ","http://"$3$4}'
 
-This will let you monitor all activity crossing source or destination port 25
+
-(SMTP).
+
 whois sploitme.com.cn
-$ sudo ngrep -wi -d wlan0 'user|pass' port 6667
+
 tshark -r suspicious-time.pcap -Y http.request  -T fields -e ip.src -e ip.dst -e http.host -e http.request.uri | awk '{print $1," -> ",$2, "\t: ","http://"$3$4}' | grep -v -e '\/image' -e '.css' -e '.ico' -e google -e 'honeynet.org'
-$ sudo ngrep -wi -d any 'user|pass' port 21
+
 tshark -r suspicious-time.pcap -qz http_req,tree
 
 tshark -r suspicious-time.pcap -Y "data-text-lines contains \"<script\"" -T fields -e frame.number -e ip.src -e ip.dst
 
 tshark -r suspicious-time.pcap -Y http.request  -T fields -e ip.src -e ip.dst -e http.host -e http.request.uri | awk '{print $1," -> ",$2, "\t: ","http://"$3$4}' | grep -v -e '\/image' -e '.css' -e '.ico'  | grep 10.0.3.15 | sed -e 's/\?[^cse].*/\?\.\.\./g'
 ------------------------------------------------------------------------
 
 
 
 
-sudo tshark -i eth0 -r suspicious-time.pcap -qz io,phs
+
 
 
-tshark -r suspicious-time.pcap | grep 'NB.*20\>' | sed -e 's/<[^>]*>//g' | awk '{print $3,$4,$9}' | sort -u
+###############################
 # PCAP Analysis with Suricata #
 # Note: run as root           #
-tshark -r suspicious-time.pcap | grep 'NB.*1e\>' | sed -e 's/<[^>]*>//g' | awk '{print $3,$4,$9}' | sort -u
+###############################
 ---------------------------Type This-----------------------------------
 cd /home/joe/pcap_analysis/
-tshark -r suspicious-time.pcap arp | grep has | awk '{print $3," -> ",$9}' | tr -d '?'
+
 mkdir suricata
 
-tshark -r suspicious-time.pcap -Tfields -e "eth.src" | sort | uniq
+cd suricata/
 
 wget https://s3.amazonaws.com/infosecaddictsfiles/suspicious-time.pcap
-tshark -r suspicious-time.pcap -R "browser.command==1" -Tfields -e "ip.src" -e "browser.server" | uniq
+
 mkdir suri
-tshark -r suspicious-time.pcap -Tfields -e "eth.src" | sort |uniq
+
 suricata -c /etc/suricata/suricata.yaml -r suspicious-time.pcap -l suri/
 
 cd suri/
-tshark -r suspicious-time.pcap -R "http.request" -Tfields -e "ip.src" -e "http.user_agent" | uniq
+
 cat stats.log | less
-tshark -r suspicious-time.pcap -R "dns" -T fields -e "ip.src" -e "dns.flags.response" -e "dns.qry.name"
+
 cat eve.json |grep -E "e\":\"http"|jq ".timestamp,.http"|csplit - /..T..:/ {*}
 
 cat xx01
 
 cat xx02
 
 cat xx03
-tshark -r suspicious-time.pcap -R http.request  -T fields -e ip.src -e ip.dst -e http.host -e http.request.uri | awk '{print $1," -> ",$2, "\t: ","http://"$3$4}'
+
 cat xx04
-tshark -r suspicious-time.pcap -R http.request  -T fields -e ip.src -e ip.dst -e http.host -e http.request.uri | awk '{print $1," -> ",$2, "\t: ","http://"$3$4}' | grep -v -e '\/image' -e '.css' -e '.ico' -e google -e 'honeynet.org'
+
 cat xx05
 
 cat xx06
-tshark -r suspicious-time.pcap -R "data-text-lines contains \"<script\"" -T fields -e frame.number -e ip.src -e ip.dst
+------------------------------------------------------------------------
 
-tshark -r suspicious-time.pcap -R http.request  -T fields -e ip.src -e ip.dst -e http.host -e http.request.uri | awk '{print $1," -> ",$2, "\t: ","http://"$3$4}' | grep -v -e '\/image' -e '.css' -e '.ico'  | grep 10.0.3.15 | sed -e 's/\?[^cse].*/\?\.\.\./g'
+
 #############################
 # PCAP Analysis with Yara   #
 # Note: run as regular user #
-######################################
+
-# PCAP Analysis with forensicPCAP.py #
+
-######################################
+cd ~/pcap_analysis/
 
-cd ~/Desktop/suspiciouspcap/
+git clone https://github.com/kevthehermit/YaraPcap.git
 cd YaraPcap/
-wget https://raw.githubusercontent.com/madpowah/ForensicPCAP/master/forensicPCAP.py
+
 wget https://github.com/Yara-Rules/rules/archive/master.zip
-sudo pip install cmd2==0.7.9
+unzip master.zip
 cd rules-master/
 ls
-python forensicPCAP.py suspicious-time.pcap
+cat index.yar
 clear
 ./index_gen.sh
 cd ..
 mkdir matching_files/
-ForPCAP >>> help
+python yaraPcap.py rules-master/index.yar suspicious-time.pcap -s matching_files/
 whereis tcpflow
 vi yaraPcap.py        **** fix line 35 with correct path to tcpflow ****:q!
-Prints stats about PCAP
+python yaraPcap.py rules-master/index.yar suspicious-time.pcap -s matching_files/
 cd matching_files/
-ForPCAP >>> stat
+ls
 cat report.txt
 ------------------------------------------------------------------------
-Prints all DNS requests from the PCAP file. The id before the DNS is the packet's id which can be use with the "show" command.
+
 
-ForPCAP >>> dns
+
 #######################################################################################################
-ForPCAP >>> show
+# Analyzing C&C with Bro IDS and RITA                                                                 #
 # Run the following commands as root                                                                  #
 # References:                                                                                         #
-Prints all destination ports from the PCAP file. The id before the DNS is the packet's id which can be use with the "show" command.
+# https://www.vultr.com/docs/installing-bro-ids-on-ubuntu-16-04                                                          #
 # https://www.blackhillsinfosec.com/how-to-hunt-command-and-control-channels-using-bro-ids-and-rita/  #
-ForPCAP >>> dstports
+#######################################################################################################
 
-ForPCAP >>> show
+sh -c "echo 'deb http://download.opensuse.org/repositories/network:/bro/xUbuntu_16.04/ /' > /etc/apt/sources.list.d/bro.list"
 wget -nv http://download.opensuse.org/repositories/network:bro/xUbuntu_16.04/Release.key -O Release.key
 apt-key add - < Release.key
-Prints the number of ip source and store them.
+apt-get update
 apt-get install -y cmake make gcc g++ flex bison libpcap-dev libssl-dev python-dev swig zlib1g-dev sendmail sendmail-bin
-ForPCAP >>> ipsrc
+
 
-ForPCAP >>> show
+
 mkdir -p /root/Bro-IDS/
 cd /root/Bro-IDS/
-Prints the number of web's requests and store them
+wget https://www.bro.org/downloads/bro-2.5.2.tar.gz
-ForPCAP >>> web
+tar -xvzf bro-2.5.2.tar.gz
 cd bro-2.5.2
-ForPCAP >>> show
+./configure --prefix=/root/Bro-IDS
 make
 make install
 export PATH=/root/Bro-IDS/bin:$PATH
-Prints the number of mail's requests and store them
+
 
-ForPCAP >>> mail
+
 vi /root/Bro-IDS/etc/node.cfg
-ForPCAP >>> show
+/root/Bro-IDS/bin/broctl
 install
 exit
 /root/Bro-IDS/bin/broctl deploy
 
 
 
 
-# Understanding Snort rules #
+mkdir b_analysis/
 cd b_analysis/
-Field 1: Action - Snort can process events in 1 of 3 ways (alert, log, drop)
+bro -C -r suspicious-time.pcap local "Site::local_nets += { 10.0.0.0/8 }"
 ls -S dns.log
-Field 2: Protocol - Snort understands a few types of traffic (tcp, udp, icmp)
+cat conn.log | bro-cut uid id.orig_h id.resp_h duration | sort -nr -k4 | head -n 5
 
-Field 3: Source IP (can be a variable like $External_Net, or an IP, or a range)
+
 
-Field 4: Source Port (can be a variable like $WebServer_Ports, or a port number, or a range of ports)
+
 
-Field 5: Traffic Direction (->)
+
 
-Field 6: Destination IP (can be a variable like $External_Net, or an IP, or a range)
+
 git clone https://github.com/ocmdev/rita.git
-Field 7: Destination Port (can be a variable like $WebServer_Ports, or a port number, or a range of ports)
+
 cd rita/
-Field 8: MSG - what is actually displayed on the analysts machine
+
 chmod +x install.sh
 
-Let's look at 2 simple rules
+./install.sh
-----------------------------------------------------------------------------------
+
-alert tcp $EXTERNAL_NET any -> $HOME_NET 135 (msg:”NETBIOS DCERPC ISystemActivator \
+source ~/.bashrc
-bind attempt”; flow:to_server,established; content:”|05|”; distance:0; within:1; \
+
-content:”|0b|”; distance:1; within:1; byte_test:1,&,1,0,relative; content:”|A0 01 00 \
+systemctl start mongod
-00 00 00 00 00 C0 00 00 00 00 00 00 46|”; distance:29; within:16; \
+
-reference:cve,CAN-2003-0352; classtype:attempted-admin; sid:2192; rev:1;)
+rita import -i /root/btest/ -d suspicious-time
 
-alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:”NETBIOS SMB DCERPC ISystemActivator bind \
+rita analyze
-attempt”; flow:to_server,established; content:”|FF|SMB|25|”; nocase; offset:4; \
+
-depth:5; content:”|26 00|”; distance:56; within:2; content:”|5c \
+cd suspicious-time
-00|P|00|I|00|P|00|E|00 5c 00|”; nocase; distance:5; within:12; content:”|05|”; \
+
-distance:0; within:1; content:”|0b|”; distance:1; within:1; \
+python -m SimpleHTTPServer