Hello World, In this Blog post I will gonna Introduce to Analyzing Malware Pcaps using Wireshark by going through a challenge from (CyberDefenders).
In This Challenge we are given 14 Questions we will go through each question and seeing how to solve it in details.
Intro to Exploit Kits:
Before we deep dive and solve this challenge its good to know what really exploit kits are and how do they work. Exploit Kits are Collection of Exploits mostly operates by searching for vulnerable browser-based applications like websites they exploits vulnerabilities in these websites and then deliver malwares and payloads. Questions that should be answered when Analyzing a Exploit Kit PCAP is What is the Infected Website as we said there should be a website that has been infected other questions may be like what is the ip address of the infected machine ?, what is the website that redirects to the exploit kit deliverer etc... This is My First Attempt to analyze an Exploit Kit so correct if I was wrong or sth. For the sake of this challenge I used Wireshark and Virus Total.
What is the IP address of the Windows VM that gets infected?
typically in exploit kits the infected website will make so many http request with other websites u can filter with (http.request) so here we can see that 172.16.165.165 is the source for all of this http traffic so we can assume that its the infected website.
answer: 172.16.165.165
What is the IP address of the compromised web site?
we can filter with (http.request) and see the packets:
we can see many get requests to IP Address 82.150.140.30 and most likely this is the infected
website we can see the domain name by double clicking u can see its coming from
http://www.ciniholland.nl/
or u can upload the pcap to virus total go to detials under dns requests u
see the ip address of the the infected website:
What is the domain name of the compromised web site?
this should be simple we already answered it above
answer: www.ciniholland.nl
What is the IP address of the server that delivered the exploit kit and malware?
for this question I Choosed to use virus total go to details and then under Interesting
HTTP Requests we can see two requests from http://stand.trustandprobaterealty.com we
its delivering two flash exploits coming from IP Address 37.200.69.143:80
answer: 37.200.69.143
What is the domain name that delivered the exploit kit and malware?
this also should be simple we can see it from virus total
answer: stand.trustandprobaterealty.com
What is the redirect URL that points to the exploit kit (EK) landing page?
I can assume that the how it will the referred website will be in an html file so
we can see the packets with content type (html/text) I mean sth like:
We Can't Be Sure So I Checked Most of Them and Found one by Right
Clicking Follow HTTP Stream
it refers to the website http://stand.trustandprobaterealty.com/ that delivers the
payload seeing the seeing the host field we can see it comes the the referrer is
24corp-shop.com/.
answer: http://24corp-shop.com/ (because he needs the full url not only the domain)
Other than CVE-2013-2551 IE exploit, what other exploit(s) sent by the EK?
we already see in question 6 that http://stand.trustandprobaterealty.com
delivered two flash exploits we can also see by going to Export Objects (HTTP)
another two Java Exploits
also the hint box can really hint us to this u can also check save this files and check them on virus total.
answer: Flash,Java
What is the hostname of the Windows VM that gets infected?
This Question can be solved by filtering with (nbns OR bootp) and this approach
will answer also the third question (What is the MAC address of the infected VM?) using nbns:
U Can See The Name under NetBios Name Service ==> Additional records ==> Name and
answer: K34EN6W3N-PC.
What is the Mac Address of the Infected VM:Filtering with (bootp) we can see the mac address and the hostname under Dynamic Host Configuration Protocol ==> Client Mac Address
answer: f0:19:af:02:9b:f1
|
|
How many times was the payload delivered?
The Payload here was file with mime (x-msdownload). we can answer this
question using two approaches first one we go to Export Objects (HTTP)
and count them they see they are three
or by filtering with http.content_type == "application/x-msdownload"
answer: 3
|
