Extracting files from a network traffic capture (PCAP)

When we are involved in an incident handling and we are in charge of analyzing a traffic capture in a pcap format related to an attack, one of the things we usually need to do is get the files which were downloaded. The reason is that we need to have a copy of the malware or the exploit to analyze it by reversing engineer or similar... 

We usually detect the original sources where these files were downloaded from just analyzing the pcap file, but they disappear in a short period of time from they were originally hosted. Because of that, we will need to extract them directly from the pcap file.

In this post, I will show you three different ways to achieve this goal using the the pcap hosted in Barracuda related to the www.php.net compromise which can be downloaded here:
http://barracudalabs.com/downloads/5f810408ddbbd6d349b4be4766f41a37.pcap

Wireshark

As you know, Wireshark is the most popular network protocol analyzer. It is capable of extracting all the files which were downloaded and captured.

If you load the pcap file in you Wireshark and use the command below...

http contains "in DOS mode"

... you can check that some executables were downloaded.

We are able to download all files which were downloaded like executables, pictures, javascripts, etc... by clicking File --> Export Objects --> HTTP and clicking on "Save all".

In the picture below shows you the files which are been recovered.

We use the command below to filter only the executables.

If we upload these files to Virustotal, we check that all of them have been categorized as malicious.

https://www.virustotal.com/en/file/d78fb2c23422471657a077ff68906d6f6b639d7b7b00ef269fa3a2ce1b38710a/analysis/

https://www.virustotal.com/en/file/816b21df749b17029af83f94273fe0fe480d25ee2f84fb25bf97d06a8fadefe4/analysis/

https://www.virustotal.com/en/file/3483a7264a3bef074d0c2715e90350ca1aa7387dee937679702d5ad79b0c84ca/analysis/

https://www.virustotal.com/en/file/5d651f449d12e6bc75a0c875b4dae19d8b3ec8b3933b6c744942b5763d5df08d/analysis/

https://www.virustotal.com/en/file/bd56609c386a6b5bc18254c7327d221af182193eee5008f6e405ab5c1215b070/analysis/

NetworkMinner

NetworkMiner is another Network Forensic Analysis Tool (NFAT) for Windows. Also, it can be installed on Linux using Mono. This tool is a great alternative to Wireshark if you just want to extract the files which were downloaded, look at the sessions, discover the DNS queries or get details about the mails detected from a pcap file.

Just loaded the traffic capture file, Network Minner downloads all files from it. Because of that, if you are using an Antivirus, It is possible it warns you if some file is detected as malicious.

You can find the folder where files have been recovered by right-clicking on a file and selecting "Open Folder". In the Picture below you can see this folder.

If we get the SHA256 checksum of the PE files, we can see that the results are exactly the same than using Wireshark. We have got the sames files.

Foremost

Foremost is a well known file carving tool. It was developed by the United States Air Force Office of Special Investigations and The Centre for Information Systems Security Studies and Research and now, it has been opened to the general public.

This tool has been designed to work on image files, such as those generated by dd, Safeback, Encase, etc, or directly on a drive...

Although I usually use Wireshark or NetworkMinner I have read some blogs where they describe how to use Foremost to extract files from a pcap file. For this, I have decided to use it in our example.

Just downloaded we extract all files from the pcap file, we execute the command in the picture below to extract all the files.

We can check that a "/output/exe" folder has been created containing six files.

But the checksum is different than we got with Wireshark or NetworkMinner. It seems like Foremost hasn't work well with the pcap file... For this reason I don't usually use it with a pcap file...

I've uploaded these files to my Cuckoo Sandbox and it seems to be corrupted because the files couldn't run properly...

The VirusTotal links below redirect you to the reports of the corrupted executables:

https://www.virustotal.com/en/file/2bcc5f03e1d63c5fab4aa362f6aecd43def44cc3c246effc13accb7b27b1bd45/analysis/

https://www.virustotal.com/en/file/647e4bbed78346eccc7c2d12826da5f17414110e52fb200ee55f2b8c5df533f1/analysis/

https://www.virustotal.com/en/file/38bc430e9d8656ee227e48236157e716b1d5038e83e53937cb534a5920d28c28/analysis/

https://www.virustotal.com/en/file/15964d7dd9644c8ce29fbcc4585b85394af10545ac2a2ba2315befe8e93b2a4d/analysis/

https://www.virustotal.com/en/file/32159b706d1addf63cdb1978291fc7222558d8fb7a3044775e242fba9661838d/analysis/

Read More

Stuxnet Trojan - Memory Forensics with Volatility | Part II

You can read the first part of this post here:

http://www.behindthefirewalls.com/2013/12/stuxnet-trojan-memory-forensics-with_16.html

DETECTING API CALLS

If we use the command below, we can see the strings of these exported files in order to try to locate some interesting words...

strings evidences/process.*

Thank to Volatility we can find the apihooks of this memory dump. In the picture below, you will see the apihooks related with the malicious process 1928.

python2 vol.py -f stuxnet.vmem malfind apihooks –p 1928

These calls are directly linked to the Stuxnet worm. You can read the article below from Symantec.

http://www.symantec.com/connect/blogs/w32stuxnet-installation-details

DETECTING MALICIOUS DRIVERS

With modscan we can pick up previously unloaded drivers and drivers that have been hidden/unlinked by rootkits.

python2 vol.py -f stuxnet.vmem modscan

The first driver draws our attention… Please, take notes of the “Base” value (0xb21d08000) because we will export it with the command bellow.

python2 vol.py -f stuxnet.vmem moddump --dump-dir evidences/ --base 0xb21d8000

We get the sha256 hash of this driver...

sha256sum evidences/driver.b21d8000.sys

...and we upload it to www.virustotal.com

Here you have the report where you will see that this drivers has been  recognized as malicious.

https://www.virustotal.com/en/file/6aa1f54fbd8c79a3109bfc3e7274f212e5bf9c92f740d5a194167ea940c3d06c/analysis/

We have just detected a malicious driver but I think that it’s necessary to look for more  drivers with a similar name in order to try to find a new ones...

python2 vol.py -f stuxnet.vmem modscan | grep mrx

Ok. Let’s go to export the second suspicious driver. We will follow the same steps as described above.

python2 vol.py -f stuxnet.vmem moddump --dump-dir evidences/ --base 0xf895a000

https://www.virustotal.com/en/file/6bc86d3bd3ec0333087141215559aec5b11b050cc49e42fc28c2ff6c9c119dbd/analysis/

We have just found two malicious drivers: mrxcls.sys and mrxnet.sys.

I checked with the same commands the other two drivers and they aren’t categorized as malicious files. This is the reason I haven't show you.

DETECTING REGISTER KEYS

In this section, we will detect the register keys that have been added to the computer. With the command below, we will see a lot of them.

strings stuxnet.vmem | grep –i mrx | grep -i Services

We can obtain valuable information about some of them with the next commands.

python2 vol.py -f stuxnet.vmem printkey -K 'ControlSet001\Services\MrxNet'

python2 vol.py stuxnet .vmem printkey -K 'ControlSet001\Services\MrxCls'

With these key registers, Stuxnet will be started in each computer restart.

Read More

Stuxnet Trojan - Memory Forensics with Volatility | Part I

Stuxnet could be the first advanced malware. It is thought that it was developed by the United States and Israel to attack Iran's nuclear facilities. It attacked Windows systems using a zero-day exploit and It was focused on SCADA systems in order to  affect critical infrastructures... Also, it may be spread from USB drivers. It is necessary a squad of highly capable programmers with depth of knowledge of industrial processes and an interest in attacking industrial infrastructure to develop this malware.

Kaspersky Lab concluded that the sophisticated attack could only have been conducted "with nation-state support" and a study of the spread of Stuxnet by Symantec says that it was spread to Iran (58.85%), Indonesia (18.22%), India (8.31%), Azerbaijan (2.57%)....

Thanks to Malware Cookbook we can download a memory dump from an infected host with this malware in the URL below: 

http://malwarecookbook.googlecode.com/svn/trunk/stuxnet.vmem.zip

Ok, let’s go. We are going to analyze it with Volatility.

STUXNET IMAGE INFO

First of all we want to get more info of the memory image. With the command below we can see the volatility suggested profile and when the image was dumped. In this case it was in 2011-06-03.

python2 vol.py -f stuxnet.vmem imageinfo

It is a good practice to export the profile WinXPSP3x86 in order not to specify more this profile in the Volatility commands.

export VOLATILITY_PROFILE=WinXPSP3x86

DETECTING MALICIOUS PROCESS

First of all, I usually want to know what process was running the computer when the memory was dumped.

Notice you will see that three lsass.exe processes were running… It draws our attention.

• lsass.exe Pid 680
• lsass.exe Pid 868
• lsass.exe Pid 1928

python2 vol.py -f stuxnet.vmem pslist

We know that lsass.exe is one of the first processes to start when Windows boots. Because of this, it’s normal that “lsass.exe” has a lower Pid. You can see when the three lsass.exe process started in the picture above:

• Pid 680 started at 2010-10-29 17:08:54
• Pid 868 started at 2011-06-03 04:26:55
• Pid 1928 started at 2011-06-03 04:26:55

You can see the “lsass.exe” with lower Pid (680) started in 2010 and the other ones with higher Pid (868 and 1928) started in 2011. It isn’t a normal behavior.

In the picture below we can notice that Winlogon.exe (Pid 624) started one of the “lsass.exe” process (Pid 680). This is a really good indication of which “lsass.exe” isn’t malicious, because Winlogon.exe always starts the real “lsass.exe”. The “lsass.exe” with Pid 868 and 1928 was started by the “services.exe” process. It isn’t a normal behavior. They could be malicious processes.

python2 vol.py -f stuxnet.vmem pstree | egrep '(services.exe|lsass.exe|winlogon.exe)'

We have just discovered two suspicious processes.

DETECTING MALICIOUS CONNECTIONS

It is really important to indentify if theses suspicious processes were making connections.  With the command below we can check it.

python2 vol.py -f stuxnet.vmem connections

No connections were establishing when the memory was dumped. Now, we are going to see the ports that were listening in the computer.

In the picture bellow you will see a “lsass.exe” with Pid 680 is bound to Port 500 and 4500, while “lsass.exe” with Pid 868 and the another one with Pid 1928 are not listening in these ports. It seems again that the “lsass.exe” with the PID 680 has a normal behavior because this process usually listens on these ports.

python2 vol.py -f stuxnet.vmem sockets

DETECTING DLL

The “lsass.exe” process with PID 680 appears to be a normal process… What’s happened with the other ones?

With the command below, we can check that “lsass.exe” with Pid 868 and Pid 1928 have a load lower DLLs.

python2 vol.py -f stuxnet.vmem dlllist –p 680 | wc –l

python2 vol.py -f stuxnet.vmem dlllist –p 868 | wc –l

python2 vol.py -f stuxnet.vmem dlllist –p 1928 | wc –l

Also, we can detect that the process with Pid 1928 has unlinked DLLs.

python2 vol.py -f stuxnet.vmem ldrmoudles –p 1928

We can get more information about it with this command.

python2 vol.py -f stuxnet.vmem ldrmoudles –p 1928 -v

These kernel calls are directly related with stuxnet worm. See the URL below:

http://www.f-secure.com/v-descs/trojan-dropper_w32_stuxnet.shtml

DETECTING INJECTED CODE

The malfind command helps us to find hidden or injected code/DLLs in the user mode memory. Then we are going to export these DLLs and we will upload them to www.virustotal.com in order to check if an anti-virus detects them.

We already know that the process with PID 680 is normal. For this reason we will continue with the other ones.

python2 vol.py -f stuxnet.vmem malfind –p 868 –dump-dir evidences/

We can see two files have been created. We continue doing the same with the “lsass.exe” process with Pid 1928.

python2 vol.py -f stuxnet.vmem malfind –p 1928 –dump-dir evidences/

The next step will be to upload to www.virustotal.com these files in order to check if some anti-virus vendor detects them as malicious files. In order to not upload the files, we will obtain the sha256 checksum of the files and then we will search on the Virustotal website.

sha256sum *.dmp

Here, you have the links to Virustotal with the report of the files which have been analyzed:

https://www.virustotal.com/en/file/e97d61f7393ac5838a1800f3e9aa22c6205f4d7e2bde494573d35c57bc9b7819/analysis/

https://www.virustotal.com/en/file/163b7da37df4ae6dafbfb5bf88b319dabf7846cee73d4192c6a7593e835857a8/analysis/

https://www.virustotal.com/en/file/abce3e79e26b5116fe7f3d40d21eaa4c8563e433b6086f9ec07c2925593f69dc/analysis/

https://www.virustotal.com/en/file/2b2945f7cc7cf5b30ccdf37e2adbb236594208e409133bcd56f57f7c009ffe6d/analysis/

https://www.virustotal.com/en/file/10f07b9fbbc6a8c6dc4abf7a3d31a01e478accd115b33ec94fe885cb296a3586/analysis/

https://www.virustotal.com/en/file/a4b4b29f0df45283b629203b080c09ddb5bc6eb4cd8e9b725f75121a8b7e728e/analysis/

https://www.virustotal.com/en/file/2b2945f7cc7cf5b30ccdf37e2adbb236594208e409133bcd56f57f7c009ffe6d/analysis/

Notice that the majority of them have been detected as Stuxnet Worm

Stuxnet Trojan - Memory Forensics with Volatility |  Part II

Continue reading the second part here:
http://www.behindthefirewalls.com/2014/01/stuxnet-memory-forensics-volatility-II.html

Read More

Parsero: The tool to audit the Robots.txt automatically

When I was writing Using robots.txt to locate your targets, I felt the necessity of developing a tool to make automatic the task of auditing the Robots.txt file of the web servers.

Now, I am really proud of introducing you my first tool called Parsero. I hope you enjoy it...

Introductions

One of the things you need to do when you are auditing a website is to look at the Robots.txt file, for example: http://www.behindthefirewalls.com/robots.txt. The web administrators write this file to tell the crawlers like Google, Bing, Yahoo... what content they are allowed to index or what directories mustn't be indexed.

But... Why the administrators want to hide some web directories to the crawlers?

Sometimes they want to hide the web portal login, management directories, private info, sensitive data, page with vulnerabilities, documents, etc... If they hide these directories from the crawlers, then they can't be found making Google Hacking or just searching in the search engines...

Why do you need Parsero?

We've said that the administrators tell the crawlers what directories or files hosted on the web server are not allowed to be indexed. They achieve this purpose by writing so much "Disallow: /URL_Path" as they want in the Robots.txt file pointing to these directories. Sometimes these paths typed in the Disallows entries  are directly accessible by the users (without using a search engine) just visiting the URL and the Path even sometimes they are not available to be visited by anybody... Because it is really common that the administrators write a lot of Disallows and some of them are available and some of them are not, you can use Parsero in order to check the HTTP status code of each Disallow entry in order to check automatically if these directories are available or not. 

When we execute Parsero, we can see the HTTP status codes. For example, the codes bellow:

• 200 OK                  The request has succeeded.
• 403 Forbidden     The server understood the request, but is refusing to fulfill it.
• 404 Not Found    The server hasn't found anything matching the Request-URI.
• 302 Found             The requested resource resides temporarily under a different URI
• ... 

Installation

Parsero needs at least Python3 and can be executed in all Operating Systems which support this language development. Also it needs Urllib3.

sudo apt-get install python3
sudo apt-get install python3-pip
sudo pip-3.3 install urllib3

When you have installed these software, just download the project from:

https://github.com/behindthefirewalls/Parsero

https://github.com/behindthefirewalls/Parsero/archive/master.zip

In Linux you can use the command bellow.

git clone https://github.com/behindthefirewalls/Parsero.git

When you download Parsero, you will see a folder with three files.

Before start, you need to check that your default Python version is 3 or later. If you have already installed Python3 but is not your default version,  you can run the script using the command "python3 parsero.py" instead of "python parsero.py".

 

If you don't type any argument, you will see the help bellow.

Example 1

In the picture below you can see the Robots.txt file of a web server in one of my environments. If you are a web security auditor, you should check all the Disallows in order to try to get some valuable information. The security auditor should want to know what directories or files are hosted in the web servers which the administrators don't want to be published on the search engines.

You can do this task automatically using Parsero with the command:

python parsero.py -u www.example.com 

Notice in the picture below that the green links are the links which are available in the web server. You don't need to waste your time checking the other links, just clicking on the green links.

If we visit the www.example.com/server-status/ we can see the Apache logs which are public but hidden for the crawlers...

Example 2

In the picture below you can see another robots.txt. The picture has been cut because this server has a lot of Disallow. Can you imagine checking all of them manually?

 

If you use Parsero, you will audit all the Robots.txt file in just a seconds...

... and discover for example, the portal login for this site.

The future of Parsero

I am working on developing new features of this tool which will be delivered in the next months... I would be really grateful if you decide to give me your feedback about this tool.

I want to give the thanks to cor3dump3d for his support and help!!! He has saved me a lot of time thanks to sharing his knwoledge of Python with me!!

Read More

Unpacking a UPX file manually with OllyDbg

You already know that the malware developers create packed executables in order to try to thwart the security analyst job and make a lighter file easier to download... If the executable is packed we cannot examine the original program which obstructs us from employing a static analysis to know what the malware does...

In this post we have a malware sample called DEMO.exe which we will work with.

If we open the file with PEiD we can check that it has been compressed with UPX. You already know that it is a common compression...

The majority of times we are able to unpack this type of compression automatically with the UPX program. But this time, we haven't been lucky...

If we want to make a static analysis, first we need to unpack the file. To achieve this purpose, we need to follow the next steps:

• To unpack the original file into memory.
• To resolve all of the imports of the original file.
• To find and transfer execution to the original entry point (OEP).

The key to this technique is to run the packed file until it is decompressed by itself, setting a breakpoint, dumping it and setting the OEP and rebuilding their imports.

To follow these steps we will use OllyDbg v1.10 and the plugin OllyDump.

The first thing we need to do is to load the executable in OllyDbg. We can see that an advertisement appears telling us what we already know: "...reports that its code section is either compressed, encrypted ,or contains large amount of embedded data..."

Ok, let's go. Just loaded the file we can see the program stop at PUSHAD. Press F7 or click on the button to Step into.

Right click at the ESP value and select Follow in Dump...

 ... select the first four characters and set a Breakpoint.

Press the play button and wait until the program stops at the breakpoint. Now we can see the tail jump at 00ACD7BD. The tail jump is the last instruction of the uncompressing action and in this type of compression is usually followed by a lot of 0x00 bytes. These 0x00 bytes are filling to ensure that the section is properly byte-aligned. Notice that function jumps to a site which is very far away, 004090E8. Just in that instruction, the original program will start.

We can set a breakpoint at the tail jump.

We resume the program again and it is stopped at the tail jump. We need to press F7 or click on the Step Into bottom.

Now we are in the OEP. Right-clik on this line and click on Dump debugged process in order to dump the process to a disk.

Notice that the OEP (004090E8) is the same that the last address in the "Modify" field, 90E8 . You can press the "Get EIP as OEP". Untick the "Rebuild import" because the import will be rebuilt using Import REConstructor. It is a good idea to copy the value "90E8" for the future...

Save the dump where you want. I have saved the file as "Dumped.exe". Notice if you want to run the program it will fail because it doesn't have the imports. To fix that, just open Import REConstructor and select the file which is being debugged with OllyDbg. In this case "demo.exe"

The next window will appear.

Just paste the value which was copied before in the OPE section and click on IAT AutoSearch.

Click on the Get Imports first and then click on the Fix Dump buttom.

Just pressed "Fix Dump" select the file which was dumped.

Now, we have two files, the first one which was dumped with OllyDbg and the last one, Dumped_.exe which has the imports rebuilt.

If  you look at the strings in OllyDbg you can see the differences. In the picture below you can see on the left the strings detected in the packed file and on the right, you can see the strings of the unpacked file.

Now, if we open the unpacked file we can detect that is was developed in Visual basic and we can start with the static analysis.

With VB Decompiler we could try to decompiler it...

Read More