Network Forensic using Wireshark

What You Need for This task • Any computer. Wireshark runs on every OS. Installing Wireshark If your computer doesn’t already have it, go to https://www.wireshark.org/ Download and install the latest version. I wrote these instructions using Wireshark 2.6.1 for the Mac on 6–28–18. Examining Layers 1–4

i am having a file here on which we will be performing network forensics. link to the file

open in wireshark

Find these features, as shown below: • Packet List in the top pane, showing one line per packet. Notice the TCP handshake performed by packets 1, 3, and 4, outlined in red in the image below. • Packet Details in the middle pane, showing the first four TCP layers. Notice MAC addresses at layer 2, IP addresses at layer 3, and TCP port numbers at layer 4, outlined in green in the image below. • Packet Bytes in the bottom pane, showing raw data in hexadecimal and ASCII form, outlined in red in the blue below.

Finding an FTP Password

FTP is a very unsafe protocol, because it sends passwords over the network without encryption. To demonstrate that, we’ll steal a password. In Wireshark, at the top, in the “Apply a display filter” box,

type ftp and press the Enter key.

Wireshark filters the packets, showing only the packets using File Transfer Protocol. On the right side, you can see the login process for a user named “john”.

John’s Password Find John’s password. That’s the flag.

username-> John

password-> Flapper

Finding an HTTP Password

Finding an HTTP Password HTTP also sends passwords over the network without encryption. To demonstrate that, we’ll steal a password. We are ahving a file here which we will be using for forensics. link to the file In Wireshark, at the top, in the “Apply a display filter” box, type http and press the Enter key.

Wireshark filters the packets, showing only the packets using HTTP. In the Packet List, in the “Info” column, find the first POST request, as shown below, and click it.

here is the post request

In the Packet Details, expand the “Hypertext Transfer Protocol” container. The username of “Isaac” and password of “Flapper” are visibie, as in the image below.

Following a TCP Stream

In the Packet List, in the “Info” column, right-click the first POST request, click Follow, and click “TCP Stream”, as shown below,

The conversation is shown, with the client’s transmission in red, and the server’s response in blue, as shown below. The TCP Stream is often very helpful, but not in this case, because the reply is zipped.

Restoring the Packet Filter to “http”

Close the “Follow TCP Stream” box. In Wireshark, at the top, in the “Apply a display filter” box, on the right side, click the X to clear the filter. In the “Apply a display filter” box, type http and press the Enter key. All the “http” packets appear, as shown below.

Viewing the HTTP Reply In the Packet List, in the “Info” column, click the packet following the first POST request, which is labelled “HTTP/1.1 200 OK”, as shown below. In the Packet Details, expand the “Line-based test data” container. The server’s reply is now readable, saying “Login Denied!”, as in the image below.

Isaac’s Password

Isaac made several attempts to log in before finally entering the correct password. Find the password that worked. That’s the flag.

for flag i checked for all the post requests in the http filter

and from the last request i got the string “Login Approved!”

password: Slapper

HTTP Basic Authentication

HTTP Basic authentication obfuscates passwords with Base64 encoding before transmitting them, which is not much better than sending them in cleartext, because Wireshark automatically decodes them. Download this file and double-click it to open it in Wireshark: BasicLogin.pcapng A user named WALDO logged in. Find Waldo’s password. That’s the flag.

for flag i applied filter “http”

the sus log was of getting access to secret/index

i inspected this packet and ot the creds

APT Capture

File link

This file contains some APT attacker traffic, which I got in the Red Team CTF on May 16, 2020. Analyze it and answer the following questions:

Encrypted Transmission There is only one protocol used for encrypted communication, with more than 3 packets sent. Find the port number of the server side of the encrypted transmissions. That’s the flag. HINT: Use Statistics, “Protocol Hierarchy”. Right-click a protocol to filter for it.

the port is 443 Tool What tool is being used to perform encrypted communications? The tool’s name is 5 letters long. That’s the flag.

socat

HINT: Use a filter like: frame contains “80” to find frames containing a command line using the port number you found in the previous flag. Don’t forget the quotation marks! Follow the streams to see the commands the attacker executed in red letters.

Hash of Tool Provide the sha1sum of the tool used to perform encrypted communications. That’s the flag. HINT: Use “frame contains” to find frames containing text including the tool name you found in the previous flag.

-> go to filter->tls->right click on any packet-> follow tcp stream and VOILA you will get the hash

Follow the streams of data sent from that port. Find the stream that begins with “.ELF” — that’s a Linux executable. Save it as “Raw” data locally with the name “socat”. Then calculate its hash.

right click on the data and -> export

in linux we have a tool -> shasum1 for calculating the hash

28af482861ab4e842c5086f9c9b765d11f210dc9

Decrypt Find the private key used for encrypted communications. Decrypt the encrypted communications and find the flag inside. HINTS: TLS Decryption Search for text found in the PEM File Format Follow the stream. Copy the private key into a file ending with “.pem” In Wireshark Preferences, in the Protocol “TLS”, add your key file. Filter for the port number used in flag H 420.4 In Wireshark, click File, “Export Packet Dissections”, “As Plain Text”. Check “Bytes”. Open the exported file in a text editor and search for “Decrypted”.

I used this filter to get the exact packet

double clicking on the log

as this packet gives half rsa key so we will locate the next packet and copy the rest of the key from there

copying from the begin to end and save it in the file naming it as key.pem

Go to:

Edit → Preferences → Protocols → TLS

In RSA Keys List:

Click Edit

Add new entry:

If key is correct → 🎉 TLS will decrypt

now

File → Export Packet Dissections → As Plain Text

exported Port Knocking There appears to be some port knocking on the network, what ports are being knocked? The flag is the answer in the form of “port,port,port”, in the order the knocks are sent.

HINT: Click Statistics, Conversations. Examine the TCP ports. Look for an obvious pattern of port numbers changing by 1000. Examine the unfiltered traffic near those conversations. Filter for SYN packets from the same source IP to see the time sequence.

i used this filter

ip.src == 10.1.30.11 && tcp.flags.syn == 1 && !tcp.flags.ack == 1

we need to look for dest port and this shows that the port differs from 1000 so our flag will be {34001,33001,32001} Exploitation On several occasions, after three knocks, the attacker got a shell on a target machine. Find the shell session with the largest number of bytes transferred. The attacker executed over 40 shell commands. The flag is the last command executed in that session. HINT: Filter for SYN packets on the first port number in the knocking sequence. There are 11 knocking attempts. Filter by source IP address. All 11 knocking attempts are visible together. Follow the streams to see which session is the largest.

For this task

Statistics > Conversations> TCP

and click on duration (to arrange them isn ascending order) cause we need to find the largets session

right click on the lngest session and Follow > TCP Stream

you will find the commands and from there get the last command