| <<< Previous | ||
After downloading the sotm27.gz file, we proceeded to an integrity check process before unzipping the file. The ouput of the commands below was compared to the digests of sotm27.gz published on the scan27 challenge page.
| $ md5sum sotm27.gz |
Then we tried to identify the type of the file sotm27 using the linux command below :
$ file sotm27 |
The file seems to be a tcpdump binary capture of a network traffic. To read it we can choose on of the following programs: tcpdump, tethereal, and ethereal. Firstly, we begin by choosing Ethereal (a free network protocol analyzer for Unix and Window) due to his conviviality, we disable the two options "Enable MAC name resolution", and "ENABLE netwok name resolution" to minimize the time processing. The total number of the captured packets is 54536. A first look at the content reveals many traffic usage : SMB, HTTP, IRC, ...etc.
Assuming that our honeypot has the IP address 172.16.134.191, we procced by determining what IRC servers did the honeypot communicate with. Before continuing let's mention that a connection is established by a process known as the three way handshake:
When the honeypot communicate with the IRC servers, it should initiate the
connections which should be identified by a TCP destination port = 6667, a
tcp flag equal to syn only, and an ip src = 172.16.134.191.
With the command below, we try read all the ackets with the tethereal
program, we disable the netwok name resolution, we apply the "tcp.dstport
== 6667 && tcp.flags.syn == 1" filter, and we redirect the filtered
output to the file "comm-irc-server".
|
$ tethereal -nr sotm27 -w comm-irc-server "tcp.dstport
== 6667 && tcp.flags.syn == 1" |
We can use tcpdump to read the result file:
|
$ tcpdump -r comm-irc-server |
To extract some statistics (specially the IP destination address) of the "comm-irc-server" file, which contain the connection packets targeted by the honeypot to some IRC, we use the perl script "sumsrcdst" made by Nick DeBaggis in his submission for scan23, then we read to output file.
|
$ tethereal -nr comm-irc-server | ./sumsrcdst > comm-irc-server.statistics |
Given the results, the honeypot is trying to initiate some TCP IRC connection on the on the following server address
|
209.126.161.29
|
|
66.33.65.58
|
|
209.196.44.172
|
|
217.199.175.10
|
|
63.241.174.144
|
But we are not sure that all these servers are alive and can respond, so we should verify if there is some respond packets with a TCP source port equal to 6667, an IP destination = 172.16.134.191, and TCP flags = SYN|ACK
|
$ tethereal -nr sotm27 -w comm-irc-alive-server "tcp.srcport
== 6667 && ip.dst == 172.16.134.191 && tcp.flags.syn
== 1 && tcp.flags.ack == 1" |
Given the output results, only the following servers are alive and communicate with the honeypot.
|
209.196.44.172
|
|
217.199.175.10
|
|
63.241.174.144
|
After the successfull processes of three way handshake, and after the user (honeypot) sends his NickName, if the botnet accept the user, he send him some statistics. By looking with Ethereal at the IRC layer of packets number 35806 and 35807, we get the following informations:
|
:irc5.aol.com 001 rgdiuggac :Welcome to the Internet Relay Network
rgdiuggac |
According to this response there are 346 client which are actually coonected to the server 209.196.44.172. this server has a maximum capacity equal to 348 users.
From the response, we also notice that the maximum global users of the botnet is equal to 4765. Assuming that each botnet host has a 56 kbps network link, the aggregate bandwidth of the botnet will be equal (based of the maximum capacity) to 56*4765/1024 = 260.585 Mb/s.
We choosed to run the original sotm27 tcpdump file through snort and see what comes up. Since snort has many attack signatures, we may get the list of IP address attacking the honeypot, and their attack ID.
After installing the snort, and disabling all the commented rules and preprocessors in the snort.conf file, we execute the following command:
|
$ snort -r sotm27 -c /etc/snort/snort.conf |
Examining the resultant alert file in /var/log/snort shows only 56 alerts, most of them are related to the "MS-SQL Worm propagation attempt" alert. and some "spp_portscan". But there are no alert related to IIS attack (like cmd.exe), or SMB attack (like null session).
We try to disactivate the stream reassembly by commenting the two preprocessors: stream4_reassemble, and stream4: detect_scans, disable_evasion_alerts. By running now the same previous command, the logged alerts number incresed to 900. It contains now the major IIS attacks, but not the SMB attacks.
We try to look at the netbios.rules file, this file seems to be not adequate for netbios traffic on Win2k, in fact in older version of windows (95, 98, Me ,and NT), SMB shares run on netbios over 137/TCP, 138/UDP, 139/TCP however, in later version of windows (2000, XP) it is possible to run SMB over TCP/IP on port 445/TCP.
We tried to change all the 137 port number in netbios.rules file
to 445, but there is no impact and no SMB attack was detected by snort. In
fact the chnaging 137 to 445 in netbios.rules is not sufficient. We need also
change the payload field, so to detetect SMB attack, we try to analyse the
sotm27 file manually.
Looking at the honeynet traffic just before it established his IRC communication, reveals the 61.111.101.78 ip address, so probablity this address is suspect to have attacked the honeypot.
Through this paragraph, we will try to trace the malicous activity of the 61.111.101.78 machine, wich expoited the null session attack, we applied the following filter on Ethereal: "tcp.addr == 61.111.101.78"
tcp/445 and tcp/139 probe to see if service is available
| 1 0.000000 61.111.101.78 -> 172.16.134.191 TCP
4614 > microsoft-ds [SYN] Seq=1613186151 Ack=0 Win=64240 Len=0 2 0.000857 172.16.134.191 -> 61.111.101.78 TCP microsoft-ds > 4614 [SYN, ACK] Seq=3333953826 Ack=1613186152 Win=17520 Len=0 3 0.176251 61.111.101.78 -> 172.16.134.191 TCP 4614 > microsoft-ds [ACK] Seq=1613186152 Ack=3333953827 Win=64240 Len=0 4 0.187157 61.111.101.78 -> 172.16.134.191 TCP 4614 > microsoft-ds [FIN, ACK] Seq=1613186152 Ack=3333953827 Win=64240 Len=0 5 0.187871 172.16.134.191 -> 61.111.101.78 TCP microsoft-ds > 4614 [FIN, ACK] Seq=3333953827 Ack=1613186153 Win=17520 Len=0 6 0.366833 61.111.101.78 -> 172.16.134.191 TCP 4614 > microsoft-ds [ACK] Seq=1613186153 Ack=3333953828 Win=64240 Len=0 7 102.073493 61.111.101.78 -> 172.16.134.191 TCP 1695 > microsoft-ds [SYN] Seq=1679902750 Ack=0 Win=64240 Len=0 8 102.078759 172.16.134.191 -> 61.111.101.78 TCP microsoft-ds > 1695 [SYN, ACK] Seq=3359397673 Ack=1679902751 Win=17520 Len=0 9 102.084257 61.111.101.78 -> 172.16.134.191 TCP 1696 > netbios-ssn [SYN] Seq=1679947992 Ack=0 Win=64240 Len=0 10 102.084260 172.16.134.191 -> 61.111.101.78 TCP netbios-ssn > 1696 [SYN, ACK] Seq=3359456153 Ack=1679947993 Win=17520 Len=0 11 102.241685 61.111.101.78 -> 172.16.134.191 TCP 1695 > microsoft-ds [ACK] Seq=1679902751 Ack=3359397674 Win=64240 Len=0 |
Create Server Message Block - SMB Connection
| 12 102.251656 61.111.101.78 -> 172.16.134.191 SMB
Negotiate Protocol Request 13 102.253383 172.16.134.191 -> 61.111.101.78 SMB Negotiate Protocol Response 14 102.262046 61.111.101.78 -> 172.16.134.191 TCP 1696 > netbios-ssn [RST] Seq=1679947993 Ack=1679947993 Win=0 Len=0 15 102.431644 61.111.101.78 -> 172.16.134.191 SMB Session Setup AndX Request, NTLMSSP_NEGOTIATE 16 102.434942 172.16.134.191 -> 61.111.101.78 SMB Session Setup AndX Response, NTLMSSP_CHALLENGE, Error: STATUS_MORE_PROCESSING_REQUIRED 17 102.611836 61.111.101.78 -> 172.16.134.191 SMB Session Setup AndX Request, NTLMSSP_AUTH 18 102.620644 172.16.134.191 -> 61.111.101.78 SMB Session Setup AndX Response |
Create Null Session to IPC$
| 19 102.791769 61.111.101.78 -> 172.16.134.191
SMB Tree Connect AndX Request, Path: \\172.16.134.191\IPC$ 20 102.793296 172.16.134.191 -> 61.111.101.78 SMB Tree Connect AndX Response |
Connect to \samr path to enumerate system info
| 21 102.960481 61.111.101.78 -> 172.16.134.191
SMB NT Create AndX Request, Path: \samr 22 102.963368 172.16.134.191 -> 61.111.101.78 SMB NT Create AndX Response, FID: 0x4001 23 103.130071 61.111.101.78 -> 172.16.134.191 DCERPC Bind: call_id: 1 UUID: SAMR 24 103.131578 172.16.134.191 -> 61.111.101.78 DCERPC Bind_ack: call_id: 1 accept max_xmit: 4280 max_recv: 4280 25 103.300247 61.111.101.78 -> 172.16.134.191 SAMR Connect4 request 26 103.302755 172.16.134.191 -> 61.111.101.78 SAMR Connect4 reply |
Get list of domain names - returned: 'PC0191'
| 27 103.480159 61.111.101.78 -> 172.16.134.191
SAMR EnumDomains request 28 103.498780 172.16.134.191 -> 61.111.101.78 SAMR EnumDomains reply |
Lookup System ID (SID) for 'PC0191'
| 29 103.660276 61.111.101.78 -> 172.16.134.191
SAMR LookupDomain request 30 103.662108 172.16.134.191 -> 61.111.101.78 SAMR LookupDomain reply |
Open that domain
| 31 103.840523 61.111.101.78 -> 172.16.134.191
SAMR OpenDomain request 32 103.842074 172.16.134.191 -> 61.111.101.78 SAMR OpenDomain reply |
List usernames
|
33 104.020685 61.111.101.78 -> 172.16.134.191 SAMR QueryDispinfo
request |
Close of /samr
|
37 104.381599 61.111.101.78 -> 172.16.134.191 SAMR Close request |
Establish a new SMB connection
|
55 105.789455 61.111.101.78 -> 172.16.134.191 SMB Negotiate Protocol
Request |
Create Null Session to ADMINS$, it is probablity that there is no need to brute force the username list.
|
62 106.320012 61.111.101.78 -> 172.16.134.191 SMB Tree Connect
AndX Request, Path: \\172.16.134.191\ADMIN$ |
session is successfully established, pushing the PSEXESVC.EXE
This file permit to executes programs remotely on Windows NT, 2000 and XP systems to perform various tasks like: launching interactive command-prompts, remotely enabling tools like IpConfig, executing processes on other systems.
|
64 106.519936 61.111.101.78 -> 172.16.134.191 SMB NT Create AndX
Request, Path: \System32\PSEXESVC.EXE |
.
.
.
pushing the inst.exe which installs the remote access VNC application.
|
462 132.784358 61.111.101.78 -> 172.16.134.191 SMB NT Create AndX
Request, Path: \System32\inst.exe |
.
.
This attack may have been initiated and exploited by a worm, for example W32/Deloder is a worm example that try to install and execute the inst.exe and psexesvc.exe file, the http://archives.neohapsis.com/archives/snort/2003-03/0419.html site deels with this kind of worm.
Other successfull attacks
By the same way the IP address 210.22.104.101 is doing a successfull attack by exploiting the null session attack, trying to brute force attack on SMB, and then successfully installing the r_server.exe, raddrv.dll, admdll.dll:
|
478 56.441692 210.22.204.101 -> 172.16.134.191 SMB NT Create AndX
Request, Path: \WINNT\System32\r_server.exe |
According to http://www.radmin.com/solutions/enterprise/push.html, thses files are used to remotely install and update applications
Some other attacks are related to netbios session and issued from the following address: 195.36.247.77 and 66.139.10.15 to gather sharing informations,the seconf has also tried to brute force system users accounts succeeded but the second has failed. The other addresses 80.181.116.202, 209.45.125.69, 129.116.182.230, 61.111.101.78, and 66.8.163.125 have exploited the null session vulnerability and tried to create a pipe over which command can be passed (Create \srvsvc) if this pipe is established, the attacker issue the share enumerate command and SMB server respond with the unicode names of all the shares on the system, including the "hidden" administrative shares.
Some other ip address are trying to connect to the honeypot, and access to the shared drive C. This attack is explained trough the following steps:
Some other attacks are related to IIS microsoft web server. we used snort_stat.pl perl script to parse the snort log file, we issued to following command:
|
$ snort_stat -d -f -h /var/log/snort/alert > snort_alerts.html
|
These address have issued some web-IIS attacks.
|
24.197.194.106
|
|
210.22.104.101
|
|
66.8.163.125
|
The issued attacks are: liked in this file.
Some aother address has been repoted by snort as a source of MS-SQL wrom propagation attempt
The 24.197.194.106 has also issued an spp_protscan.
tcpdump
ethereal
file
cat
snort
snort_stat