{"id":1979,"date":"2021-08-20T13:44:25","date_gmt":"2021-08-20T11:44:25","guid":{"rendered":"https:\/\/mikadmin.fr\/blog\/?p=1979"},"modified":"2021-09-19T11:05:58","modified_gmt":"2021-09-19T09:05:58","slug":"btlo-network-analysis-web-shell","status":"publish","type":"post","link":"https:\/\/mikadmin.fr\/blog\/btlo-network-analysis-web-shell\/","title":{"rendered":"BTLO – Network Analysis – Web Shell"},"content":{"rendered":"<\/span> 4<\/span> min read<\/span><\/span>

Views: 539<\/p>\n

<\/div>\n\n\n\n

Scenario : <\/strong><\/p>\n\n\n\n

The SOC<\/a> received an alert in their SIEM for \u2018Local to Local Port Scanning\u2019 where an internal private IP began scanning another internal system. Can you investigate and determine if this activity is malicious or not? You have been provided a PCAP<\/a>, investigate using any tools you wish.<\/p><\/blockquote>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

<\/p>\n\n\n\n

\n\n\n\n

Sur ce challenge, nous utiliserons principalement Wireshark<\/span><\/strong> et tshark<\/span><\/strong>.<\/p>\n\n\n\n

<\/p>\n\n\n\n

<\/div>\n\n\n\n

Challenge Submission :<\/strong><\/p>\n\n\n\n

<\/div>\n\n\n\n

What is the IP responsible for conducting the port scan activity?<\/span><\/strong><\/p><\/blockquote>\n\n\n\n

Afin de retrouver l’ip responsable du scan de port nous pouvons par exemple v\u00e9rifier les flags SYN \u00e0 1 et les ACK \u00e0 0 (TCP SYN – nmap -sS) \u00e0 l’aide de ce filtre Wireshark<\/span><\/strong> :<\/p>\n\n\n\n

tcp.flags.syn==1 and tcp.flags.ack==0<\/code><\/pre>\n\n\n\n
Ce qui nous donnes bien l’adresse IP source responsable :<\/p>\n\n\n\n
\"network\"<\/figure><\/div>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n
\n\n\n\n
<\/div>\n\n\n\n
<\/p>\n\n\n\n
What is the port range scanned by the suspicious host?<\/span><\/strong><\/p><\/blockquote>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n
\n\n\n\n
<\/div>\n\n\n\n
What is the type of port scan conducted?<\/span><\/strong><\/p><\/blockquote>\n\n\n\n
Nous avons d\u00e9j\u00e0 r\u00e9pondu \u00e0 la question plus haut, c’est donc du TCP SYN<\/a>.<\/p>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n
\n\n\n\n
<\/div>\n\n\n\n
Two more tools were used to perform reconnaissance against open ports, what were they? <\/span><\/strong><\/p><\/blockquote>\n\n\n\n
Pour celle-ci, nous pouvons utiliser l’outil tshark<\/span><\/strong> afin de r\u00e9cup\u00e9rer les diff\u00e9rents user-agent<\/strong> qui ont effectu\u00e9 la phase de reconnaissance :<\/p>\n\n\n\n
tshark -Y 'http contains "User-Agent:"' -T fields -e http.user_agent -r BTLOPortScan.pcap | sort | uniq -c | sort -nr<\/code><\/pre>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n
\n\n\n\n
<\/div>\n\n\n\n
What is the name of the php file through which the attacker uploaded a web shell?<\/span><\/strong><\/p><\/blockquote>\n\n\n\n
Afin de retrouver ce fichier, il est possible d’utiliser ce filtre wireshark<\/span><\/strong> permettant de r\u00e9cup\u00e9rer les requ\u00eates POST<\/strong> de la part de l’ip malveillante 10.251.96.4<\/strong> :<\/p>\n\n\n\n
ip.src == 10.251.96.4 && http.request.method == POST<\/code><\/pre>\n\n\n\n
<\/p>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n
\n\n\n\n
<\/div>\n\n\n\n
What is the name of the web shell that the attacker uploaded? <\/span><\/strong><\/p><\/blockquote>\n\n\n\n
Pour retrouver le nom du fichier il suffit simplement d’utiliser la m\u00eame requ\u00eate et de regarder la partie MIME<\/strong> :<\/p>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n
\n\n\n\n
What is the parameter used in the web shell for executing commands?<\/span><\/strong><\/p><\/blockquote>\n\n\n\n
<\/div>\n\n\n\n
Afin d’identifier le param\u00e8tre permettant d’ex\u00e9cuter les commandes nous pouvons utiliser cette commande tshark<\/span><\/strong> :<\/p>\n\n\n\n
tshark -Y 'http contains "dbfunctions.php"' -r BTLOPortScan.pcap | s\nort | uniq -c | sort -nr<\/code><\/pre>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n
\n\n\n\n
What is the first command executed by the attacker?<\/span><\/strong><\/p><\/blockquote>\n\n\n\n
<\/div>\n\n\n\n
Afin de trier et savoir qu’elle est la premi\u00e8re commande ex\u00e9cut\u00e9e nous utilisons cette commande :<\/p>\n\n\n\n
tshark -Y 'http contains "dbfunctions.php"' -T fields -e frame.time_delta -e http.request.uri -r BTLOPortScan.pcap | sort -n<\/code><\/pre>\n\n\n\n
<\/p>\n\n\n\n
<\/p>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n
\n\n\n\n
<\/div>\n\n\n\n
What is the type of shell connection the attacker obtains through command execution?<\/span><\/strong><\/p><\/blockquote>\n\n\n\n
Comme nous pouvons le voir \u00e0 la question pr\u00e9c\u00e9dente, il s’agit d’un reverse shell<\/a> :<\/p>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n
\n\n\n\n
What is the port he uses for the shell connection? <\/span><\/strong><\/p><\/blockquote>\n\n\n\n
<\/div>\n\n\n\n
Le port et l’ip sont pr\u00e9sents dans le reverse shell :<\/p>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n
<\/div>\n","protected":false},"excerpt":{"rendered":"
<\/span>  4<\/span> min read<\/span><\/span>The SOC received an alert in their SIEM for \u2018Local to Local Port Scanning\u2019 where an internal private IP began scanning another internal system. Continuer la lecture →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":1988,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_themeisle_gutenberg_block_has_review":false,"footnotes":""},"categories":[4,2],"tags":[68,70,5,31,63],"class_list":["post-1979","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-infosec","category-network","tag-blueteam","tag-btlo","tag-infosec","tag-network","tag-writeup"],"aioseo_notices":[],"post_mailing_queue_ids":[],"_links":{"self":[{"href":"https:\/\/mikadmin.fr\/blog\/wp-json\/wp\/v2\/posts\/1979","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mikadmin.fr\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mikadmin.fr\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mikadmin.fr\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mikadmin.fr\/blog\/wp-json\/wp\/v2\/comments?post=1979"}],"version-history":[{"count":0,"href":"https:\/\/mikadmin.fr\/blog\/wp-json\/wp\/v2\/posts\/1979\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mikadmin.fr\/blog\/wp-json\/wp\/v2\/media\/1988"}],"wp:attachment":[{"href":"https:\/\/mikadmin.fr\/blog\/wp-json\/wp\/v2\/media?parent=1979"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mikadmin.fr\/blog\/wp-json\/wp\/v2\/categories?post=1979"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mikadmin.fr\/blog\/wp-json\/wp\/v2\/tags?post=1979"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}