Name: Kristinn Gudjonsson Description: How I came to my conclusion... This is a little text describing the methods that I used to solve this case. First of all a little disclaimer, since this is a competition where scripting is encouraged I decided beforehand to write a script and not rely on any available tools to complete this task. To begin with, we know that Ann is being monitored closely, since she is expected to skip town. The police then brings along a network capture, claiming it to quite possibly indicate her intention to flee the country. There are definitely some questions that need to be answered. So to begin with, let's examine the content quickly using tcpdump. We want to see every IP and port number that has issued any IP traffic. So let's begin by quickly seeing all the possible sources. tcpdump -nn -r evidence02.pcap | awk -F 'IP' '{print $2}' | awk '{print $1}' | sort -nu reading from file evidence02.pcap, link-type EN10MB (Ethernet) 10.1.1.20.53 64.12.102.142.587 192.168.1.10.52111 And then to see all the destinations. tcpdump -nn -r evidence02.pcap | grep IP | awk -F '>' '{print $2}' | awk '{print $1}' | sort -nu reading from file evidence02.pcap, link-type EN10MB (Ethernet) 10.1.1.20.53: 64.12.102.142.587: 192.168.1.30.514: We see a traffic that most like is a DNS traffic (port 53) and then some other traffic that seems to going to the server 64.12.102.142 on port 587. Let's examine the TCP traffic little bit closer using a script that I wrote for the previous network forensic challenge, pcapcat. pcapcat -r evidence02.pcap -b 0 [1] TCP 192.168.1.159:1036 -> 64.12.102.142:587 [2] TCP 192.168.1.159:1038 -> 64.12.102.142:587 We see that there are only two TCP connections that have been set up in this dump. And they correspond with the output that we saw from tcpdump, that is Ann's laptop is clearly communicating to the sever 64.12.102.142 on port 587. We need to examine this traffic little closer, so let's dump it using pcapcat. pcapcat -r evidence02.pcap [1] TCP 192.168.1.159:1036 -> 64.12.102.142:587 [2] TCP 192.168.1.159:1038 -> 64.12.102.142:587 Enter the index number of the conversation to dump or press enter to quit: 1 Dumping index value 1 Unable to determine output file Give the name of the output file: file_1 pcapcat -r evidence02.pcap [1] TCP 192.168.1.159:1036 -> 64.12.102.142:587 [2] TCP 192.168.1.159:1038 -> 64.12.102.142:587 Enter the index number of the conversation to dump or press enter to quit: 2 Dumping index value 2 Unable to determine output file Give the name of the output file: file_2 Now we have two files, file_1 and file_2 that contain the gathered TCP stream from the network capture. Start by checking out what this is: file file_* file_1: ASCII HTML document text, with CRLF line terminators file_2: ASCII HTML document text, with CRLF line terminators According to the file command, we are dealing with a HTML document. Let's try to see if that is correct head -3 file_1 220 cia-mc06.mx.aol.com ESMTP mail_cia-mc06.1; Sat, 10 Oct 2009 15:35:16 -0400 EHLO annlaptop 250-cia-mc06.mx.aol.com host-69-140-19-190.static.comcast.net head -3 file_2 220 cia-mc07.mx.aol.com ESMTP mail_cia-mc07.1; Sat, 10 Oct 2009 15:37:56 -0400 EHLO annlaptop 250-cia-mc07.mx.aol.com host-69-140-19-190.static.comcast.net By examining the first three lines in each of these documents it becomes clear to use that this is in fact not a HTML document but a SMTP conversation. So now we know that Ann was actually sending e-mails to the server 64.12.102.142 What IP address is this, let's examine that a bit: dig -x 64.12.102.142 ; <<>> DiG 9.6.0-APPLE-P2 <<>> -x 64.12.102.142 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 57356 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 1 ;; QUESTION SECTION: ;142.102.12.64.in-addr.arpa. IN PTR ;; ANSWER SECTION: 142.102.12.64.in-addr.arpa. 3600 IN PTR smtp-mc.mx.aol.com. ;; AUTHORITY SECTION: 102.12.64.in-addr.arpa. 3600 IN NS dns-02.ns.aol.com. 102.12.64.in-addr.arpa. 3600 IN NS dns-01.ns.aol.com. ;; ADDITIONAL SECTION: dns-02.ns.aol.com. 51683 IN A 205.188.157.232 ;; Query time: 99 msec ;; SERVER: 10.40.6.81#53(10.40.6.81) ;; WHEN: Fri Oct 16 14:36:52 2009 ;; MSG SIZE rcvd: 137 We see that the reverse DNS (or the PTR record) for the IP address points to a server that looks to be a SMTP server belonging to AOL, which can be further strengthen by issuing a whois against the IP address: whois 64.12.102.142 OrgName: America Online, Inc. OrgID: AMERIC-158 Address: 10600 Infantry Ridge Road City: Manassas StateProv: VA PostalCode: 20109 Country: US NetRange: 64.12.0.0 - 64.12.255.255 CIDR: 64.12.0.0/16 NetName: AOL-MTC NetHandle: NET-64-12-0-0-1 Parent: NET-64-0-0-0-0 NetType: Direct Assignment NameServer: DNS-01.NS.AOL.COM NameServer: DNS-02.NS.AOL.COM Comment: RegDate: 1999-12-13 Updated: 1999-12-16 RTechHandle: AOL-NOC-ARIN RTechName: America Online, Inc. RTechPhone: +1-703-265-4670 RTechEmail: domains@aol.net # ARIN WHOIS database, last updated 2009-10-15 20:00 # Enter ? for additional hints on searching ARIN's WHOIS database. So we now know that Ann did in fact send two e-mails to this server that belongs to AOL. Now we need to examine the conversation a bit better. To do that I created a script called smtp_anex (SMTP ANalyse and EXtraction tool). So let's use that script to analyse the traffic: ./smtp_anex -r file_1 -d data_1 ------------------------------------------------------------ SMTP_ANEX (SMTP ANALYSIS AND EXTRACTION) ------------------------------------------------------------ Information from e-mail header Mail from: sneakyg33k@aol.com Recipient: sec558@gmail.com Information from e-mail body Mail from: "Ann Dercover" Mail to : Subject : lunch next week Authentication information: Username: sneakyg33k@aol.com Password: 558r00lz Header information: date : Sat, 10 Oct 2009 07 x-mimeole : Produced By Microsoft MimeOLE V6.00.2900.2180 x-mailer : Microsoft Outlook Express 6.00.2900.2180 content-type : multipart/alternative; boundary="----=_nextpart_000_0006_01ca497c.3e4b6020" : x-priority : 3 x-msmail-priority : Normal mime-version : 1.0 message-id : <000901ca49ae$89d698c0$9f01a8c0@annlaptop> Additional information: data_response: 250 OK cmd_ehlo: HASH(0x8b3610) banner: 220 cia-mc06.mx.aol.com esmtp mail_cia-mc06.1; sat, 10 oct 2009 15:35:16 -0400 auth_leftovers: 235 - AUTHENTICATION SUCCESSFUL data_cmd_response: 354 start mail input, end with "." on a line by itself header: HASH(0x8b6ec0) ------------------------------------------------------------ The message content ------------------------------------------------------------ -------- Text -------- Sorry-- I can't do lunch next week after all. Heading out of town. = Another time! -Ann -------- HTML --------
Sorry-- I can't do lunch next week = after all. Heading out of town. Another time! -Ann
The script works by default by going through the SMTP conversation, and plocking out the relevant data. It then prints the data both on screen and saves it to files (the printing to screen can be silenced using the option -q). I used the option -d to save all the data in the folder "data_1", which now contains the following files: 1-HTML.html 1-RAW.txt 1-Text.txt 1-info.txt We can clearly see from the output that Ann was sending this e-mail from the address sneakyg33k@aol.com and was sending it to the address sec558@gmail.com. The content of the conversation was (again taken from the output of the script): Sorry-- I can't do lunch next week after all. Heading out of town. = Another time! -Ann This looks to be quite suspicious. Ann is claiming that se cannot do lunch because she is heading out of town? We also see the username and password that Ann uses in this conversation: Authentication information: Username: sneakyg33k@aol.com Password: 558r00lz The authentication information that the script reads comes from the command AUTH that is issued during the SMTP conversation: AUTH LOGIN 334 VXNlcm5hbWU6 c25lYWt5ZzMza0Bhb2wuY29t 334 UGFzc3dvcmQ6 NTU4cjAwbHo= 235 AUTHENTICATION SUCCESSFUL This is a very common authentication mechanism, where base64 is used to encode the messages, if we just decode it, we get: S: 334 Username: C: sneakyg33k@aol.com S: 334 Password: C: 558r00lz S: 235 AUTHENTICATION SUCCESSFUL where S: denotes server communications and C: client one. But we do not need to do this manually, the script does this for us. Let's examine the second e-mail a bit close, again using the script smtp_anex -r file_2 -d data_2 ------------------------------------------------------------ SMTP_ANEX (SMTP ANALYSIS AND EXTRACTION) ------------------------------------------------------------ Information from e-mail header Mail from: sneakyg33k@aol.com Recipient: mistersecretx@aol.com Information from e-mail body Mail from: "Ann Dercover" Mail to : Subject : rendezvous Authentication information: Username: sneakyg33k@aol.com Password: 558r00lz Header information: date : Sat, 10 Oct 2009 07 x-mimeole : Produced By Microsoft MimeOLE V6.00.2900.2180 x-mailer : Microsoft Outlook Express 6.00.2900.2180 boundary="----=_nextpart_000_000d_01ca497c.9dec1e70" : content-type : multipart/mixed; x-priority : 3 x-msmail-priority : Normal mime-version : 1.0 message-id : <001101ca49ae$e93e45b0$9f01a8c0@annlaptop> Additional information: data_response: 250 OK msg: Attachment dumped to file - name: secretrendezvous.docx cmd_ehlo: HASH(0x8b3610) banner: 220 cia-mc07.mx.aol.com esmtp mail_cia-mc07.1; sat, 10 oct 2009 15:37:56 -0400 auth_leftovers: 235 - AUTHENTICATION SUCCESSFUL data_cmd_response: 354 start mail input, end with "." on a line by itself header: HASH(0x8b6ec0) ------------------------------------------------------------ The message content ------------------------------------------------------------ -------- Text -------- Hi sweetheart! Bring your fake passport and a bathing suit. Address = attached. love, Ann -------- HTML --------
Hi sweetheart! Bring your fake passport = and a bathing suit. Address attached. love, Ann
Now this looks to be quite suspicious, we can see from the output that Ann is again sending an e-mail, and this time to mistersecretx@aol.com with the subject of "rendezvous". The text from the message is: Hi sweetheart! Bring your fake passport and a bathing suit. Address = attached. love, Ann We also see from the output of the script the following additional information: msg: Attachment dumped to file - name: secretrendezvous.docx So there was an attachment with the message, let's examine the output of the folder data_2 1-HTML.html 1-RAW.txt 1-Text.txt 1-info.txt 1-secretrendezvous.docx We can therefore examine the content of the attachment. First of all, let's calculate the MD5sum of the docx document that was attached to the e-mail. 9e423e11db88f01bbff81172839e1923 data_2/1-secretrendezvous.docx Since this is a .docx document, we can use other scripts to read it, such as cat_open_xml.pl cat_open_xml.pl 1-secretrendezvous.docx Meet me at the fountain near the rendezvous point. Address below. I’m bringing all the cash. returning from a call.. We don't get much from this, perhaps there is more to this document than just text. Since we know that docx documents are nothing more than a simple ZIP file we can just extract the content of the document: unzip -d doc 1-secretrendezvous.docx Archive: 1-secretrendezvous.docx inflating: doc/[Content_Types].xml inflating: doc/_rels/.rels inflating: doc/word/_rels/document.xml.rels inflating: doc/word/document.xml extracting: doc/word/media/image1.png inflating: doc/word/theme/theme1.xml inflating: doc/word/settings.xml inflating: doc/word/webSettings.xml inflating: doc/word/styles.xml inflating: doc/docProps/core.xml inflating: doc/word/numbering.xml inflating: doc/word/fontTable.xml inflating: doc/docProps/app.xml Now we see that there is an image that is contained within the document. Let's examine it md5sum doc/word/media/image1.png aadeace50997b1ba24b09ac2ef1940b7 doc/word/media/image1.png The image seems to be taken from Google maps, displaying the meeting place. PLaya del Carmen 1. Av. Constituyentes 1 Calle 10 x la 5ta Avenida Playa del Carmen, 77780, Mexico 01 984 873 4000 Now we know the location where they are planning to meet, we know the secret lover's e-mail address and we know for sure that Ann is planning to escape the country, the rest is up to the police chief... p.s. the pcapcat can be downloaded from here: http://blog.kiddaland.net/dw/pcapcat cat_open_xml.pl can be downloaded from here: http://blog.kiddaland.net/dw/cat_open_xml.pl And the final script, smtp_anex can be seen in the additional text field