Name: Iulian Anton
Actors:
Ann Dercover - bad girl - 10.10.10.10 - malware server
Vick Timmes - good guy - 10.10.10.70
Here is the summary of the network conversation:
10.10.10.70 -> clicks on exploit page (10.10.10.10)
10.10.10.10 -> sends the exploit
10.10.10.70 -> executes the exploit and downloads the malicious code
10.10.10.70 -> connects to 10.10.10.10 on port 4444
10.10.10.70 download the malware
10.10.10.10 and 10.10.10.70 -> communicates to each others using ssl v3
10.10.10.70 tries to connect to 10.10.10.10 on port 4445 several times (failed attempts)
10.10.10.70 closes connecton on potr 4444
10.10.10.70 tries to connect to 10.10.10.10 on port 4445 several times
10.10.10.70 connects to 10.10.10.10 on port 4445
10.10.10.70 download again the same malware
10.10.10.10 and 10.10.10.70 -> communicates to each others using ssl v3
10.10.10.70 closes connecton on potr 4445
I used Wireshark (http://www.wireshark.org/download.html) to view the evidence.pcap file.
In the first packet we see that Vick opens the url: http://10.10.10.10:8080/index.php (answer for the first question).
Here is the http header from the first packet:
GET /index.php HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
Host: 10.10.10.10:8080
Connection: Keep-Alive
Things we can notice:
1. The port is 8080 (the alternative http port) and not the default http port(80). (default port for metasploit - clue)
2. The header doesn't contain any referer so maybe Vick copied/pasted the link into the browser or he doesn't use a web based mail client.
3. The user agent tag from the header offers useful informations. The browser (MSIE 6.0) is Microsoft Internet Explorer 6, the operating system (Windows NT 5.1) is Windows XP. The token SV1 sugests that Vick uses Internet Explorer 6 with enhanced security features. This is available only in Windows XP SP2 and Windows Server 2003 only. So, the OS is Windows XP with SP2. More information about UserAgent string format and tokens from Microsoft is available on MSDN at: http://msdn.microsoft.com/en-us/library/ms537503(VS.85).aspx (Understanding User-Agent Strings).
In the next packet can be found the ACK response from the server.
The server response header can be found in the next packet:
HTTP/1.1 200 OK
Content-Type: text/html
Pragma: no-cache
Connection: Keep-Alive
Server: Apache
Content-Length: 5748
Therefore, we see from the response that the server is Apache. It seems to be a metasploit server because, by default, a standard apache sends more information in the header.
The content of this response contains the exploit (packets 3,4,5,6,8). It's a html code that has an obfuscated JavaScript.
Unobfuscated and commented JavaScript code:
-------------------START--index.php-------------------------