Quick note, updated the dhcp dll Satori uses. I'm getting ~10 times faster processing for DHCP fingerprints now!
Run the updater.exe and look for the latest!
Subscribe To
Posts
All Comments
Thursday, July 12, 2012
Wednesday, July 4, 2012
Satori 0.7.4 released
Short Info:
- Had a request from Randy to add a "not" feature to the filter. Added that and fixed the fact that it only filtered existing packets, not new packets. Thanks for the suggestion! Usage is: ![var] or just [var], sorry no ability to use && or || type logic.
- Also fixed a bug he noticed in the MAC Vendor not showing up in cases where it did know it.
- Last but not least packaged Satori with InstallForge (http://www.installforge.net/).
Long Winded Info:
For those that don't want to do a full blown install, nice thing is InstallForge, while making it an .exe it is actually a .zip, so it can be extracted with any zip program. You'll end up with an extra dir, but works sweet even when using unzip.
I had a request to add the ability to do a NOT in the filter. Initially it was simple, the problem came with trying to get it to do more than just what was currently on the screen, ie all those new packets coming in at the same time. While the first piece of code was about 5 mins of trial and error and some logic issues, the piece to get it to update new packets was 3-4 of pain and suffering on my part. Nothing like have 7 year old code that you barely ever look at anymore and try to figure out everything that is actually happening there!
The same person pointed out a few other issues, one of which was that Satori sometimes shows the Vendor of a MAC, other times doesn't, with no rhythm or reason he could see. Initially neither could I, until I remembered that the DNS dll will put an IP down and if you end up going there later it will add the MAC. Problem was I wasn't doing a lookup then, just an update. Simple code change later and I think it is now fixed. Thankfully that was a 10 min fix!
And the last thing he noted was that the date/time stamp of files on my web server were sometimes older than local ones from an install. This has to do with doing the install via a simple zip file and when you extract it it takes "today's" date/time instead of the file depending on the zip program and its settings. It also has to do with the way I pull time locally vs remotely and GMT, so sometimes files are off by a day. While I didn't fix this entirely, I've wanted a decent and free installer program for a long time and I found InstallForge. Works nicely for what I need and I recommend checking them out and donating to them if you find it useful!
One cool feature of InstallForge is it is really a .zip file underneath, so for those of you that don't want to install Satori, you can still just right click on the .exe and tell 7zip, or whatever your zip program of choice is to unextract it and you should be good to go!
- Had a request from Randy to add a "not" feature to the filter. Added that and fixed the fact that it only filtered existing packets, not new packets. Thanks for the suggestion! Usage is: ![var] or just [var], sorry no ability to use && or || type logic.
- Also fixed a bug he noticed in the MAC Vendor not showing up in cases where it did know it.
- Last but not least packaged Satori with InstallForge (http://www.installforge.net/).
Long Winded Info:
For those that don't want to do a full blown install, nice thing is InstallForge, while making it an .exe it is actually a .zip, so it can be extracted with any zip program. You'll end up with an extra dir, but works sweet even when using unzip.
I had a request to add the ability to do a NOT in the filter. Initially it was simple, the problem came with trying to get it to do more than just what was currently on the screen, ie all those new packets coming in at the same time. While the first piece of code was about 5 mins of trial and error and some logic issues, the piece to get it to update new packets was 3-4 of pain and suffering on my part. Nothing like have 7 year old code that you barely ever look at anymore and try to figure out everything that is actually happening there!
The same person pointed out a few other issues, one of which was that Satori sometimes shows the Vendor of a MAC, other times doesn't, with no rhythm or reason he could see. Initially neither could I, until I remembered that the DNS dll will put an IP down and if you end up going there later it will add the MAC. Problem was I wasn't doing a lookup then, just an update. Simple code change later and I think it is now fixed. Thankfully that was a 10 min fix!
And the last thing he noted was that the date/time stamp of files on my web server were sometimes older than local ones from an install. This has to do with doing the install via a simple zip file and when you extract it it takes "today's" date/time instead of the file depending on the zip program and its settings. It also has to do with the way I pull time locally vs remotely and GMT, so sometimes files are off by a day. While I didn't fix this entirely, I've wanted a decent and free installer program for a long time and I found InstallForge. Works nicely for what I need and I recommend checking them out and donating to them if you find it useful!
One cool feature of InstallForge is it is really a .zip file underneath, so for those of you that don't want to install Satori, you can still just right click on the .exe and tell 7zip, or whatever your zip program of choice is to unextract it and you should be good to go!
Monday, June 11, 2012
Adventures in new machines
Ok, switching to a new machine and moving all your tools to it always sucks, but really, I mean really, it shouldn't be this hard!
I've been working on getting Delphi installed on my machine for the past 4+ hours so that I could start working on Satori again (yes it is written in Delphi, I still hate C and C++ though one of these days I swear I'll learn it).
Ok, I'm running an ANCIENT version of Delphi, Delphi 6, but I refuse to pay $900 to get the latest version and since I didn't upgrade over the years I can't get by on the cheaper upgrade price of $500, or whatever it was.
The saga starts, install Delphi 6. Program from 2001 or so, 1 CD install flies. Launch it, Windows 7 whines, Delphi 7 isn't supported.... Huh, this is Delphi 6, click past the stupid error and it works fine. It didn't like the debugger I don't think, but oh well, it installed. Oh new machine, Borland only lets you install 3 times or so before they make you email in on a rebuild to bump your license count. On a plus side, they got back in me in under 30 mins having bumped my license limit (thanks Bryce, very impressed).
Ok, go to open Satori, missing VirtualStringTree, try to install that, missing XP Theme Manager, install that. Missing this component, then this, then that. Damn I'd forgotten how many little components I'd added to Satori over the years (time to write it command line only already, more on that shortly). While I was at it, oh lets go ahead and get the latest version of XYZ, hey why doesn't this work anymore, oh yeah, I'd added my own little code into their file for the convience factor since it needed extended. ARRGGGHHHH.... 4 hours later Satori opens and compiles again! YEAH!
Satori cmd line - ok, I made a linux version 3 or so years ago, cmd line only, thinking of expanding that and doing a windows/linux version that is cmd line only. Been doing a ton of Snort stuff lately and the way Snort/Barnyard2/BASE all work together makes me think I should look at doing that again. Get Satori to just write to file as fast as it can, maybe doing the fingerprinting lookup, maybe leaving that to a 2ndary piece of software that would also dump it into a DB. Then get a pretty front end to read it near real time out of the DB. All a pipe dream now, no free time to do any of this, but it is on my mind to do one of these days.
If I do do that, I'll be switching it all over to Free Pascal and Lazarus most likely or maybe I'll get real bold and convert the whole thing to C++, wouldn't that be a kick (why do I hate C/C++ so much.....).
Anyway, long story short, Satori can be compiled on my machine again and maybe I'll do some updates. Oh and satori is getting used a bit more, more on that in another post down the road.
Saturday, June 9, 2012
Forensics Contest #10
Well it has been awhile since they released one to the public, but the Lake Missoula Group has released a new puzzle.
Besides just network this time it appears to have some HD forensics required!
If time permits I hope to get to this in the near future. You have until 7/23/12 to submit your answers.
Contest #10 can be found here.
Tuesday, April 3, 2012
CapLoader 1.0
I've been playing with a beta of this product for the past month or so.
Straight from Erik's writeup:
Here are the main features of CapLoader:
• Fast loading of multi-gigabyte PCAP files (1 GB loads in less than 2 minutes on a standard PC and even faster on multi-core machines).
• GUI presentation of all TCP and UDP flows in the loaded PCAP files.
• Automatic identification of application layer protocols without relying on port numbers.
• Extremely fast drill-down functionality to open packets from one or multiple selected flows.
• Possibility to export packets from selected flows to a new PCAP file or directly open them in external tools like Wireshark and NetworkMiner.
---
These were observations in the beta versions, they may have been fixed since then:
I found 2 minor glitches when testing the beta and have reported them to Erik. One he found was due to out of wack timestamps in a random pcap I'd found on the internet and the other had to do with the Empty Flows on a 750 MB file that was mostly Empty Flows. For me the Empty Flow option was just something I tested, not something I'd use in what I do on a regular basis.
Overall a very sweet and fast product. I dumped a lot of 750 MB files into it and played around with it over the course of many days in a month. I wish I could get Satori to process files this quick!
Anyway, after processing the file(s), I clicked on the flow I wanted, drag and dropped it into wireshark and got what I was after. So much easier than loading a 750 MB file into wireshark (if it would ever load in the first place and not just die) and then write filter after filter and watch it process the whole file repeatedly. Instead pick the next flow I was after and drag it into wireshark!
The protocol fingerprinting database got a large overhaul between the 2 beta's I tested. I can't say how accurate the determination is as I have not had a chance to sit down and look deeply into it, but I know it is something I want to look at closer in the future.
Straight from Erik's writeup:
Here are the main features of CapLoader:
• Fast loading of multi-gigabyte PCAP files (1 GB loads in less than 2 minutes on a standard PC and even faster on multi-core machines).
• GUI presentation of all TCP and UDP flows in the loaded PCAP files.
• Automatic identification of application layer protocols without relying on port numbers.
• Extremely fast drill-down functionality to open packets from one or multiple selected flows.
• Possibility to export packets from selected flows to a new PCAP file or directly open them in external tools like Wireshark and NetworkMiner.
---
These were observations in the beta versions, they may have been fixed since then:
I found 2 minor glitches when testing the beta and have reported them to Erik. One he found was due to out of wack timestamps in a random pcap I'd found on the internet and the other had to do with the Empty Flows on a 750 MB file that was mostly Empty Flows. For me the Empty Flow option was just something I tested, not something I'd use in what I do on a regular basis.
Overall a very sweet and fast product. I dumped a lot of 750 MB files into it and played around with it over the course of many days in a month. I wish I could get Satori to process files this quick!
Anyway, after processing the file(s), I clicked on the flow I wanted, drag and dropped it into wireshark and got what I was after. So much easier than loading a 750 MB file into wireshark (if it would ever load in the first place and not just die) and then write filter after filter and watch it process the whole file repeatedly. Instead pick the next flow I was after and drag it into wireshark!
The protocol fingerprinting database got a large overhaul between the 2 beta's I tested. I can't say how accurate the determination is as I have not had a chance to sit down and look deeply into it, but I know it is something I want to look at closer in the future.
Microsoft Tokens, Hashes and lots more
Ok, so nothing to do with fingerprinting, but it has been very interesting reading through this series:
#1 - Protecting Privileged Domain Accounts: Safeguarding Password Hashes
#2 - Protecting Privilged Domain Accounts: LM Hashes -- The Good, the Bad, and the Ugly
#3 - Protecting Privileged Domain Accounts: Disabling Encrypted Passwords
#4 - Protecting Priviledge Domain Accounts: Safeguarding Access Tokens
#1 - Protecting Privileged Domain Accounts: Safeguarding Password Hashes
#2 - Protecting Privilged Domain Accounts: LM Hashes -- The Good, the Bad, and the Ugly
#3 - Protecting Privileged Domain Accounts: Disabling Encrypted Passwords
#4 - Protecting Priviledge Domain Accounts: Safeguarding Access Tokens
Monday, March 26, 2012
Fingerprint Editor updated to 1.00.09
Jeff updated the fingerprint editor he wrote that I utilize for .xml editing of the files Satori uses. We got the Terms of Service inputted into all of the .xml files now and the UTF-8 encoding fixed with saving of the file when the TOS is there. Some other minor fixes/updates as I believe.
Thanks for the changes!
Thanks for the changes!
Wednesday, March 7, 2012
Satori - update 0.7.3 and most dll's recompiled
I'm busy taking the SANS 503 IDS course, one of the things we do in that course is look at BPF style filters. Low and behold, I use these in Satori to do some prefiltering of packets before Satori hashes through them. While I have complete confidence in my coding skills (brief pause as I control the hysterical laughing fit I've found myself in), it never hurts to preprocess the packets before I get them.
History on the filters, we'll look at the TCP fingerprinting one:
Original:
'tcp'
Noticed vlan tagged traffic wasn't being picked up so, up until yesterday:
'tcp or vlan'
Yesterday first change:
'tcp or (vlan and tcp)' - decent update, meant only vlan traffic that was also tcp got sent to me, but wait, we only want TCP traffic with options, so...
'tcp[12] > 50 or (vlan and tcp[12] > 50)'
So now, instead of having to process all tcp traffic with Satori, winpcap only sends this dll tcp traffic that has tcp options!
Other protocols still read the whole tcp packet, or the whole packet for that matter, but now tcp processing should be a little quicker as I don't have to dig through the packet to see if it is tcp with options, I let winpcap do it. I still check to see if there are options on it and don't assume all is good, but I limit the initial packets that I have to process!
Ok, other updates besides BPF stuff....
Satori 0.7.3 released. Wanted a new .zip file as the last one was 0.7.1 and that was from quite awhile ago. 0.7.2 .exe was released 1.5 years ago! One thing I recently noticed with the update of the oui.txt file is that Satori reads it, but doesn't pick up any new changes in it unless I recompile the .exe. No idea why, on my list to fix some day.
Also released the SIP dll and profile. I wrote these back in 2010 and evidently never released them to the public. Which reminds me, I should probably upload the .xml file that goes with that also which means updating the .zip file that will be missing it also. Oh well, 5 more mins of my life.
Enjoy the updates, let me know if I broke anything as I haven't had a ton of testing time with the new changes as I'm supposed to be studying for SANS 503 stuff right now!
Oh last note, figured out some interesting "glitches" with the vlan tag and BPF, will try to do a different post once I verify it all and get some feed back.
History on the filters, we'll look at the TCP fingerprinting one:
Original:
'tcp'
Noticed vlan tagged traffic wasn't being picked up so, up until yesterday:
'tcp or vlan'
Yesterday first change:
'tcp or (vlan and tcp)' - decent update, meant only vlan traffic that was also tcp got sent to me, but wait, we only want TCP traffic with options, so...
'tcp[12] > 50 or (vlan and tcp[12] > 50)'
So now, instead of having to process all tcp traffic with Satori, winpcap only sends this dll tcp traffic that has tcp options!
Other protocols still read the whole tcp packet, or the whole packet for that matter, but now tcp processing should be a little quicker as I don't have to dig through the packet to see if it is tcp with options, I let winpcap do it. I still check to see if there are options on it and don't assume all is good, but I limit the initial packets that I have to process!
Ok, other updates besides BPF stuff....
Satori 0.7.3 released. Wanted a new .zip file as the last one was 0.7.1 and that was from quite awhile ago. 0.7.2 .exe was released 1.5 years ago! One thing I recently noticed with the update of the oui.txt file is that Satori reads it, but doesn't pick up any new changes in it unless I recompile the .exe. No idea why, on my list to fix some day.
Also released the SIP dll and profile. I wrote these back in 2010 and evidently never released them to the public. Which reminds me, I should probably upload the .xml file that goes with that also which means updating the .zip file that will be missing it also. Oh well, 5 more mins of my life.
Enjoy the updates, let me know if I broke anything as I haven't had a ton of testing time with the new changes as I'm supposed to be studying for SANS 503 stuff right now!
Oh last note, figured out some interesting "glitches" with the vlan tag and BPF, will try to do a different post once I verify it all and get some feed back.
Monday, February 13, 2012
p0fv3 - update
Well sat down and finally played with p0fv3...
DAMN that is fast! Reminds me how pathetically slow Satori is since I wander the .xml file EVERY packet that goes through instead of reading it in once, hashing it and doing a look up on that hash. Not sure how easy it will be, but after seeing how fast p0fv3 is (and prads in the past) just reminds me how much time I'm killing do to how I do lookups!
Anyway, back to p0fv3. Ran a 7 year old pcap file through it, there were about 7-10 devices that it didn't know. Mostly Netware 5 and 6 boxes, a few others that I don't know and would like to, and then a few XP ones that may have been because of the SP they were at or other services. Anyway, sent them on.
Very nice nice program as always mz!
DAMN that is fast! Reminds me how pathetically slow Satori is since I wander the .xml file EVERY packet that goes through instead of reading it in once, hashing it and doing a look up on that hash. Not sure how easy it will be, but after seeing how fast p0fv3 is (and prads in the past) just reminds me how much time I'm killing do to how I do lookups!
Anyway, back to p0fv3. Ran a 7 year old pcap file through it, there were about 7-10 devices that it didn't know. Mostly Netware 5 and 6 boxes, a few others that I don't know and would like to, and then a few XP ones that may have been because of the SP they were at or other services. Anyway, sent them on.
Very nice nice program as always mz!
Monday, February 6, 2012
Passive Aggressive Pwnage
15 min fire talk at Schmoocon 2012, mentions Satori in DHCP fingerprinting, which I was happy to see, missed the greater use of it, but at least it was mentioned!
Audio on this sucks, but was worth my 15 mins to listen to and get a few new ideas.
Thanks for the mention of Satori John!
Audio on this sucks, but was worth my 15 mins to listen to and get a few new ideas.
Thanks for the mention of Satori John!
Subscribe to:
Posts (Atom)