Network Forensics - How to get better at

Ok, I like to toy in the network forensics world, but it is hard to get any better at it when I have so little time to dedicate to it on top of everything else going on with life and work!

Lets digress a bit, I like to play a game on facebook, almost 2 years sunk into it when I have spare time, called Battle Pirates.  In trying to track down an issue way back when the game started I realized that it sent some info in the clear about what was going on.  JSON files would provide you with whose ship was going across the map, where it was going on how strong the fleet was.  They might have a simple ship as the lead ship, making it look weak, but seeing it was a lvl 40 fleet you knew it was a farce.  I also realized I could see bases under their fog of war.  At the initial time the only way to find someone was to scout, remove the fog of war and find their base, but by scanning around the map, even with the FOW there I could still see underneath it because the data was on the wire to read if you knew how.

Eventually they lifted the whole idea of the fog of war and I stopped paying much attention what I could pull until I got bored with the game and was about to quit.  I noticed that I could actually tell, based on the JSON files exactly what was on a fleet when it was launched.  Once it was on the water all I could do was get updates on where it was going, etc, but if I was "watching" when it was launched, I could get exactly what was on it.  Only problem was it was in code looking something like this:
...[["create","oid",999999,"level",7,"on","Some User","type",3,"minidata",{"hullid":30},"x",999999900,"y",58500,"fleetid",3]],"updated_at":"99999999.837","transitionid":"99999999","data":{"fleet":{"mpm":0,"ships":[{"weapons":[104,112],"hullID":30,"tacticalModules":[],"armors":[303,303],"actives":{"flt":3,"fltp":1,"hp":192,"bid":99999,"f":1,"rank":5,"id":14},"specials":[550]},{"weapons":[121,104],"hullID":30,"tacticalModules":[],"armors":[310,310],"actives":{"flt":3,"fltp":4,"hp":172,"bid":99999,"f":0,"rank":3,"id":15},"spels":[550]},{"weapons":[104,121],"hullID":30,"tacticalModules":[],"armors":[302,302],"actives":{"flt":3,"fltp":2,"hp":132,"bid":99999,"f":0,"rank":5,"id":13},"specials":[550]},{"weapons":[182,182],"hullID":45,"tacticalModules":[],"armors":[312],"actives":{"flt":3,"fltp":3,"hp":362,"bid":99999,"f":0,"rank":0,"id":27},"specials":[530]},{"weapons":[182,182],"hullID":45,"tacticalModules":[],"armors":[320],"actives":{"flt":3,"fltp":5,"hp":225,"bid":99999,"f":0,"rank":0,"id":28},"specials":[500]}],"fspd":55,"adstats":[],"fnum":1,"mcap":28613,"fid":3}}


It provided me with where it was launched from, the rank and HP on the ship, the armor, any specials, and any tact modules along with the type of ship.

Only problem was looking through what I could find to translate those numbers to actual useful info.

I never did find it in the swf file, but didn't look too hard there, instead, little by little I launched my fleets, compared what I had on them to what it reported and built out a list.

I rarely use the program except to try to spot new ships being launched that I may not have, or to identify new weapons, armor, etc and then ask the people if they are ones I know.

My latest trick was to notice that at the end of the battle you can see what was on the fleet you just battled.  With that in mind and the tweaks they made today to BP, I decided to list out what was on the new fleets.  This is subject to change, as just before this writing, most Drac fleets disappeared off the map as I believe Kixeye may be revamping them due to outcry from those that don't like today's changes, but I digress.  Here are the ones I've checked so far (had to do this manually via a packet capture and my list of numbers as it wasn't programmed into my program to disect this):

29:
1 - LightCruiser (HP:980)
specials[Sonar3,SFB1]
weapons:[D53C,D53M,D53R]
armors:[Unknown93,Unknown93]
2 - LightCruiser (HP:980)
specials:[Sonar3,AA2]
weapons:[D71N,D71L,D71A]
armors:[Unknown93,Unknown93]
3 - Battleship (HP:3188)
specials:[Sonar3,SFB2,Autoload3]
weapons:[D71N,D71L,D71A,D53C,D53M,D53R]
armors:[Unknown94,Unknown94]
4 - Battlecruiser (HP:1478)
specials:[Sonar3,Eng2,HB2]
weapons:[D33P,D33A,D33P,D33A]
armors:[Unknown92,Unknown92]
5 - LightCruiser (HP:642)
specials:[Sonar3,AA2]
weapons:[D35S,D35S]
armors:[Unknown93]

37:
1 - LightCruiser (HP:980)
specials:[Sonar3,SFB2]
weapons:[D53C,D53M,D53R]
armors:[Armor93,Armor93]
2 - Battlecruiser (HP:1732)
specials:[Sonar3,HB2]
weapons:[D33P,D33A,D33P,D33A]
armors:[Armor93,Armor93]
3 - Dreadnought (HP:8749)
specials:[Sonar3,AA3,SFB3,Laser3]
weapons:[D53C,D53M,D53R,D53C,D93M,D93R,D33P,D33X]
armors:[Armor95,Armor95,Armor95,Armor95]
4 - Battlecruiser (HP:1732)
specials:[Sonar3,HB2,Eng2]
weapons:[D33P,D33A,D33P,D33A]
armors:[Armor93,Armor93]
5 - LightCruiser (HP:642)
specials:[Sonar3,SFB2]
weapons:[D53C,D53M,D53R]
armors:[Armor93]

45:
1 - Battlecruiser (HP:2546)
specials:[Sonar3,SFB3,AA2]
weapons:[D51L,D51A,D53M,D53R]
armors:[Armor95,Armor95]
2 - Battlecruiser (HP:2586)
specials:[Sonar3,AA2,HB3]
weapons:[D71N,D71L,D71A,D33P]
armors:[Armor95,Armor95]
3 - Battleship (HP: 5220)
specials:[RA3,Eng3,HB3]
weapons:[D35S,D35S,D35S,D35X,D35X,D35X]
armors:[Armor95,Armor96,Armor95]
4 - Battleship (HP:4515)
specials:[AA3,HB3,HES3]
weapons:[D33X,D33P,D33A,D71N,D71L,D71A]
armors:[Armor96,Armor95]
5 - Battleship (HP:4874)
specials:[AA3,SFB3,Laser3]
weapons:[D53C,D53M,D53M,unknown,D71A]
armors:[Armor96,Armor96]

55:
(1) - Battleship (hp:6378)
specials[Sonar3,AA3,HES3]
weapons:D71L,D71L,D71L,D71L,D33P,D33A]
armors:[Unknown96,Unknown96,Unknown96]
(2) - Battleship (hp:6258)
specials:[Sonar3,AA3,SFB3]
weapons:[D71L,D71L,D53C,D53C,D53M,D53R]
armors:[Unknown96,Unknown96,Unknown96]
(3) - Battleship (hp:6578)
specials:[Eng3,HB3,AA3]
weapons:[D33X,D33X,D33P,D33P,D33A,D33A]
armors:[Unknown96,Unknown96,Unknown96]
(4) - Battleship (hp:6258)
specials:[Sonar3,AA3,SFB3]
weapons:D53C,D53M,D53R,D71L,D71L,D93C]
armors:[Unknown96,Unknown96,Unknown96]
(5) - Battleship (hp:6258)
specials:[HB3,Eng3,unknown],
weapons:D35L,D35L,D35S,D35S,D35X,D35X]
armors:[Unknown96,Unknown96,Unknown96]

One thing I've noticed of late is the armor on the drac fleets is different than what we as players have access to.  Also all the drac hull's, while named the same, are different ID's so they may have different specs than the ones players have.  The weapons and specials, for the most part though all seem to be the same as what we have access to except for some of the weapons and tacticals that were in the last 2 raids. 

Ok, so what does all this have to do with Network Forensics?  Only that you have to get comfortable with looking at tons of packet captures and be willing to go back over them afterwards, because you never know what you may have missed in the past!  The fact that I could see launched fleets and killed fleets was there from my packet captures a year ago, but up until recently I hadn't see it because I was filtering it down to what I thought I wanted to see and missing what I really wanted in the process!

Revenge of the PDU

Your next PDU? Taking the wall wart to the next level. I've been thrilled to see the little wall wart devices for the past 2 years or so and been saying how much fun they'd be in a Pen Test. While this one isn't one you'd want to abandon, due to the cost, it is the ultimate in stealth!

Nothing like having a PDU with a built in computer that phones home!

So many ideas, so little free time....

DHCP dll for Satori updated

Quick note, updated the dhcp dll Satori uses.  I'm getting ~10 times faster processing for DHCP fingerprints now!

Run the updater.exe and look for the latest!

Satori 0.7.4 released

Short Info:
- Had a request from Randy to add a "not" feature to the filter. Added that and fixed the fact that it only filtered existing packets, not new packets. Thanks for the suggestion! Usage is: ![var] or just [var], sorry no ability to use && or || type logic.
- Also fixed a bug he noticed in the MAC Vendor not showing up in cases where it did know it.
- Last but not least packaged Satori with InstallForge (http://www.installforge.net/).

Long Winded Info:
For those that don't want to do a full blown install, nice thing is InstallForge, while making it an .exe it is actually a .zip, so it can be extracted with any zip program. You'll end up with an extra dir, but works sweet even when using unzip.

I had a request to add the ability to do a NOT in the filter. Initially it was simple, the problem came with trying to get it to do more than just what was currently on the screen, ie all those new packets coming in at the same time. While the first piece of code was about 5 mins of trial and error and some logic issues, the piece to get it to update new packets was 3-4 of pain and suffering on my part. Nothing like have 7 year old code that you barely ever look at anymore and try to figure out everything that is actually happening there!

The same person pointed out a few other issues, one of which was that Satori sometimes shows the Vendor of a MAC, other times doesn't, with no rhythm or reason he could see. Initially neither could I, until I remembered that the DNS dll will put an IP down and if you end up going there later it will add the MAC. Problem was I wasn't doing a lookup then, just an update. Simple code change later and I think it is now fixed. Thankfully that was a 10 min fix!

And the last thing he noted was that the date/time stamp of files on my web server were sometimes older than local ones from an install. This has to do with doing the install via a simple zip file and when you extract it it takes "today's" date/time instead of the file depending on the zip program and its settings. It also has to do with the way I pull time locally vs remotely and GMT, so sometimes files are off by a day. While I didn't fix this entirely, I've wanted a decent and free installer program for a long time and I found InstallForge. Works nicely for what I need and I recommend checking them out and donating to them if you find it useful!

One cool feature of InstallForge is it is really a .zip file underneath, so for those of you that don't want to install Satori, you can still just right click on the .exe and tell 7zip, or whatever your zip program of choice is to unextract it and you should be good to go!

Adventures in new machines

Ok, switching to a new machine and moving all your tools to it always sucks, but really, I mean really, it shouldn't be this hard! I've been working on getting Delphi installed on my machine for the past 4+ hours so that I could start working on Satori again (yes it is written in Delphi, I still hate C and C++ though one of these days I swear I'll learn it). Ok, I'm running an ANCIENT version of Delphi, Delphi 6, but I refuse to pay $900 to get the latest version and since I didn't upgrade over the years I can't get by on the cheaper upgrade price of $500, or whatever it was. The saga starts, install Delphi 6. Program from 2001 or so, 1 CD install flies. Launch it, Windows 7 whines, Delphi 7 isn't supported.... Huh, this is Delphi 6, click past the stupid error and it works fine. It didn't like the debugger I don't think, but oh well, it installed. Oh new machine, Borland only lets you install 3 times or so before they make you email in on a rebuild to bump your license count. On a plus side, they got back in me in under 30 mins having bumped my license limit (thanks Bryce, very impressed). Ok, go to open Satori, missing VirtualStringTree, try to install that, missing XP Theme Manager, install that. Missing this component, then this, then that. Damn I'd forgotten how many little components I'd added to Satori over the years (time to write it command line only already, more on that shortly). While I was at it, oh lets go ahead and get the latest version of XYZ, hey why doesn't this work anymore, oh yeah, I'd added my own little code into their file for the convience factor since it needed extended. ARRGGGHHHH.... 4 hours later Satori opens and compiles again! YEAH! Satori cmd line - ok, I made a linux version 3 or so years ago, cmd line only, thinking of expanding that and doing a windows/linux version that is cmd line only. Been doing a ton of Snort stuff lately and the way Snort/Barnyard2/BASE all work together makes me think I should look at doing that again. Get Satori to just write to file as fast as it can, maybe doing the fingerprinting lookup, maybe leaving that to a 2ndary piece of software that would also dump it into a DB. Then get a pretty front end to read it near real time out of the DB. All a pipe dream now, no free time to do any of this, but it is on my mind to do one of these days. If I do do that, I'll be switching it all over to Free Pascal and Lazarus most likely or maybe I'll get real bold and convert the whole thing to C++, wouldn't that be a kick (why do I hate C/C++ so much.....). Anyway, long story short, Satori can be compiled on my machine again and maybe I'll do some updates. Oh and satori is getting used a bit more, more on that in another post down the road.

Forensics Contest #10

Well it has been awhile since they released one to the public, but the Lake Missoula Group has released a new puzzle. Besides just network this time it appears to have some HD forensics required! If time permits I hope to get to this in the near future. You have until 7/23/12 to submit your answers. Contest #10 can be found here.

CapLoader 1.0

I've been playing with a beta of this product for the past month or so.

Straight from Erik's writeup:
Here are the main features of CapLoader:
• Fast loading of multi-gigabyte PCAP files (1 GB loads in less than 2 minutes on a standard PC and even faster on multi-core machines).
• GUI presentation of all TCP and UDP flows in the loaded PCAP files.
• Automatic identification of application layer protocols without relying on port numbers.
• Extremely fast drill-down functionality to open packets from one or multiple selected flows.
• Possibility to export packets from selected flows to a new PCAP file or directly open them in external tools like Wireshark and NetworkMiner.


---

These were observations in the beta versions, they may have been fixed since then:

I found 2 minor glitches when testing the beta and have reported them to Erik. One he found was due to out of wack timestamps in a random pcap I'd found on the internet and the other had to do with the Empty Flows on a 750 MB file that was mostly Empty Flows. For me the Empty Flow option was just something I tested, not something I'd use in what I do on a regular basis.

Overall a very sweet and fast product. I dumped a lot of 750 MB files into it and played around with it over the course of many days in a month. I wish I could get Satori to process files this quick!

Anyway, after processing the file(s), I clicked on the flow I wanted, drag and dropped it into wireshark and got what I was after. So much easier than loading a 750 MB file into wireshark (if it would ever load in the first place and not just die) and then write filter after filter and watch it process the whole file repeatedly. Instead pick the next flow I was after and drag it into wireshark!

The protocol fingerprinting database got a large overhaul between the 2 beta's I tested. I can't say how accurate the determination is as I have not had a chance to sit down and look deeply into it, but I know it is something I want to look at closer in the future.

Microsoft Tokens, Hashes and lots more

Ok, so nothing to do with fingerprinting, but it has been very interesting reading through this series:

#1 - Protecting Privileged Domain Accounts: Safeguarding Password Hashes

#2 - Protecting Privilged Domain Accounts: LM Hashes -- The Good, the Bad, and the Ugly

#3 - Protecting Privileged Domain Accounts: Disabling Encrypted Passwords

#4 - Protecting Priviledge Domain Accounts: Safeguarding Access Tokens

Fingerprint Editor updated to 1.00.09

Jeff updated the fingerprint editor he wrote that I utilize for .xml editing of the files Satori uses. We got the Terms of Service inputted into all of the .xml files now and the UTF-8 encoding fixed with saving of the file when the TOS is there. Some other minor fixes/updates as I believe.

Thanks for the changes!

Satori - update 0.7.3 and most dll's recompiled

I'm busy taking the SANS 503 IDS course, one of the things we do in that course is look at BPF style filters. Low and behold, I use these in Satori to do some prefiltering of packets before Satori hashes through them. While I have complete confidence in my coding skills (brief pause as I control the hysterical laughing fit I've found myself in), it never hurts to preprocess the packets before I get them.

History on the filters, we'll look at the TCP fingerprinting one:
Original:
'tcp'

Noticed vlan tagged traffic wasn't being picked up so, up until yesterday:
'tcp or vlan'

Yesterday first change:
'tcp or (vlan and tcp)' - decent update, meant only vlan traffic that was also tcp got sent to me, but wait, we only want TCP traffic with options, so...

'tcp[12] > 50 or (vlan and tcp[12] > 50)'

So now, instead of having to process all tcp traffic with Satori, winpcap only sends this dll tcp traffic that has tcp options!

Other protocols still read the whole tcp packet, or the whole packet for that matter, but now tcp processing should be a little quicker as I don't have to dig through the packet to see if it is tcp with options, I let winpcap do it. I still check to see if there are options on it and don't assume all is good, but I limit the initial packets that I have to process!

Ok, other updates besides BPF stuff....

Satori 0.7.3 released. Wanted a new .zip file as the last one was 0.7.1 and that was from quite awhile ago. 0.7.2 .exe was released 1.5 years ago! One thing I recently noticed with the update of the oui.txt file is that Satori reads it, but doesn't pick up any new changes in it unless I recompile the .exe. No idea why, on my list to fix some day.

Also released the SIP dll and profile. I wrote these back in 2010 and evidently never released them to the public. Which reminds me, I should probably upload the .xml file that goes with that also which means updating the .zip file that will be missing it also. Oh well, 5 more mins of my life.

Enjoy the updates, let me know if I broke anything as I haven't had a ton of testing time with the new changes as I'm supposed to be studying for SANS 503 stuff right now!

Oh last note, figured out some interesting "glitches" with the vlan tag and BPF, will try to do a different post once I verify it all and get some feed back.