text: what's going on YouTube this is IPC and we're going to be doing knock knck from hack the box which is another Sherlock so it's a defensive challenge so let's just kind of look at the scenario there is a lot of text here um I'm not going to read the entire thing but essentially uh forla the company they left a server open to the internet it got hacked but thankfully they had a packet capture tool running so they gave us a pcap of like one to two days for us to analyze and there's a bunch of questions here um like what ports open UTC time miter attack ID there's a lot of things that we could go um I've summarized a lot of the questions in an obsidian thing just like I did in my last video but I don't like starting with the questions right because if we take this question for example um what ports did the attack or

title: Analyzing PCAP with Zeek - HTB Sherlocks - KnockKnock


text: find open during the enumeration phase I don't like starting there just because um we'll get into it in a minute but there's a lot of data in that log typically I don't start looking for Recon right I like looking for something suspicious and then translating it back over to Recon right um it's just how I generally start things right so um we not going to like we're going to look over the questions but we're not going to focus all our searching around the questions so let's get over into the um actual challenge uh we have the obsidian here I've summarized all the questions but we really just have this one peap file and I'm probably going to surprise you but we're not going to open y shark once and this whole thing hopefully we aren't um I'm doing this kind of live but I don't like starting at wire shark and the whole reason why I don't like starting at wire shark is when I do


text: these type of challenges I like to know if the problem scales right um typically when I worked in doing defensive work I didn't just like look at peaps I would more often than not go to Splunk elastic wherever the scam was do some searches and hunt and gooey tools don't do that well right so we want a way to parse this peap into text um so really the best answer is going to be Zeke it is formally known as bro and the first time I ever run tools like this I generally just do it off of Docker because there's a good chance I'm going to screw things up and if I screw it up in Docker I can just delete it and rep it right so let's just do a Docker pull on this image uh exactly one our oh there we go and we're going to download it um what we're going to do once we get this running is run like share our directory to this


text: container so we can analyze things um and then hopefully once we do this it will make a lot more sense why we're doing it in Z and not using like wire shark right so to start things off um let's do a Docker run uh that's not it I think it's just Zeke sh we can do a A- it before run let's see Zeke Zeke uh DOA run then it there we go so before we run it we want to mount so I'm going to do a-v for volume and I'm going to share my current working directory which is PWD to/ Mount so now when I go into LS Mount we have our pcap file right and if we wanted to analyze it let's just do a bash so have tab aut to complete we can do a Zeke and then- R is like recurse into the packet capture I think we run it and uh let's see I'm not in Mount there we go and it's going to give us an error message let me just move a little bit there we go that still looks good um


text: and whenever it sees these invalid check sums it's going to discard the packet so we're actually throwing a lot of data away um I wish there was a good way I can show you this quickly let's just do a wc- l star. log uh we have 91,000 connections and 15 FTP let's add the flag it said which I think was A- Capital C to um ignore check sums and we're going to rerun it it doesn't give us that error message anymore which is good and then we're going to do the same wc- L and then see the logs right and do this again we have 56 FTP this was 15 before so we definitely have more data now um how do we begin this right we could look at the questions again and go through it like open ports that's probably going to be um what is it uh the connection log but I don't want to start there if you're new to Zeke um I


text: would recommend Googling like Zeke cheat sheet if I could type that would be great go over to Google I think it's going to be on corite yes this is a good one and I would like have this up on your second monitor or print it out um I always had these up on my wall when I did a lot of work um looking at these logs because it's going to tell you all the fields and then things like the connection State it's going to break out the connection state so you know um everything there right and this would easily tell us what ports are open and not just because we can see the responses of packets but we're not going to start there I just wanted to highlight out that cheat sheet if you want to dig more into Zeke on your own so the cool thing about this is um it's just really good at pulling apart everything so we can do good searches um I always start at just


text: looking at anomalies and going with the small thing first so like I'm going to look at Curb roast log just to see what it looks like it's only 10 lines uh we don't have app or less let's just do an appt update and install less here alternatively we could um like go to our host container and do it all there I forgot to change my directory to the Sherlocks there oh well um we'll just live in this container let's see uh what are we looking at oh we were doing Less on curos and there's a lot of um comments there's only really one line and the comments are just so Zeke cut can work this is going to be a unique identifier if we search this line in any log it's going to show us um the data this went to right so if I did a GP on this on st. log and then we do a less- capital S we can see that unique line was in connection uh there is a file related to


text: it um HTTP Cerros weird so um Zeke just thought that ceros packet was odd it looks like maybe it was an HTTP request to a ceros thing I don't know right but that's one of the benefits the really cool thing though about Zeke is it makes a awesome um they have a tool called Zeke cut which you just take the field up top and it will show you right so this is ID originating host so if I just catted this croos log piped it over to Z cut and do id. orig uncore H it shows me all the IPS in that log this one only had one entry so we're going to kind of skip over the cobos log um let's see what do I find interesting let's let's look at all the SSL logs I'm going to look at x509 and SSL because certificates can be gold mines so I always just start with a s- capital S x509 log and then we look at it um let's


text: see we can see Ubuntu let's encrypt this is going to be AWS at the compute.


text: internal AWS uh there's nothing really interesting here we could also if we wanted to um let's see there's the fingerprint certificate version serial uh subject I think is what is interesting in this one so we can do Z cut um certificate subject that was not it let's see certificate. subject that should have pulled it let's just do certificate issuer what is this did this work oh I C Cur Bros log that's it x509 there we go so there's nothing really interesting here um let's move over to the SSL log and let's see uh we can see all the cipher sues so this could be interesting we also got again IP addresses uh how it was like the I think that may be the curve I don't know um let's see server name is going to be interesting but I want to know something else let's see let's just go with Cipher first so if we did cat


text: SSL um Z cut Cipher that's not exactly what I was looking at uh maybe version uh let's do s-u only two versions it's not too interesting always do less- capital S um it makes it nice let's see decode error nothing too interesting in the logs I guess let's just go over the server name and see what is here so we can do server name sort dasu and nothing too interesting um you may see like self-signed certificates like any type of default certificate would stand out but this doesn't look like there's anything fishy in SSL um let's try SSH so SSH dolog and let's see we can see a SSH Goan client this is somewhat odd uh this one is really weird I'm guessing this is some type of Port scanner because it's just a bunch of junk there uh we have SSH 1.5 so let's just look at all of these this is going to be probably the client so cat SSH Z


text: cut client sort uh uni- C sort DN so we can see there's one with SSH 1.5 server hello world this that's odd um I was looking for like Ruby things like that that would indicate Metasploit but this is somewhat interesting um generally when I would be looking at this I would think let's see um we have all these clients let's look at any client that uses multiple SS things because right off the bat the ssh1 is interesting because the only thing off top of my head that uses like like ssh1 would be um I think routers still have it by default like old Cisco routers if you SSH from them they may default to one first but I like just doing a um check on which IPS are doing that is there one IP that sent a lot of SSH clients because that is fishy to me doesn't mean it's bad because it could just be a lot of clients behind aat right but this is just things I like


text: looking at first so we do Z ID originating host client then we can sort it and now we can do a let's see um we do sort dasu uh didn't do the dashu so right now we kind of have this pair of Ip client and I just want to get all these IP client and make sure they are all unique so now when I do a a on the IP and we do a unque - c and then we sort DN we see all these IPS only have one SSH client associated with them which that is not fishy this one has four so this is definitely interesting and Zeke by default doesn't give you a good way to do this um so if we did s. log um and then we just GP for this IP we lose the ability to do a z cut right if I do ID orid it gives me nothing and that's because this GP has erased the comments here right cuz Z cut needs all these comments to operate so what we'll do is we'll do a GP and then we'll pipe uh not


text: pipe but do- e say it begins with a comment or it's this IP and now when we do it uh g- E I have a three now it works so one thing I like doing is creating an alias so we'll call it Zeke grep and then we can say g- e the same thing we just did and then- E and end this so anything we put after this is going to be um the IP so if I did now did a Zeke GP and we give it this IP it just works so now we have Z Gra um so we can do IDE H client and we can see it's these clients I'm guessing this is going to be some type of port scan right or like Ed map Mass scan or something because we did 1.5 2.0 we didn't send one we have a bunch of just garbage data so let's do a GP on this IP and all the connections and we don't have that much right so let's just put uh new file let's say new file I'm going to call this SSH let's do 10 sh log I'm going


text: to uh copy this let's see where is it uh we'll do tail one copy paste and then we can just name this uh SSH unique clients for one IP or something like that it's a bad title uh we probably should have done a tail das5 so we see some that have two but this is generally what I would do and then as I get deeper into the analysis um I'd see if these IPS keep reappearing because this one definitely is somewhat fishy uh let's take a look at what is next so specifically avoiding connection because that just has so many lines uh DNS could be good I don't think files is as useful as it sounds mainly because it doesn't give you the file name um there's a lot of hash zip whatever so I don't think that's going to be that useful FTP is probably good HTTP is go good um let's start with HTTP and then we can move over to


text: FTP so let's see I'm just looking at the fields we have IPS of course um we have the URI that's probably going to be interesting um user agent user agent here I hate how like the column isn't always lined up uh password so so I'm going to look for the password first and then I'm going to look at user agent and then URI that sounds like a good plan so let's cat HTTP log Zeke cut password sort dasu nothing um username nothing user agent and we get a hit uh we have a few user agents we have Debian WG and AWS SD K so this could explain the golang SSH client right that could just be something in AWS but let's just do a sort now on user agent and then like doing a uni- c and then a sort DN and we see there's only one WG request so let's see who that was so let's just do a um Zeke grap on WG and then we can say uh let's see


text: um URI let's do ID originating host ID responding host the URI uh user agent and I forgot to say Zeke cut and I got these backwards ID period like that I always for some reason mix that up so we see we have a malicious file and W get here so let's save this and put it in the HTTP log so let's new file let's do 20 HTTP log um paste this and what we're going to say is um ransomware download WG and that is probably going to answer um what tool was used to download the ransomware we have a tool right here so we can put um 20 HTTP and then I'll do a carat and we can just click that so now that's linked directly to this um let's see the next thing we want full URL to the ransomware um I'm going to guess it's this we probably need to get the host name this came from right so that could be that we don't have the IP so let's


text: do um ID responding Port that is Port 80 so this is going to be HTTP I looked at 80 versus 443 because it was 443 we'd get the host name from the SSL log right because we'd see that um certificate so we want to get this server's host name so what I'm going to do is a GP on this on all log files and let's see if we have anything interesting we have connection files and HTTP I don't think we actually have the host name in this log we don't so it's probably going to be if it wants the IP address it could be HTTP like that so the answer is either this or just the URL right um so let's just put this in 20 HTTP log and again we can comment that so let's see we got those two um I'm going to rename it to ZZ showing we have answered it what was the ransomware it's a zip file we're not actually extracting the


text: files yet um we'll get into that in a minute or probably later in the video so uh we can't answer that one uh there's a lot of other questions let's go to the FTP packets so let's cat FTP log um just pipe it over to less first and let's see we have some username so Tony Sheppard Abdullah yasen uh let's see urls and the password is hidden we want to be able to unmask this password right um the reason why it's hidden because again we're using Zeke in a command line way it's also the ability to U monitor packets in real time so you just set up a span port or a mirror port and then point Zeke at that um network interface and it does all this live puts it into files and then you can go inest it into whatever seam you want right or spunk elastic whatever and then search through it you generally don't want to put passwords in that so that's why by


text: default it is hidden but we can also unhide it right so let's do that um so let's see I'm going to find sluser grap FTP doz I want to say probably or we can do grap FTP grap Zeke and we want to edit the actual FTP script well we could create a new one I find editing it to be quicker so protocols main Zeke uh we don't have V so let's install them yep and we're probably going to I'm trying to think there's two things I want to do I don't know if I want to show both I guess we can so this is going to be the logged commands uh we're going to edit this in a minute to log more uh those are guest IDs that are considered Anonymous but I'm going to search this for hidden and we see there is one that says if the password field um is not a guest which is like Anonymous things like that then replace password with hidden we don't want that so let's um


text: comment all this I should have done a block comment oh well that's fine so if I reprocess it with Zeke um- c-r it's going to take a second and then we're going to look at the FTP log and see valid passwords because it won't be hiding them anymore um the other thing was the logging commands right we can see um these are the commands that are logged I want to say pass is a command P SS and since that's not logged we're not going to log invalid attempts so if we look at this we can now see passwords so I'm guessing Tony Shepard's password is summer 2023 abdulla yon's password is that thing that is weird that he has the and who OD at the end but now we have passwords so what we could do is actually let's um log everything uh let's see FTP tet login example I'm doing the toet because this is going to tell me all the commands and what we want to log right


text: so they do user and pass I want to log pass so I'm going to do comma pass here and I'm going to do a wc- l on ftp.com more files and I think there's one thing I've been forgetting to do in Zeke but we'll get to that later wow we have a lot more we have 1,134 right so let's do l-s on FTP and we have a lot of login incorrects I wonder if I should do like a Zeke recursive grap so we could remove things um let's see so we have the Alias for that Zeke d e let's see um I don't know what to call this Zeke vrep because we add a-v here let's try this let's see if this works um so let's do cat FTP log Zeke GP and then what do we want to put in here um Tony do we have invalid passwords for Tony though yes we do so we're going to do grap one Tony and we can also say Zeke vrep to hide things on um what was incorrect was it I'll just


text: do correct awesome that worked the reason why I did correct is I wasn't sure if it was a capital I like like that or like that so I just took a portion of the phrase so now we can hide grap and show so um Tony's password so let's add to FTP let's go 30 FTP log and and we can say passwords um it's probably incorrect with the capital I it is not lowercase i okay so let's get rid of that and we can say Zeke cut probably username password that's not it l-s FTP log what is it user and password I think let's do user sort dasu no uh cat FTP log uh g-v incorrect l-s let's see user password oh shoot um my alias uh did a recursive GP for the first thing so the V grip did not actually work um let's see can we do it like this we can say g- e g-v like that so this- V applied to this and was also hiding all those lines which we don't want we probably didn't


text: need that at all let's see what this does that's not good uh we can just say vrap we don't even need a vrep actually let's see cat FTP log g-v incorrect l-s yeah because incorrect isn't in any of these fields so we're fine that's good okay Z cut user password sort dasu and we have credentials so there we go so one thing we had if we showed all the incorrect was just a lot of brute forcing right let's see let's just show passwords um Zeke GP incorrect Zeke cut uh let's do user password so we definitely have a lot of password spraying right so this is probably going to be one of the miter questions uh we have 1,75 failed login attempts so say fail logins then the other thing I want to show is going to be the IPS doing this so we can say ID originating host and then sort uni- C sort DN and we have two host that are doing the um


text: spray um unique host so these are definitely our attackers now we have finally found two attackers most likely um let's grab star. log for the 120 IP and let's see that's the connection log FTP log let's see a-f print one sort uni- C so he appears just in these two lines let's create a new thing IP of Interest and then we save this and now we want to look at that other guy the 3109 so let's do the same thing see how many times this guy goes he's in a lot more logs we even got a DNS name for him potentially or maybe he's making a DNS query so that's the IP I'm going to start with just because we have more data on him right and we can do the same thing 3 109 20943 uh FTP spray Okay so let's look at him in DNS we could also get his SSH Banner potentially so let's grab this and what we going to say


text: DNS uh sure that's fine let's just look at DNS log what do we have I think he was making a query actually it'll be easier let's go to the cheat sheet and show example of using this so DNS log we don't care about the time stamp that much uid ID query that's what we want we want query so cat DNS log Z grap IP Z cut ID array Orting host ID responding host and um query so he's just making DNS queries we don't actually get um who he is wait oh this is an e uh AWS HST it's an ec2 um we have this IP quering the DNS server this is an internal IP right the internal IP is quering the DNS server most likely for who this guy is and we're getting the reverse lookup right so we know this is an eect host um how reverse lookups work is they put the last octat first right so the IP goes in reverse for the reverse lookup so we now know


text: um this guy is in AWS it's an ec2 instance so that is awesome um let's see what else do we want to do I guess I guess now let's look at the questions um is it open ports or what was that question exactly um I guess let's just answer the open ports I don't know if that was it but we can answer that uh open ports of what though I'm going to ignore that question let's do UTC time of start of attack sometimes summarizing them does make for a painful thing so I'm going to say uh let's analyze connection. log so we'll cat connection. log um l-s let's see what do we have um let's just do the originating host and see who's the most chatty so we can do a Zeke cut on ID originating host wc- L uh whoops sort uni- Z sort uh numbers and this is the most chatty and it's 65,66 whenever I see like 65,000 I assume that's a full port skin because


text: there's 65,535 ports so that's a coincidence right so let's look at this guy um let's do cat connection log uh less actually let's just do let's check our port scan Theory so we're going to do a Zeke GP on this IP then we can do the Z cut I'm going to leave the ID origin host just so we know it and we do ID origin port and we can see it oh wait it's not going to be originating port that's the ephemeral Port right we actually want the port on the other end of that connection and there we have it this is the port scan he's scanning 1 through 65,535 sequentially so what we want is to get the time stamp of this and that field packet is TS and we have the very first Port starts here um we can just do let's see do tail das1 so we have that then we do a date- D and then at the epoch time whoops did not mean had enter so quick and we have the time so this is when the


text: attack began so I'm going to um grab this do 50 attack or this will be connection log and we can just paste this in so there we have that let me just clean this up to remove the invalid entry and UTC time start of attack let's just put this here connection log uh do a carrot and we did not label it so start of attack there we go awesome so miter attack ID of initial access I'm guessing this was FTP Brute Force um right because that's what we saw uh with this password spray so let's see miter attack ID Brute Force FTP this is probably going to be it uh initial let's do this um FTP brute force and we can link our FTP in so 30 password spray okay let's say that's done that's done valid credential for the foothold um I'm going to guess it was the spring one right because we knew it was a password spray so knowing that the


text: attack starts with um the password spray and they were using um season year I'm going to guess this was the initial foot hold this probably would not be in a password spray unless it's credential stuffing which like they compromize a website or get a database dump get users and throw the passwords the user had on other websites into it but I'm going to guess it's summer 2023 just because again we know they were doing a password spray so we do that let's again link our FTP log so we know it's there just in case the question is wrong we have an idea where we got that from right so that's done malicious IP initial access that is that 3109 most likely so I'll do that again um let's put this in connection log we could link a lot of these here right we got the start of attack um we got the FTP log of


text: password spray uh what else did we see this IP in right um IP of in I can just also link this right so uh 40 we're putting all our evidence against this guy there we go I should have been doing that more um critical Service Port critical service exploit tactic so I don't know know what this one's going to be AWS creds Abdullah that could be the password we got in FTP um what was the ransomware full path for SSH access I'm going have to pull the questions up again but let's now extract files right uh we haven't done that at all and there's one thing I have been missing that we may have missed some data um let's do a wc- l star log s-n uh let's remember 1134 for FTP so let's see let us do a Zeke again I'm going to add local at the end and this is probably going to run some more scripts I really should have done this to begin with but I forgot to run


text: that last flag and of course that's going to miss things unfortunately um this essentially is going to run local. zek which is the default Zeke collection thing that may get more right we have like extra things loaded scripts so we didn't run all the scripts there's now a Telemetry notice um did we have ldap before there's a software log so there's more scripts we could look at um we probably again should have but yeah so like software logs in some software used we have WG with one instance there but that's not the end of the world there wasn't really that much new things here um let's see we wanted to get the files and I thought about that because let's find local. I always say user when it's just USR uh local doz why did that find more oh because user local Zeke the period was a wild card so this is going to be the


text: script that runs right let's just do a g-v for anything that has or starts with a comment and then grab here uh on local Zeke and then grab for a line so this is the Z config um it's telling what scripts to run and one of the scripts that's running is not going to be a um what is it what is extract files that's what I was thinking um so we want to go we want to find what directory this goes to it's probably up to and share uh let's just go here is there a protocols find.


text: grap let's grap this real quick share Zeke okay so share Zeke policy so just do a find here grap for extract and we want to do let's see base files proba policy Frameworks extract all files so let's run this into a z config share Zeke site uh CP local would do custom.


text: zek and then we can just add that we need at load I don't think we do policy is it just framework they have a policy there so I'm going to have a policy here okay let's go back to Mount um gp-r Zeke and instead of local we want custom so hopefully now we're going to have a extract files directory and that extract files directory will um contain all the files in this capture so we can then pull that ransomware out and then once we get the ransomware I'm probably going to pause the video so I can get back up into my hack the Box account so I can understand the questions better cuz the cliff notes did not help me so there we go we have a list of all the files um file command not found uh let's do apt install file that's a pain painful thing about working this stalker right so we have a lot of just metadata of it but we wanted


text: to do is pull that ransomware file so that ransomware file came out of HTTP log right so let's cat HTTP log um Z grap we'll do W get do a l-s and there is is a uid right let's see we could probably just grab this ID right let's see LS extract files GP for that can't use uid of that line there's another ID um original follow you IDs that's probably it so again if we did Z cut or Ridge fuid what was that original file name is blank fuds that's not it I just want to know what that field is called it's probably this field but I do want to know uh what it was so file names nothing then MIM type that MIM type looks fine oh that's response M type so that's the end so that's response file name then response file uid so the orig that's probably be file uploads there we go that's the uid we want hopefully when we look and extract


text: files for this we have a file if we do a file against it uh cannot oh we have to go extract files then this we can see it's a zip archive so we could unzip this which I'm going to guess unzip is not on this container right apt install unzip I would probably go over to my host and then run unzip but uh doesn't matter either way works let's see if I was not a zip file or extract files unzip let's see let's CP this up one ransomware doz mior analysis move ransomware now oh my God analysis ransomware doz okay this file is not a zip what do we AP install let's try seven zip uh let's just go to my host so this is where we P it unzip ransomware it is 100 Megs even so I wonder if extract files had a limit of a 100 Megs on it and that's why it did not unzip see can we benw walk it I don't have benw walk on


text: this but I think we got the answer um ransomware Source the name is Gunna cry right so let's see what was the ransomware it's going to cry and this is um in the file and that is we linked the file and 20 HTTP log oops there we go so that question is answered and I'm going to um pause the video put the questions back up so we can see what open ports and um this stuff means well this is probably just FTP file containing config and creds let's just start with that let's just go with it and see how much we can answer uh so let's see cat FTP let's look at all the files um file uid file size where's a name see let's just search for file size and then we can get name or go to the cheat sheet uh DNS FTP unique file ID reply message file size ARG ARG is probably what we want right or command command and ARG


text: so cat FTP zcut command Okay ARG there we go so retrieve so RR is what we want so let's do a Zeke GP on r if I can type there we go so we have a few files we have backup fetch archive task to get done reminder pass to be Shadow so here we can do fuid and get all the file U IDs so backup let's C extract files and then let's just grab this file so this is the port knock I think SE quence okay so let's see let's put this in FTP log um good files there we go so I think that was a port knocking question we'll just go at the end and input everything but I think it's what sequence require um do you have to do to open like the port knock I think that's it so let's do dash dash this was in FTP and good files there we go file containing config and creds so this doesn't contain that uh let's see fetch what is


text: fetch um we have username and password F uh SQL so let's put this here uh let's see I should create another one of creds and let's do FTP there probably a way to do this better um like an actual table I forget how to do a table and markdown uh see markdown table it's probably like um Proto user password FTP test password I know it uses these pipes let's see markdown table there we go awesome then we got FTP Tony Shephard summer 2023 bang okay that's better um I'll call this hint I don't know what better feel for that name but we have Tony Shephard Game of Thrones rocks so this will be um f SQL file FTP Tony Shephard and copy this okay so we know the file that was this was is was it fetch fetch. sh that contain credentials let's see there's also archive SQL so let's check this grab that and this is a SQL database uh we have


text: Alonzo I'm guessing this is a key so what is this table so we got name account ID and passord password so name is going to be Alonzo account ID password so nothing there here we go so we can go back to credentials and this is um DB FTP I probably should just put the file name right um this was archive.


text: SQL and there we go that' be his password so we also have arive SQL so ports to access so that's probably going to be the open ports one the ports require to access critical service right so what is the fetch um we want to grab this file so we send these ports it's going to allow access to this port what port is that uh let's see FTP so this these ports allow access um you see time to access critical service reject I am going to guess it's this one this is when they first logged in and it's coming from the malicious IP right so let's see here it is date- d and I'll just say first login Abdula bad IP this is maybe password spray oh no um they got his password somewhere let's see where is this password stored let's just grip everything for this or so what I'm doing here it's a field separator and we see got it from this


text: file oh oh this is a different file um I thought this was the uh Port knock maybe it is is that it is that what I have been getting um grap this on FTP log backup so let's see valid creds it's going to be this see ports to access when did the CER arrive we probably get some of these questions wrong just because I've summarized it and that made it hard I've not actually done this um Sherlocks before so that's why it's kind of getting confusing when I answer these questions I don't know what service this is deadline hiring devs uh grap D I hire on extract files we have this file how did what just happened there okay that's a Debian binary package that is not it um it's probably going to be in the FTP log one of these files maybe reminder.


text: text let's grab this file or maybe it could be that doc X I was just avoiding the doc X cuz I didn't feel like opening a wood document Pakistan task to complete um he has to arrive there we go account withth a shell we saw it past WD so let's grab this grab everything that ends in sh don't know which one they're asking for there's a few there see full path SSH password okay I'm going to pause the video let's start inputting the questions um I just got to log back in to hack the Box okay I am now logged in and the first question is a little bit tougher than I expected we have to guess or know what ports the attacker found open during their enumeration phase right and this can be found I guess somewhat easily this would be a pain to do in wire shark I think so this is where Zeke is going to definitely shine um we know the bad IP is this 31091


text: right so let's go to the connection log so I can cat con log uh we can do a Zeke GP on that IP and then what do we want to see we probably want to look at the um what says reject here whatever that is connection state is what we want so let's do a z cut and we want ID um the responding Port I really confus that one so this is going to show all the ports and then we want connection State and SF is probably going to be open um if we went back to uh where is it this cheat sheet um SF means normal established and termination so this is definitely going to be it was open and there's a lot of ports here because keep in mind we did a port knock and once we did a port knock all the ports got exposed so we could connect to everything right so um we want to do everything after the port knock and we could do it based upon time stamp right we could look for when the


text: time stamp happened and then grab everything before that that's probably the easy way to go about this because once the port knock happened a lot of ports opening and it is no longer the keyword being um a numeration phase right but what I could also do is because we did a full port map I'm going to do this connection State and we're going to GP for everything that's rejected right because we scan ports 1 through 65,535 or at least that's our assumption and got a rejection notice this is before we did the port knock so I'm going to say um AR and we're going to make a big filter right I only want to print the second field here and that's going to be all the ports now the tricky thing is um I can't just do um what is it like a g- v on 443 because 45 443 would also match and before I do this a or after I do the a I


text: guess I want to do a let's just do a wc- l and then we can do sort d wc- l does that shrink it much it doesn't I'm not going to worry about that because that's only like five lines so we want to put quotes and say it starts with and it ends with so now we have this and I'm going to call this rejected. log I'm going to put this in analysis and we want to get all the accepted right so let's change this for SF and we no longer need these and I can just do accepted.


text: log so if I cat accepted. log we have a list of all the ports uh this may be uh let's do sort wcl 93 yeah so let's just do a sort dasu and move T to accepted because that greatly lowers so this is all the ports that we connected to successfully or that malicious IP connected to again Port knock opened everything up so we just want to filter all the ones that we ever saw a reject for coming from it out so I'm going to do a g- v-f and rejected. log and this could take a little bit but what we'll be left with hopefully is just a handful of ports because um we saw a bunch of rejects hitting it right so let this finish I guess we can look at this while it goes what UTC time did it begin let's check our time stamp uh let's see UTC time it's probably gonna be this I don't know what format it wants


text: it that's annoying it's not the format I have so DayDay that's 21 um I think March is five ah shoot it went away um year year year hour hour minute minute second second so we can say 2023 I think March is actually three right my brain is just fried right now 10 4223 hey it's correct sweet that was going to be embarrassing if I got that wrong um miter ID let's go here we think this is it submit oh that's not it wonder what that is merer ID password spray could it be not Brute Force but a password spray this is the thing I really hate about miter so many things can be classified multiple ways right hey it's password spray so we can also put that in notes okay that's done is our thing done it is so 21 22 3306 so we have them so 2122 my SQL was open to the world that is bad 6379 8086 submit okay valid scent of credentials to get the initial foothold so that


text: would probably be Tony Shephard right so let's go to creds it's turn Shephard and then summer 2023 cuz that was a password spray so it looks like the attacker did a password spray they got access to FTP they started downloading files and it was all over after that because they had passwords in files which is somewhat common uh what file contains some config data and credentials uh let's see do we have a list of files I don't think I saved that uh that was probably fuid if I did that uh no oh yeah that is it I think retrieve there we go it's probably dot backup I would think see what port was the critical service running uh let's see what port was that I think we answered this task seven we did not let's see Z cut command argument fuid let's get id. original Orting uh responding Port so it's probably


text: this looks like there's two ftps and that's probably um yeah so this is going to be the attacker Port the ephemeral port and then FTP it's either a second FTP server or uh the session just redirected them to this um Port so let's try this one what was the technique name to get to that critical service don't know let's skip that one real quick or actually let's see where does this go in logs that's FTP we may actually have to open this one up in wire shark which I'm going to hate because I want to do this without wire shark it's probably like password spraying or sensitive file right because he downloads fetch. and soon as he downloads fetch. sh he logs in as Abdullah right um oh it's probably Port knocking that's it there we go so he downlo fetch. sh this file was the port KN file right if we grab this let's cat um extract files


text: this or this is my SQL uh before that file let see you download Dot Backup andt backup this was the one that had Point knocking right yeah so this is the port knock thing there were creds at the bottom of this so he got the creds did the port knock and then accessed the critical service um the port knock ports I know I have this in my notes but since it's right here let's just put this oh oh ascending order let's see just because I can't count or I can't visualize that okay they're all the same number of digits so it's the 295 like that okay I thought one may have just been like an extra digit long or something UTC time when the interaction with the previous ports ends UTC time when interaction oh so we probably want to look at all these ports and get the time stamp okay so let's see um V Port knock. log let's put these


text: all on separate lines and again uh that's done backwards and this is so we can just do GP with the file and GP for these three things so cat connection log and then we want to do a Zeke grap on the IP I say was like 3109 do we have it here 3109 20943 okay and then we want to say uh Z cut on i d is it no um I think it's ID responding Port there we go we also want to grab the timestamp and then g-f Port knock do log that did not do what I expected it to do oh because it doesn't begin with is that a tab or a space I'm going to hope that's a space that's not there we go okay so let's see UTC time stamp when it ends so it looks like the port knock actually happens twice now does it want the first one or the second one see 299 54 so it looks like this is a failed one it probably like the point knock needs to be specific sequentially um and the


text: port knock went 29545 so I'm goingon to guess the question's answer should be this and it has to be sequentially I think because if it was just you hit these ports in any order then the full port scan would have triggered the port knock right and we wouldn't have got the 65,000 rejects it would just started magically saying every port is open so it's got to be this the last one uh let's see day day let's do 2103 20 23 then 1050 850 okay valid set of credentials for the critical service the critical service that is the second FTP so let's go to ceds uh this so we can grab this and then paste this okay what time do the attacker gain access to This Server um let's see we probably had that in our logs but this is easy enough to get let's just do cat FTP Zeke grap um 3109 20943 and then how do you spell the name is that


text: good enough it is let's see login successful so this is the time stamp date- d uh so that is 21 March 2023 1101 like that okay AWS account ID I'm just going to go into the notes for this one this was grabbed from the database backup that we pulled I think it was backup uh let's see the creds and we have oh was it account ID it said account ID and password I don't think it's this I think the account ID was the digit right yeah for the developer Abdullah so we have to go back into um that so is it backup let's just cat extract files this nope oh let's get all the files names again let's see archive. SQL this is the file we want cat extract files okay so we want this and then the password submit okay deadline for hiring new folks that's probably going to be in this um file I did not feel like downloading this doc


text: X so let's CP extract files star to analysis called task. docx and hope I have open Office installed uh might just do open tasks yes I do let's see deadline uh deadline for hiring new developers High 20 developers 830 2023 08 uh 208 2023 what is it 30 it is there we go uh when was he scheduled to arrive that was definitely in one of these logs 8 March 2023 so wow it just changed time formats on me oh no it didn't did it yeah no it did not um 03 did it it did that's weird okay the attacker was performed directly traversal to escape the CH route jail this caused the attacker to roam around the file just like a normal user word what was the username of the other account other than route having b bash so that was the past WD uh we can just pull that again quickly fast WD I'm pretty sure I save


text: this yep grab bash so it's either Ubuntu or cyber Junkie I'm going to guess cyber junkie but let's look at the other files real quick just to see if there was another thing we could have done uh they did who am I oh they downloaded The Who Ami binary opt reminders CPU info no so it's probably cyber junky I said that because it ended with E and Ubuntu did not um what is the full path of the file which led to SSH access by the attacker um full path is it Etsy shadow let's proba this what is this file opt reminders uh cat extracted files this reminder to clean up the GitHub Reaper some sensitive data could have been leaked there okay so we need to get the SSH password and if we read this there was a warning that said this shock will contain element of os int to complete fully so I'm guessing uh based upon the reminder we have to go to the GitHub repo uh let's


text: see so let's say does GitHub is it for how do we spell forla uh where is it forla do they have anything forlo Dev it is loading GitHub let's go to code cyber junkie is here so this looks good if we go to this is there any password uh the passing sh pass but have sh password there is a history though um update update let's just go to this says comments there we go so in the get history there was the password and I wish this was not that common but you'd be surprised what you find in get history so put that password there we go full URL to download the ransomware and we have that in our notes and let's see I was guessing it was the HTTP full URL okay what tool this was WG so w get1 121 and the final question uh we assume that was going to cry based upon um the file names and the zip right put this in and we have completed the Sherlock so


text: hopefully you guys enjoyed that video that was a lot longer than I ever expected it to be but hopefully you enjoyed playing around in Zeke and once you play around in the Zeke command line long enough you realize um how to do the searches on elastic or Splunk and then you can do these type of hunts live right you don't have to just get handed a peap it's really nice to be able to do live hunts put things in a dashboard things like that so definitely check out Zeke if you haven't if you're in this field but um that's going to be the video take care and I'll see you all next time