CS Network Assessment

                            ###################################
----------- ############### # Day 1: External Network Mapping  ################ -----------
                            ###################################


###################################
# Setting up your virtual machine #
# Note: run as root user          #
###################################


Here is where we will setup all of the required dependencies for the tools we plan to install
---------------------------Type this as root--------------------------
apt update
apt-get install -y libpcre3-dbg libpcre3-dev autoconf automake libtool libpcap-dev libnet1-dev libyaml-dev libjansson4 libcap-ng-dev libmagic-dev libjansson-dev zlib1g-dev libnetfilter-queue-dev libnetfilter-queue1 libnfnetlink-dev cmake make gcc g++ flex bison libpcap-dev libssl-dev unzip python-dev swig zlib1g-dev sendmail sendmail-bin prads tcpflow python-scapy python-yara tshark whois jq nmap python-setuptools




Some tools to install:
---------------------------Type this as a regular user----------------------------------
wget --no-check-certificate https://dl.packetstormsecurity.net/UNIX/cgi-scanners/Webr00t.pl
wget --no-check-certificate https://dl.packetstormsecurity.net/UNIX/scanners/blindcrawl.pl
wget --no-check-certificate https://dl.packetstormsecurity.net/UNIX/scanners/propecia.c
wget --no-check-certificate https://raw.githubusercontent.com/craig/ge.mine.nu/master/lbd/lbd.sh
gcc propecia.c -o propecia
sudo cp propecia /bin
wget --no-check-certificate https://raw.githubusercontent.com/BenDrysdale/ipcrawl/master/ipcrawl.c
gcc ipcrawl.c -o ipcrawl
chmod 777 ipcrawl
sudo cp ipcrawl /bin

git clone https://github.com/jmbr/halberd.git
cd halberd/
sudo python setup.py install

git clone https://github.com/EnableSecurity/wafw00f.git
cd wafw00f/
sudo python setup.py install
-----------------------------------------------------------------------





###########################
# Target IP Determination #
###########################
---------------------------Type this as a regular user----------------------------------
cd ~/

perl blindcrawl.pl -d cellularsales.com
-----------------------------------------------------------------------


-- Take each IP address and look ip up here:
http://whois.domaintools.com/



Host discovery of the IP space:
---------------------------Type This-----------------------------------

./ipcrawl 74.221.176.0 74.221.191.255 | grep cell


sudo nmap -sL 74.221.176.0/20 | grep cell

----------------------------------------------------------------------




###########################
# Load Balancer Detection #
###########################

Here are some options to use for identifying load balancers:
    - http://toolbar.netcraft.com/site_report
    - https://addons.mozilla.org/en-US/firefox/addon/live-http-headers/


Here are some command-line options to use for identifying load balancers:
---------------------------Type This-----------------------------------
dig cellularsales.com


./lbd.sh cellularsales.com


halberd cellularsales.com

-----------------------------------------------------------------------


######################################
# Web Application Firewall Detection #
######################################
---------------------------Type This-----------------------------------
wafw00f.py http://www.cellularsales.com

sudo nmap -p 80 --script http-waf-detect.nse cellularsales.com


sudo nmap -p 80 --script http-waf-detect.nse cellularsales.com

-----------------------------------------------------------------------


########################
# Scanning Methodology #
########################

- Ping Sweep
What's alive?
------------

---------------------------Type This-----------------------------------
sudo nmap -sP 74.221.180.*

-----------------------------------------------------------------------



    -if -SP yields no results try:
---------------------------Type This-----------------------------------
sudo nmap -sL 74.221.180.*

-----------------------------------------------------------------------



    -Look for hostnames:
---------------------------Type This-----------------------------------
sudo nmap -sL 157.166.226.* | grep com

-----------------------------------------------------------------------



- Port Scan
What's where?
------------
---------------------------Type This-----------------------------------
sudo nmap -sS 74.221.180.*

-----------------------------------------------------------------------



- Bannergrab/Version Query
What versions of software are running
-------------------------------------

---------------------------Type This-----------------------------------
sudo nmap -sV 74.221.180.*

-----------------------------------------------------------------------




- Vulnerability Research
Lookup the banner versions for public exploits
----------------------------------------------
http://exploit-db.com
http://securityfocus.com/bid
https://packetstormsecurity.com/files/tags/exploit/



--------------------------------------------------------------------------------------------------------------------------------
		################
		# VPN Auditing #
		################


####################
# Install IKE-Scan #
####################

---------------------------Type This-----------------------------------

sudo apt-get install -y ike-scan

wget https://raw.githubusercontent.com/0x90/wifi-arsenal/master/IKECrack/ikecrack-snarf-1.00.pl

-----------------------------------------------------------------------


#############
# Discovery #
#############

---------------------------Type This-----------------------------------

[root@Linux j0e]# ike-scan -M 24.24.0.0/16 <--- Discovery of VPNs


[root@Linux j0e]# ike-scan -M --aggressive 24.24.0.0/16 <--- Discovery of VPNs in agressive mode

-----------------------------------------------------------------------


##################
# Fingerprinting #
##################

---------------------------Type This-----------------------------------

[root@Linux j0e]# ike-scan -M --trans=5,2,1,2 --showbackoff 24.24.1.151 <--- Fingerprinting
-----------------------------------------------------------------------


	*** If you are really having trouble figuring out what VPN is, then you might wanna try some different transforms.
-----------------------------------------------------------------------
#!/bin/sh
# generate-transforms.sh
# Encryption algorithms: DES, Triple-DES, AES/128, AES/192 and AES/256
ENCLIST="1 5 7/128 7/192 7/256"
# Hash algorithms: MD5 and SHA1
HASHLIST="1 2"
# Authentication methods: Pre-Shared Key, RSA Signatures, Hybrid Mode and XAUTH
AUTHLIST="1 3 64221 65001"
# Diffie-Hellman groups: 1, 2 and 5
GROUPLIST="1 2 5"
#
for ENC in $ENCLIST; do
   for HASH in $HASHLIST; do
      for AUTH in $AUTHLIST; do
         for GROUP in $GROUPLIST; do
            echo "--trans=$ENC,$HASH,$AUTH,$GROUP"
         done
      done
   done
done
-----------------------------------------------------------------------
---------------------------Type This-----------------------------------
[root@Linux j0e]# sh generate-transforms.sh | xargs --max-lines=8 ike-scan 24.24.1.151 <--- Fingerprinting

[root@Linux j0e]# ike-scan -M `perl -e 'print "--trans=2,3,4,5 " x 20 . "--trans 5,2,1,2";'` 24.24.1.151

[root@Linux j0e]# ike-scan --trans=5,2,1,2 --vendor=4048b7d56ebce88525e7de7f00d6c2d3c0000000 --multiline 24.24.1.151

-----------------------------------------------------------------------
################
# PSK Cracking #
################

---------------------------Type This-----------------------------------
[root@Linux toolz]# /usr/sbin/tcpdump -nxq > logfile.dat
-----------------------------------------------------------------------

			or

---------------------------Type This-----------------------------------
		windump -nxq -s 1500 port 500 > logfile.dat
-----------------------------------------------------------------------

	*****make connection attempt with VPN client, then stop the log capture.*****
	Because the VPN uses PSK you can do this without a password so this logfile
	will contain the actual PSK, and ikecrack-scarf will bruteforce it for you.

	You have to attempt your connection with the VPN client software for that
	specific VPN, and the VPN needs to be in agressive mode.

---------------------------Type This-----------------------------------

[root@Linux toolz]# perl ikecrack-snarf-1.00.pl 24.24.1.151.500
-----------------------------------------------------------------------

	*****IKECrack by default looks for "logfile.dat" in the current directory*****




----------------------------------------------------------------------------------------------------------------------

---------------------------Type This-----------------------------------
[root@LinuxLaptop toolz]# ike-scan -M 24.24.1.0/24
-----------------------------------------------------------------------

Starting ike-scan 1.9 with 256 hosts (http://www.nta-monitor.com/tools/ike-scan/ )
24.24.1.0       Notify message 14 (NO-PROPOSAL-CHOSEN)
        HDR=(CKY-R=ba78bba863d98025)
24.24.1.1       Notify message 14 (NO-PROPOSAL-CHOSEN)
        HDR=(CKY-R=e9ba2df614761ad3)
24.24.1.2       Notify message 14 (NO-PROPOSAL-CHOSEN)
24.24.1.151     Main Mode Handshake returned
        HDR=(CKY-R=30a3910882ffea48)
        SA=(Enc=3DES Hash=MD5 Group=2:modp1024 Auth=PSK LifeType=Seconds LifeDur ation=28800)
        VID=4048b7d56ebce88525e7de7f00d6c2d3c0000000 (IKE Fragmentation)
24.24.1.162     Notify message 14 (NO-PROPOSAL-CHOSEN)
        HDR=(CKY-R=0000000000000000)
24.24.1.169     (24.24.1.162) Notify message 14 (NO-PROPOSAL-CHOSEN)
        HDR=(CKY-R=0000000000000000)
24.24.1.236     Main Mode Handshake returned
        HDR=(CKY-R=f31f790c32b65404)
        SA=(Enc=3DES Hash=MD5 Group=2:modp1024 Auth=PSK LifeType=Seconds LifeDur ation=28800)
        VID=4048b7d56ebce88525e7de7f00d6c2d3c0000000 (IKE Fragmentation)

Ending ike-scan 1.9: 256 hosts scanned in 39.640 seconds (6.46 hosts/sec).  2 re turned handshake; 12 returned notify

---------------------------Type This-----------------------------------
[root@LinuxLaptop toolz]# ike-scan -M --trans=5,2,1,2 --showbackoff 24.24.1.151
-----------------------------------------------------------------------

Starting ike-scan 1.9 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
24.24.1.151     Main Mode Handshake returned
        HDR=(CKY-R=82c51aa0ae799258)
        SA=(Enc=3DES Hash=SHA1 Group=2:modp1024 Auth=PSK LifeType=Seconds LifeDuration=28800)
        VID=4048b7d56ebce88525e7de7f00d6c2d3c0000000 (IKE Fragmentation)


IKE Backoff Patterns:

IP Address      No.     Recv time               Delta Time
24.24.1.151     1       1182310337.727521       0.000000
24.24.1.151     2       1182310345.723607       7.996086
24.24.1.151     3       1182310353.723382       7.999775
24.24.1.151     4       1182310361.724154       8.000772
24.24.1.151     Implementation guess: Cisco VPN Concentrator

Ending ike-scan 1.9: 1 hosts scanned in 84.191 seconds (0.01 hosts/sec).  1 returned handshake; 0 returned notify
--------------------------------------------------------------------------------------------------------------------------------










                            ###########################
----------- ############### # Day 2: Malware Analysis  ################ -----------
                            ###########################


---------------------------Type This-----------------------------------
wget http://45.63.104.73/wannacry.zip

unzip wannacry.zip
     infected

file wannacry.exe

mv wannacry.exe malware.pdf

file malware.pdf

mv malware.pdf wannacry.exe

hexdump -n 2 -C wannacry.exe

-----------------------------------------------------------------------



***What is '4d 5a' or 'MZ'***
Open a web browswer and take a look at the link below.
http://www.garykessler.net/library/file_sigs.html

While on this page use CTRL-F to search for the following:
MX
PDF
XLS


Look at the hex representation for each file type.

This website has the data that is in the header of each file type. This is really important for file analysis.


---------------------------Type This-----------------------------------
objdump -x wannacry.exe

strings wannacry.exe

strings --all wannacry.exe | head -n 6

strings wannacry.exe | grep -i dll

strings wannacry.exe | grep -i library

strings wannacry.exe | grep -i reg

strings wannacry.exe | grep -i key

strings wannacry.exe | grep -i rsa

strings wannacry.exe | grep -i open

strings wannacry.exe | grep -i get

strings wannacry.exe | grep -i mutex

strings wannacry.exe | grep -i irc

strings wannacry.exe | grep -i join

strings wannacry.exe | grep -i admin

strings wannacry.exe | grep -i list



-----------------------------------------------------------------------








Hmmmmm.......what's the latest thing in the news - oh yeah "WannaCry"

Quick Google search for "wannacry ransomeware analysis"


Reference
https://securingtomorrow.mcafee.com/executive-perspectives/analysis-wannacry-ransomware-outbreak/

- Yara Rule -


Strings:
$s1 = “Ooops, your files have been encrypted!” wide ascii nocase
$s2 = “Wanna Decryptor” wide ascii nocase
$s3 = “.wcry” wide ascii nocase
$s4 = “WANNACRY” wide ascii nocase
$s5 = “WANACRY!” wide ascii nocase
$s7 = “icacls . /grant Everyone:F /T /C /Q” wide ascii nocase








Ok, let's look for the individual strings

---------------------------Type This-----------------------------------

strings wannacry.exe | grep -i ooops

strings wannacry.exe | grep -i wanna

strings wannacry.exe | grep -i wcry

strings wannacry.exe | grep -i wannacry

strings wannacry.exe | grep -i wanacry          **** Matches $s5, hmmm.....


-----------------------------------------------------------------------





####################################
# Tired of GREP - let's try Python #
####################################
Decided to make my own script for this kind of stuff in the future. I

Reference1:
http://45.63.104.73/analyse_malware.py

This is a really good script for the basics of static analysis

Reference:
https://joesecurity.org/reports/report-db349b97c37d22f5ea1d1841e3c89eb4.html


This is really good for showing some good signatures to add to the Python script


Here is my own script using the signatures (started this yesterday, but still needs work):
https://pastebin.com/guxzCBmP


---------------------------Type This-----------------------------------
wget http://45.63.104.73/analyse_malware.py
wget https://pastebin.com/raw/guxzCBmP


mv guxzCBmP am.py

chmod +x analyse_malware.py
chmod +x am.py

python analyse_malware.py
python am.py wannacry.exe

nano analyse_malware.py
nano am.py
-----------------------------------------------------------------------