1. 20141116
Malware-Traffic-Analysis.net - 2014-11-16 - Traffic analysis exercise
并不是解题的思路历程,而是答案证据记录。
LEVEL 1 QUESTIONS:
What is the IP address of the Windows VM that gets infected?
根据经验捕捉的流量有公私网地址,所以应该位于网关位置,所以受感染的 vm 应该为私网地址,那么很有可能就是以下地址。
![image-20211228103124207](https://img2020.cnblogs.com/blog/1512048/202201/1512048-20220117104825462-1289179020.png)
根据通信数据大小来判断,很有可能是 172.16.165.165 这台。
此外,这些 ip 有的是主机,有的是 路由器/交换机,可以通过 nbns 协议进一步确认。nbns 协议特征是主机向 路由器/交换机 发送消息。
![image-20211228105151205](https://img2020.cnblogs.com/blog/1512048/202201/1512048-20220117104825961-834092645.png)
因此,可以判断 172.16.165.165 为终端,其他两个为网络设备。再排查一下 172.16.165.254
![image-20211228113116131](https://img2020.cnblogs.com/blog/1512048/202201/1512048-20220117104826393-2040818026.png)
可以看到 172.16.165.254 为 dhcp 服务器。
故可以确定 受陷主机为 172.16.165.165
What is the host name of the Windows VM that gets infected?
![image-20211228113835280](https://img2020.cnblogs.com/blog/1512048/202201/1512048-20220117104826862-298386509.png)
What is the MAC address of the infected VM?
![image-20211228114010402](https://img2020.cnblogs.com/blog/1512048/202201/1512048-20220117104827299-1468894796.png)
What is the IP address of the compromised web site?
将该页面的响应导出后,直接报毒。所以就是 该网站被攻陷
![image-20211228145435140](https://img2020.cnblogs.com/blog/1512048/202201/1512048-20220117104827903-1898759693.png)
What is the domain name of the compromised web site?
![image-20211228145600526](https://img2020.cnblogs.com/blog/1512048/202201/1512048-20220117104828552-39104706.png)
What is the IP address and domain name that delivered the exploit kit and malware?
继续翻看请求记录,发现请求了一个 jar 包。
![image-20211228142843897](https://img2020.cnblogs.com/blog/1512048/202201/1512048-20220117104829065-1282800481.png)
下载下来后发现报毒。
![image-20211228143313282](https://img2020.cnblogs.com/blog/1512048/202201/1512048-20220117104829686-100371272.png)
所以就是通过 该网站来投递攻击载荷。
![image-20211228150241540](https://img2020.cnblogs.com/blog/1512048/202201/1512048-20220117104830212-1034961357.png)
另一个方法就是把所有的 http 对象导出,然后用杀毒软件扫一下整个导出目录。。。
![image-20211228151126594](https://img2020.cnblogs.com/blog/1512048/202201/1512048-20220117104830804-2045472274.png)
通过 referer 头部定位到引用恶意域名的网站
![image-20211228140458031](https://img2020.cnblogs.com/blog/1512048/202201/1512048-20220117104831509-1183471352.png)
LEVEL 2 QUESTIONS:
What is the redirect URL that points to the exploit kit (EK) landing page?
第一个请求 stand. 这个域名的http header referer 字段
Besided the landing page (which contains the CVE-2013-2551 IE exploit), what other exploit(s) sent by the EK?
![image-20211228153005547](https://img2020.cnblogs.com/blog/1512048/202201/1512048-20220117104832487-1000741019.png)
java 和 flash
How many times was the payload delivered?
3 次,按照顺序,分别是
Submit the pcap to VirusTotal and find out what snort alerts triggered. What are the EK names are shown in the Suricata alerts?
将流量包提交到 virustotal,观察输出即可
![image-20211228154535950](https://img2020.cnblogs.com/blog/1512048/202201/1512048-20220117104833663-1660214617.png)
LEVEL 3 QUESTIONS:
Checking my website, what have I (and others) been calling this exploit kit?
这个我不会,,看答案是 RIG EK
What file or page from the compromised website has the malicious script with the URL for the redirect?
http://www.ciniholland.nl/ 该url 的响应包
![image-20211228155648815](https://img2020.cnblogs.com/blog/1512048/202201/1512048-20220117104834320-117759269.png)
这也发现 wireshark 的一处问题,没有多个数据包data部分搜索功能。
其实可以将整个导出对象的文件夹添加到 vscode 中,再使用全局搜索功能
![image-20211228161817625](https://img2020.cnblogs.com/blog/1512048/202201/1512048-20220117104834804-1386836573.png)
Extract the exploit file(s). What is(are) the md5 file hash(es)?
![image-20211228161141110](https://img2020.cnblogs.com/blog/1512048/202201/1512048-20220117104835269-547105728.png)
VirusTotal doesn't show all the VRT rules under the "Snort alerts" section for the pcap analysis. If you run your own version of Snort with the VRT ruleset as a registered user (or a subscriber), what VRT rules fire?
没尝试。。