Analysing capture.cap

In this section, we describe briefly the tools used to analyse the traffic in capture.cap.  The information in capture.cap is processed into another form suitable for streams analysis.  This transformation and analysis is presented in the section "Data Flow/ Streams Analysis".  As the intruder used ssh as the means for communication, a section "Analysis of ssh traffic" is dedicated to the analysis of these encrypted communication channels.

 

Tools Used For Traffic Analysis

tcpflow: http://www.circlemud.org/~jelson/software/tcpflow/
ngrep: http://www.packetfactory.net/Projects/ngrep/
tcdump: http://www.tcpdump.org
tcpslice. Available at http://www.tcpdump.org/other/tcpslice.tar.Z
ethereal/tethereal. http://www.ethereal.com
Norton Anti-Virus. http://www.norton.com
Snort. http://www.snort.org

 

Data Flow / Streams Analysis

Tcpflow was used to identify and extract sessions from the tcpdump file. Several streams was produced and the types identified in the attached traffic.txt.

The breakdown of file types is as follows:


We can see that a large proportion of the file types are ASCII. From an analysis of the traffic data, it seem to be a result of ftp probing and attacks. the http and ssh traffic are largely in the data group as a result of downloaded binaries and encrypted sessions.

Traffic breakdown is as follows:
5310 streams to and from port 21
40 streams to and from port 22
18 streams to and from port 80
4 streams to and from port 25
1 streams to and from port 23

A lot of the port 21 traffic are attacks and some are repeated attempts to retrieve rootkits and tools. Some of the http traffic are wget attempts to retrieve files from rho-team.org and haxteam.org. 2 emails were also sent to the email addresses haxteam@yahoo.com and haxteam@haxteam.org containing data such as uptimes, routes, hardware configuration and network configuration.

Of the other streams
012.249.106.060.00113-192.168.001.002.01074 contains 1162 , 21 : USERID :
OTHER :root, of which the meaning is unclear.

There are also a few ssh traffic going to uncommon ports
066.088.064.196.55211-192.168.001.002.01082: data
192.168.001.002.01082-066.088.064.196.55211: data
192.168.001.002.02255-213.150.165.194.55211: data
213.150.165.194.55211-192.168.001.002.02255: data
066.088.064.196.55211-192.168.001.002.01082: data
192.168.001.002.01082-066.088.064.196.55211: data
192.168.001.002.02255-213.150.165.194.55211: data
213.150.165.194.55211-192.168.001.002.02255: data

A cursory examination would indicate ssh servers running at port 55211, which suggests they are either trying to hide it or they do not have permission to start the server at lower ports.

A rough sketch of the events that have occurred is provided in the attached files traffic01.html and traffic02.html. traffic01.html contains links to all the session files in chronological order. traffic02.html reduces the amount of contents by summarizing sessions of 3 lines and less into a count to improve human readability.

Analysis of ssh traffic


Based on the observations from the captured logs as well as the presence of several SSH configuration files found in the "bigwar" and "hax" tarballs, the intruder(s) seem to have used ssh as the communication channel after successfully compromised the target host via wu-ftpd. Close inspection of the two sshd_config files found in "bigwar.tgz" and "hax.tgz" revealed two unorthodox ports for the SSH servers. They are port 17985 and 55211.
sshd_config (in "bigwar")
# This is ssh server systemwide configuration file.
Port 17985
ListenAddress 0.0.0.0
#ListenAddress ::
HostKey /usr/lib/ssh_host_key
RandomSeed /usr/lib/ssh_random_seed
ServerKeyBits 768
KeyRegenerationInterval 1
sshd_config (in "hax")
# This is ssh server systemwide configuration file.
Port 55211
ListenAddress 0.0.0.0
#ListenAddress ::
HostKey /usr/lib/ssh_host_key
RandomSeed /usr/lib/ssh_random_seed
ServerKeyBits 768
KeyRegenerationInterval 3600

With these information, the network traffic logs were parsed for port 22, 17985 and 55211.  We observed that most of the ssh sessions on port 22 came from the address range 66.218.97.141-144 which coincides with previous observation that the adversaries first re-entered the system via ssh at 23:04 hrs (29 Nov 2002) from 62.231.97.143 after exploiting wu-ftpd.

Attempts to connect to the victim host with ssh via port 17985 also suggested that the adversary attempted to configure a sshd at the mentioned port. However, all attempts to connect from external host 62.231.97.141 and 143 to this port were unsuccessful as indicated by the RST flag in the returned packets.

The victim host (192.168.1.2) also attempted  to connect to an external host (66.88.64.196) via ssh at port 55211. Details are shown below:

08:18:43.688317 IP 66.88.64.196.55211 > 192.168.1.2.1082: P 1:26(25) ack 1 win 5792 <nop,nop,timestamp 43781206 74649583>
 (DF)
0x0000   4500 004d 68be 4000 3106 9c26 4258 40c4            E..Mh.@.1..&BX@.
0x0010   c0a8 0102 d7ab 043a 4ccb 64f1 2f27 db3e            .......:L.d./'.>
0x0020   8018 16a0 2add 0000 0101 080a 029c 0c56            ....*..........V
0x0030   0473 0fef 5353 482d 312e 352d 284e 4f4e            .s..SSH-1.5-(NON
0x0040   2d43 4f4d 4d45 5243 4941 4c29 0a                      -COMMERCIAL).
08:18:43.688758 IP 192.168.1.2.1082 > 66.88.64.196.55211: . ack 26 win 5840 <nop,nop,timestamp 74649604 43781206> (DF)
0x0000   4500 0034 d4df 4000 4006 211e c0a8 0102            E..4..@.@.!.....
0x0010   4258 40c4 043a d7ab 2f27 db3e 4ccb 650a            BX@..:../'.>L.e.
0x0020   8010 16d0 5f9c 0000 0101 080a 0473 1004            ...._........s..
0x0030   029c 0c56                                                                  ...V
08:18:43.690883 IP 192.168.1.2.1082 > 66.88.64.196.55211: P 1:23(22) ack 26 win 5840 <nop,nop,timestamp 74649604 43781206
> (DF)
0x0000   4500 004a d4e0 4000 4006 2107 c0a8 0102            E..J..@.@.!.....
0x0010   4258 40c4 043a d7ab 2f27 db3e 4ccb 650a            BX@..:../'.>L.e.
0x0020   8018 16d0 6f68 0000 0101 080a 0473 1004            ....oh.......s..
0x0030   029c 0c56 5353 482d 312e 352d 4f70 656e            ...VSSH-1.5-Open
0x0040   5353 485f 322e 3970 320a                                      SSH_2.9p2.
08:18:43.835747 IP 66.88.64.196.55211 > 192.168.1.2.1082: . ack 23 win 5792 <nop,nop,timestamp 43781221 74649604> (DF)
0x0000   4500 0034 68bf 4000 3106 9c3e 4258 40c4            E..4h.@.1..>BX@.
0x0010   c0a8 0102 d7ab 043a 4ccb 650a 2f27 db54            .......:L.e./'.T
0x0020   8010 16a0 5fa7 0000 0101 080a 029c 0c65            ...._..........e
0x0030   0473 1004                                                                 .s..

This is a non-standard port for ssh communication and may suggest that the external host is another launch pad used by the adversaries. However, due to the fact that the server_key pair are constantly changing every hour by default and not kept on the system, there is no way to recover the clear text from the encrypted traffic in the captured logs.