A Network Forensic Analysis Framework Professor Patrick McDaniel - PowerPoint PPT Presentation

A Network Forensic Analysis Framework Professor Patrick McDaniel Daniel Krych Fall 2015

About • An extensible network forensic analysis framework. • Enables rapid development of plugins to support the dissection of network packet captures. • Key features: ‣ Robust stream reassembly ‣ IPv4 and IPv6 support ‣ Custom output handlers ‣ Chainable decoders • Billy Glodek Page

Page

Installation (Ubuntu) > sudo apt-get install git > git clone https://github.com/USArmyResearchLab/Dshell.git > sudo apt-get install python-crypto python-dpkt python-ipy python-pypcap python-pip > sudo pip install pygeoip Download GeoLite Country, GeoLite Country IPv6, GeoLite ASN, GeoLite ASN IPv6 http://dev.maxmind.com/geoip/legacy/geolite/ > gunzip * Move the MaxMind dat files to ~/Dshell/share/GeoIP/ > cd ~/Dshell > make > ./dshell If you get a Dshell> prompt, you're good to go! Page

Malware Traffic Analysis • http://www.malware-traffic-analysis.net/ > wget http://www.malware-traffic- analysis.net/2014/11/16/2014-11-16- traffic-analysis-exercise.pcap Page

General Usage • To run a decoder > decode – d <decoder> *.pcap • To list all decoders > decode – l • To get help > decode – h • To learn more about a specific decoder > decode – d <decoder> Page

> decode – l Page

Example Uses - followstream • Generates color-coded Screen/HTML output similar to Wireshark Follow Stream. • Default filter: tcp > decode – d followstream 2014-11-16- traffic-analysis-exercise.pcap Page

Example Uses - followstream Page

Example Uses - web • Tracks server responses • Default filter: tcp and (port 80 or port 8080 or port 8000) > decode – d web 2014-11-16-traffic- analysis-exercise.pcap Page

Example Uses - web Page

Example Uses - DNS • Extracts and summarizes DNS queries/responses (defaults: A,AAAA,CNAME,PTR records), • Default filter: (udp and port 53) > decode -d dns 2014-11-16-traffic- analysis-exercise.pcap Page

Example Uses - DNS Page

Example Uses - DHCP • Extracts client information from DHCP messages • Default filter: (udp and port 67) > decode -d dhcp 2014-11-16-traffic- analysis-exercise.pcap Page

Example Uses - DHCP Page

So, how does it work? Page

dpkt • An ethernet packet decoding module • Python library - Dug Song & Jon Oberheide • leveraged by Dshell • https://github.com/kbandla/dpkt Page

Dshell Types Page

Dshell Types Page

Dshell Classes ~/Dshell/lib/dshell.py Page

Dshell Classes ~/Dshell/lib/dshell.py Page

Dshell Classes ~/Dshell/lib/dshell.py Page

Dshell Classes ~/Dshell/lib/dshell.py Page

Dshell Classes ~/Dshell/lib/dshell.py Page

Dshell Classes ~/Dshell/lib/dshell.py Page

Dshell Classes ~/Dshell/lib/dshell.py Page

Dshell Classes ~/Dshell/lib/dshell.py Page

Dshell Classes ~/Dshell/lib/dshell.py Page

Dshell Classes ~/Dshell/lib/dshell.py Page

Dshell Classes ~/Dshell/lib/dshell.py Page

User-Agent Author: Eric Kilmer Page

User-Agent Author: Eric Kilmer Page

Useful tools • Python libraries: ‣ util.hexPlusAscii • Function to print hex and Ascii side-by- side ‣ binascii.hexlify / binascii.unhexlify • tcpdump • Wireshark Page

Additional Notes • Decoders can be chainable ‣ see the country decoder for an example • Read the protocol’s RFCs • Make your code more pythonic ‣ Raymond Hettinger’s Tips and Tricks https://gist.github.com/JeffPaine/6213790 ‣ Youtube videos of Raymond’s talks https://www.youtube.com/watch?v=wf-BqAjZb8M https://www.youtube.com/watch?v=OSGv2VnC0go ‣ PEP 8 Style Guide for Python Code https://www.python.org/dev/peps/pep-0008/ Page

Our Contributions • Dan - DHCP, NBNS, Bitcoin • Eric – User-Agent, Flash-Detect, teredo • Mark – WebColors, ether • Nate – accept-filter, asn-filter, flow-range, uaabf, entropy Page

Assignment • Repeat the process in these slides using the DNS, Followstream, and Web decoders for Dshell on 3 different pcap’s (malware-traffic-analysis.net) • What information can you discover using these decoders? • Write a new decoder that parses out the ‘Referrer’ field from a HTTP Header (HINT: This will be similair to the ‘User - Agent’ decoder discussed earlier) • What will this provide us with? What else could we add to the decoder to make it more useful as an analysis tool? Page