Differences
This shows you the differences between two versions of the page.
|
isc:labs:10 [2022/05/16 11:35] florin.stancu |
isc:labs:10 [2024/05/14 12:30] (current) florin.stancu [04. Audio Visualization] |
||
|---|---|---|---|
| Line 1: | Line 1: | ||
| - | ====== Lab 10 - Privacy Technologies====== | + | ====== Lab 10 - Forensics ====== |
| ===== Overview ===== | ===== Overview ===== | ||
| - | Privacy is a usually included in the larger security landscape, but it deals with aspects that concern people more that technologies and tries to answer a very tough question: "How to access/compute data without the owner know who you are?". While, like everything, is a sword with two blades, it tries to allow people own their data in the digital world and to provide anonymity while browsing the Internet. | + | Computer forensics is a branch of digital forensic science pertaining to evidence found in computers and digital storage media. The goal of computer forensics is to examine digital media in a forensically sound manner with the aim of identifying, preserving, recovering, analyzing and presenting facts and opinions about the digital information. |
| - | ===== Exercises ===== | + | <hidden> |
| + | ===== [BONUS] Completare formular de feedback ===== | ||
| - | ==== 00 [0p]. Users ==== | + | Vă invităm de asemenea să evaluați, dacă este posibil, activitatea echipei de ISC și să precizați punctele tari, punctele slabe și sugestiile voastre de îmbunătățire a materiei. Feedback-ul vostru este foarte important pentru noi să creștem calitatea materiei în anii următori și să îmbunătățim materiile pe care le veți face în continuare. |
| - | Create the following users: **//red//**, **//green//** and **//blue//**. Make sure that you can ssh into the VM using this users. For example, copy the ".ssh/" directory from student to the newly added users and "chown" it accordingly. | + | [[https://curs.upb.ro/mod/feedbackadm/view.php?id=26590|Găsiți formularul de feedback aici]]. |
| - | <hidden> | + | Vă mulțumim! |
| - | <code> | + | |
| - | sudo adduser red | + | -------- |
| - | sudo adduser green | + | \\ |
| - | sudo adduser blue | + | |
| - | </code> | + | |
| </hidden> | </hidden> | ||
| + | ===== Exercises ===== | ||
| - | ==== 01 [50p]. Pretty Good Privacy==== | + | You are a private investigator and you have 2h to solve 9 crimes. At the end of every crime you will find a flag that looks like **ISC{...}**. \\ |
| + | Are you up to the task? \\ \\ | ||
| + | {{:isc:labs:ISC-lab09.zip|Here}} is your data.\\ \\ | ||
| + | All exercises can be solved on the local Linux machine. | ||
| - | Pretty Good Privacy (PGP) is an encryption standard that can be used to authenticate in a distributed manner. GNU Privacy Guard (GPG) is an open-source implementation of the PGP standards. In this exercise you are required to send one file encrypted from one user to the other. | + | ==== 00. Capture 1 ==== |
| - | For the next exercises, you will need to be logged in as users red/green/blue via ssh in order to generate the gpg key. | + | This is traffic capture of a suspect that we've been following for a long time. Can you find anything interesting like login credentials? |
| + | <spoiler Hint1> | ||
| + | Use wireshark to analyse the pcap. | ||
| + | </spoiler> | ||
| + | <spoiler Hint2> | ||
| + | Check the ports at statistics/conversations/tcp. | ||
| + | </spoiler> | ||
| + | \\ | ||
| + | ==== 01. Unknown File Type ==== | ||
| - | * Unfortunately, gpg doesn't work when the user is with ''su'' (tty permission problems, owned by ''student''). If you want to do this, use ''tmux'' after logging in: it allocates a new TTY ;) | + | We've found this file on a confiscated machine, but we can't figure what it is. Can you help us? |
| - | * Generate a private/public key using the gpg tool for each of the three users previously created. **Use <red|green|blue>@cs.pub.ro for the emails ;) ** | + | <spoiler Hint1> |
| + | Today is not your lucky day. No hints for you. | ||
| + | </spoiler> | ||
| + | \\ | ||
| + | ==== 02. Hidden Flag ==== | ||
| - | <hidden> | + | There is something uncanny about this image. Is it trying to give us a hint? |
| - | <code> | + | \\ |
| - | su - blue | + | ==== 03. Corrupted File ==== |
| - | gpg --gen-key | + | |
| - | su - red | + | |
| - | gpg --gen-key | + | |
| - | su - green | + | |
| - | gpg --gen-key | + | |
| - | sudo apt-get install rng-tools | + | During a transmission, one of our files got corrupted. Take a look and see if you can do something about it. |
| - | sudo rngd -v -f -r /dev/urandom | + | <spoiler Hint1> |
| - | </code> | + | Maybe there is something wrong with the header. |
| - | </hidden> | + | </spoiler> |
| - | * First, we are going to send **//red//**'s public key to **//green//**. Export it into an ASCII file format and import it into **//green//**'s account. | + | \\ |
| - | <note> After importing the key you should list it and double check that it was stored in the public ring. At this moment the key is not trusted yet, we will do this in a future step. </note> | + | ==== 04. Audio Visualization ==== |
| - | * You should see something similar (for red and green): <code> | + | |
| - | green@isc:~$ gpg --list-keys | + | |
| - | /home/green/.gnupg/pubring.gpg | + | |
| - | ------------------------------ | + | |
| - | pub 2048R/13C73580 2019-04-23 | + | |
| - | uid green <green@cs.pub.ro> | + | |
| - | sub 2048R/F1C1FF9A 2019-04-23 | + | |
| - | pub 2048R/860244A1 2019-04-23 | + | We have intercepted an alien transmission, but there is no way to understand what is it saying. Maybe we should look at it. |
| - | uid red-student <red@cs.pub.ro> | + | <spoiler Hint1> |
| - | sub 2048R/E7626ADD 2019-04-23 | + | FFT! Can you SEE it? |
| - | </code> | + | Check Audacity. |
| - | <note> The description of fields is available [[https://github.com/gpg/gnupg/blob/master/doc/DETAILS#field-1---type-of-record|here]]. </note> | + | </spoiler> |
| + | \\ | ||
| + | ==== 05. Hidden File ==== | ||
| - | <hidden> | + | There is something wrong with the size of this image. Is there anything else there? |
| - | <code> | + | <spoiler Hint1> |
| - | student@isc:~$sudo cp /home/red/pub_red.asc /home/green/. | + | Use Binwalk. "-e" option is buggy sometimes. |
| - | [sudo] password for student: | + | </spoiler> |
| - | student@isc:~$ sudo chown green:green /home/green/pub_red.asc | + | \\ |
| - | </hidden> | + | ==== 06. Censored ==== |
| - | * Now, **//green//** can use **//red//**'s public key to authenticate him and send an encrypted file. Create a file containing a secret message, encrypt it and send it to the other party. | + | |
| - | <hidden> | + | |
| - | <code> | + | |
| - | green@isc:~$ echo "this is a secret message" > secret_file.txt | + | |
| - | green@isc:~$ gpg --encrypt --recipient red@cs.pub.ro secret_file.txt | + | |
| - | gpg: E7626ADD: There is no assurance this key belongs to the named user | + | |
| - | pub 2048R/E7626ADD 2019-04-23 red-student <red@cs.pub.ro> | + | We've found a letter in the trash can of a suspect, but some of the info is censored. Do some magic and find what is underneath the black box. |
| - | Primary key fingerprint: 950D 2356 F2DB B4D7 F4FC 9BB2 EB86 5C35 8602 44A1 | + | <spoiler Hint1> |
| - | Subkey fingerprint: F07B EFBB 284A 99F3 10BF D964 517A 10DE E762 6ADD | + | Use Google. |
| + | </spoiler> | ||
| + | \\ | ||
| + | ==== 07. Waiting for eternity ==== | ||
| + | |||
| + | We stared at this gif for the last hour but nothing is happening. Would you like to join us and stare at it for the next hour? | ||
| + | \\ | ||
| + | ==== 08. Capture 2 ==== | ||
| + | |||
| + | This is an USB capture of a device connected to a suspect's machine. Can you find what he's been typing? | ||
| + | <spoiler Hint1> | ||
| + | [[https://www.usb.org/sites/default/files/documents/hut1_12v2.pdf|USB Documentation]] | ||
| + | </spoiler> | ||
| + | \\ | ||
| + | ===== Resources ===== | ||
| + | * Hex Editor | ||
| + | * Wireshark | ||
| + | * Binwalk | ||
| + | * Audacity | ||
| + | * Image extractor | ||
| + | * USB documentation | ||
| - | It is NOT certain that the key belongs to the person named | ||
| - | in the user ID. If you *really* know what you are doing, | ||
| - | you may answer the next question with yes. | ||
| - | Use this key anyway? (y/N) y | ||
| - | green@isc:~$ ls | ||
| - | pub_red.asc secret_file.txt secret_file.txt.gpg | ||
| - | </code> | ||
| - | </hidden> | ||
| - | * Send the encrypted file back to **//red//** and decrypt it. | ||
| - | <hidden> | ||
| - | <code> | ||
| - | student@isc:~$ sudo cp /home/green/secret_file.txt.gpg /home/red/. | ||
| - | student@isc:~$ sudo chown red:red /home/red/secret_file.txt.gpg | ||
| - | student@isc:~$ su - red | ||
| - | Password: | ||
| - | red@isc:~$ ls | ||
| - | pub_red.asc secret_file.txt.gpg | ||
| - | red@isc:~$ gpg --decrypt secret_file.txt.gpg | ||
| - | gpg: encrypted with 2048-bit RSA key, ID E7626ADD, created 2019-04-23 | ||
| - | "red-student <red@cs.pub.ro>" | ||
| - | this is a secret message | ||
| - | </code> | ||
| - | </hidden> | ||
| - | * The next step is to create a trust channel between **//blue//** and **//red//** using **//green//** as a trusted party. To do so, **//green//** must firstly sign **//red//**'s key and export both his key and **//red//**'s to **//blue//**. Move the exported files into **//blue//**'s directory and import them. After the import was done, list the keys available to **//blue//**. | ||
| - | <note> The signing process typically involves manually verifying the fingerprint of the key </note> | ||
| <hidden> | <hidden> | ||
| - | <code> | ||
| - | green@isc:~$ gpg --sign-key red@cs.pub.ro | ||
| - | green@isc:~$ gpg --export -a green@cs.pub.ro > pub_green.asc | ||
| - | green@isc:~$ gpg --export -a red@cs.pub.ro > pub_red_signed_by_green.asc | ||
| - | green@isc:~$ exit | ||
| - | logout | ||
| - | student@isc:~$ sudo cp /home/green/pub_green.asc /home/blue/ | ||
| - | student@isc:~$ sudo cp /home/green/pub_red_signed_by_green.asc /home/blue/ | ||
| - | student@isc:~$ su - blue | ||
| - | blue@isc:~$ gpg --import pub_green.asc | ||
| - | blue@isc:~$ gpg --import pub_red_signed_by_green.asc | ||
| - | blue@isc:~$ gpg --list-key | ||
| - | /home/blue/.gnupg/pubring.gpg | ||
| - | ----------------------------- | ||
| - | pub 2048R/C1CD918F 2019-04-23 | ||
| - | uid blue-student <blue@cs.pub.ro> | ||
| - | sub 2048R/0F45CB72 2019-04-23 | ||
| - | pub 2048R/13C73580 2019-04-23 | + | ====== STUFF FROM SUMMER 2016 ====== |
| - | uid green <green@cs.pub.ro> | + | |
| - | sub 2048R/F1C1FF9A 2019-04-23 | + | |
| - | pub 2048R/860244A1 2019-04-23 | ||
| - | uid red-student <red@cs.pub.ro> | ||
| - | sub 2048R/E7626ADD 2019-04-23 | ||
| - | </code> | ||
| - | </hidden> | ||
| - | * Now, **//blue//** should mark **//green//**'s key as trusted (by signing it). After this, as the **//red//** user, create a file with an important message and sign it (do not encrypt it for this step). Transfer the file to **//blue//**, read the file and verify the signature. | ||
| - | <hidden> | ||
| - | <code> | ||
| - | red@isc:~$ echo "this is an important message" > important_file.txt | ||
| - | red@isc:~$ gpg --sign important_file.txt | ||
| - | red@isc:~$ exit | ||
| - | student@isc:~$ sudo cp /home/red/important_file.txt.gpg /home/blue/ | ||
| - | student@isc:~$ sudo chown blue:blue /home/blue/important_file.txt.gpg | ||
| - | student@isc:~$ su - blue | ||
| - | Password: | ||
| - | blue@isc:~$ ls | ||
| - | important_file.txt.gpg pub_green.asc pub_red_signed_by_green.asc | ||
| - | blue@mihai-isc:~$ gpg important_file.txt.gpg | ||
| - | gpg: Signature made Tue 23 Apr 2019 02:25:50 PM UTC using RSA key ID 860244A1 | ||
| - | gpg: Good signature from "red-student <red@cs.pub.ro>" | ||
| - | gpg: WARNING: This key is not certified with a trusted signature! | ||
| - | gpg: There is no indication that the signature belongs to the owner. | ||
| - | Primary key fingerprint: 950D 2356 F2DB B4D7 F4FC 9BB2 EB86 5C35 8602 44A1 | ||
| - | blue@isc:~$ cat important_file.txt | ||
| - | this is an important message | ||
| - | </code> | ||
| - | </hidden> | ||
| - | * In the default setup mode, the last step should have given a warning stating that the key is not trusted while still being valid ("Good signature"). This is because GPG uses a more complex trusted model. As a last step, login as the **//blue//** user and change the trust level for **//green//**'s key to "I trust ultimately". After this verify the previous file signature again. | ||
| - | <note> The web of trust allows a more elaborate algorithm to be used to validate a key. A more flexible algorithm can now be used: a key K is considered valid if it meets two conditions: \\ 1. it is signed by enough valid keys, meaning \\ a. you have signed it personally, \\ b. it has been signed by one fully trusted key, or \\ c. it has been signed by three marginally trusted keys; and \\ 2. the path of signed keys leading from K back to your own key is five steps or shorter. [[https://www.gnupg.org/gph/en/manual.html#AEN335|ref]]</note> | ||
| - | <hidden> | ||
| - | <code> | ||
| - | blue@isc:~$ gpg --edit-key green@cs.pub.ro | ||
| - | gpg> trust | ||
| - | Please decide how far you trust this user to correctly verify other users' keys | + | TODO!!!! |
| - | (by looking at passports, checking fingerprints from different sources, etc.) | + | SCHIMBAT IP MASINA VIRTUALA SI MODIFICAT IN DOCUMENT |
| - | 1 = I don't know or won't say | + | Sa caute ultimul fisier modificat din filesystem |
| - | 2 = I do NOT trust | + | locatie in QR |
| - | 3 = I trust marginally | + | |
| - | 4 = I trust fully | + | Adaugat ceva de mobile?? |
| - | 5 = I trust ultimately | + | |
| - | m = back to the main menu | + | |
| - | Your decision? 5 | + | |
| - | Do you really want to set this key to ultimate trust? (y/N) y | + | ===== Resources ===== |
| + | |||
| + | *[[http://downloads.volatilityfoundation.org/releases/2.4/CheatSheet_v2.4.pdf|Volatility Cheatsheet]] | ||
| - | gpg> quit | ||
| - | blue@isc:~$ gpg -v --verify-files important_file.txt.gpg | ||
| - | gpg: original file name='important_file.txt' | ||
| - | gpg: Signature made Tue 23 Apr 2019 02:44:00 PM UTC using RSA key ID 860244A1 | ||
| - | gpg: using PGP trust model | ||
| - | gpg: checking the trustdb | ||
| - | gpg: 3 keys cached (8 signatures) | ||
| - | gpg: 3 keys processed (3 validity counts cleared) | ||
| - | gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model | ||
| - | gpg: depth: 0 valid: 2 signed: 1 trust: 0-, 0q, 0n, 0m, 0f, 2u | ||
| - | gpg: depth: 1 valid: 1 signed: 0 trust: 1-, 0q, 0n, 0m, 0f, 0u | ||
| - | gpg: Good signature from "red-student <red@cs.pub.ro>" | ||
| - | gpg: binary signature, digest algorithm SHA1 | ||
| - | </code> | ||
| - | </hidden> | ||
| + | ===== Overview ===== | ||
| - | ==== 02. [40p] TOR ==== | + | *You are a forensic detective hired to investigate the recent attack on our database server. Fortunately, the security team detected the intrusion in time and the hacker had to run quickly, leaving his laptop in the server room. Using a cold boot attack, we managed to obtain a dump of his ram. Your job is to gather as much intel as you can. |
| - | The Tor (The Onion Routing) project is an implementation of the more generic "onion routing" idea that allows a user to gain network anonymity while surfing the Internet. The mechanism that allows for a private surfing is based on re-encryption and "randomly" routing of the packet at the level of each router within the network, allowing each router to only know the previous and the next router in the route (not the source/destination of the packet) [[https://www.torproject.org/about/history/|ref]]. Accessing the Tor network can be done either through a local proxy of via a Browser pre-configured with the proxy server. | ||
| - | * First, please install `tor`: <code> | + | <note> |
| - | sudo apt update | + | Volatility usage: |
| - | sudo apt install tor | + | |
| - | </code> | + | volatility-2.5.standalone.exe -f <dump> imageinfo; Look at the suggested profile |
| - | * Enable SOCKS proxy by editing /etc/torrc and uncommenting ''SOCKSPort 9050'' ;) | + | |
| - | <note> Tor only supports TCP traffic, some make sure your DNS queries are done over TCP.</note> | + | volatility-2.5.standalone.exe -f <dump> --profile=<profile> kdbgscan; Look at the Offset (V) |
| - | <hidden> | + | |
| - | <code> | + | volatility-2.5.standalone.exe -f <dump> --profile=<profile> --kdbg=<offset> COMMAND |
| - | root@isc:/etc/tor# netstat -nltp | + | </note> |
| - | Active Internet connections (only servers) | + | |
| - | Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name | + | |
| - | tcp 0 0 127.0.0.1:3306 0.0.0.0:* LISTEN 1276/mysqld | + | <note tip>You should look for processes, commands, files, history, connections and network traffic.</note> |
| - | tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 25926/sshd | + | |
| - | tcp 0 0 0.0.0.0:9050 0.0.0.0:* LISTEN 1414/tor | + | |
| - | tcp6 0 0 :::80 :::* LISTEN 3280/apache2 | + | |
| - | tcp6 0 0 :::22 :::* LISTEN 25926/sshd | + | ==== Solution: ==== |
| - | </code> | + | |
| - | </hidden> | + | volatility-2.5.standalone.exe -f memory.dmp imageinfo |
| - | * //torsocks// is a tool that forces any opened program to use the Tor network for connectivity. Open a shell and find out your real IP address. Now, open a shell using //torsocks// and find out the IP address via the Tor network. Restart the **tor** service and discovery your newly allocated IP address. | + | |
| - | <note tip><code>dig TXT +tcp +short o-o.myaddr.l.google.com @ns1.google.com | awk -F'"' '{ print $2}'</code></note> | + | volatility-2.5.standalone.exe -f memory.dmp --profile=Win7SP1x86 kdbgscan |
| - | <hidden> | + | |
| - | <code> | + | volatility-2.5.standalone.exe -f memory.dmp --profile=Win7SP1x86 --kdbg=0x82b73c78 pslist > ps.txt |
| - | root@isc:/etc/tor# torsocks --shell | + | |
| - | /usr/bin/torsocks: New torified shell coming right up... | + | volatility-2.5.standalone.exe -f memory.dmp --profile=Win7SP1x86 --kdbg=0x82b73c78 cmdline |
| - | root@isc:/etc/tor# dig TXT +tcp +short o-o.myaddr.l.google.com @ns1.google.com | awk -F'"' '{ print $2}' | + | |
| - | 199.249.230.72 | + | volatility-2.5.standalone.exe -f memory.dmp --profile=Win7SP1x86 --kdbg=0x82b73c78 consoles |
| - | root@isc:/etc/tor# exit | + | |
| - | exit | + | volatility-2.5.standalone.exe -f memory.dmp --profile=Win7SP1x86 --kdbg=0x82b73c78 dumpfiles -D file > dump.txt |
| - | root@isc:/etc/tor# dig TXT +tcp +short o-o.myaddr.l.google.com @ns1.google.com | awk -F'"' '{ print $2}' | + | |
| - | 141.85.241.165 | + | file: file.3640.0x86a44318 |
| - | </code> | + | |
| - | </hidden> | + | find: "search" |
| - | * You are going to configure your local Firefox browser to use the Tor proxy on the VM. First, use ssh local port forwarding to make port 9050 available to your machine: <code> | + | |
| - | ssh -i <fep_key_path> -o ProxyCommand="ssh <username>@fep.grid.pub.ro -W %h:%p" -L 9050:localhost:9050 student@<VM_IP> | + | http://www.bing.com/search?q=https%3A%2F%2Fdocs.google.com%2Fdocument%2Fd%2F1KAHXjGIT_8EX0gA5NGZSZ0A-PzcVbzIxm1NKtQClvME%2Fedit%3Fusp%3Dsharing&qs=n&form=QBLH&pq=https%3A%2F%2Fdocs.google.com%2Fdocument%2Fd%2F1kahxjgit_8ex0ga5ngzsz0a-pzcvbzixm1nktqclvme%2Fedit%3Fusp%3Dsharing&sc=0-96&sp=-1&sk=&cvid=32A3046F740B479DA10E524ABD27DB70 |
| - | </code> | + | |
| - | * Next, change the **Firefox** Network Settings to use Socks5 proxy using the IP address and port from your VM. You can verify that your browser is using Tor by accessing the following [[https://check.torproject.org/|website]]. | + | https://docs.google.com/document/d/1KAHXjGIT_8EX0gA5NGZSZ0A-PzcVbzIxm1NKtQClvME/edit |
| - | <hidden> | + | |
| - | [[https://1.bp.blogspot.com/-b-MahPstRzA/WvgwatvGq5I/AAAAAAAAQiA/e1rJp8RGKU08O-tV5W0oUA9kDGY5tEq5gCLcBGAs/s1600/proxy.png|Firefox Settings]] | + | user besthacker |
| + | |||
| + | WW91ciBwYXNzd2QgaXM6IENGVFVJQkRMRlM= BASE64decode | ||
| + | |||
| + | Your passwd is: CFTUIBDLFS | ||
| + | |||
| + | ssh besthacker@..... | ||
| </hidden> | </hidden> | ||
| Line 235: | Line 170: | ||
| Please take a minute to fill in the [[https://forms.gle/5Lu1mFa63zptk2ox9|feedback form]] for this lab. | Please take a minute to fill in the [[https://forms.gle/5Lu1mFa63zptk2ox9|feedback form]] for this lab. | ||
| + | |||
