And welcome back, everybody, to DEF CON 28 Safe Mode.
Continuing on with the Blue Team Village OpenSOC CTF walkthrough,
we're going to be talking about Moloch today,
and we have Bashar Shama here to give us a quick discussion
and a walkthrough on the tool.
Welcome, Bashar.
Thank you. Hello, everyone.
I am Bashar, and I'm going to go over how we're going to use Moloch tomorrow
during the CTF.
I was actually introduced to Moloch two years ago
playing the same exact CTF that you're going to play tomorrow.
I played it two years ago, and I really, really fell in love with Moloch.
So since then, I started playing with it,
tinkering with it, just use it as much as I can,
and I keep using it day to day.
The goal today is to really prepare you on how to use Moloch on the CTF tomorrow.
So we will have time for questions at the end.
Please post any questions that you have to the TechWorkshops Track 1 channel in the Discord.
The moderators will monitor your questions, and we're going to ask them at the end,
towards the end of the session.
So keep your questions thrown away.
We'll have some time at the end to go over some questions.
So let's go ahead and get started.
So a very brief intro on what Moloch is.
It's pretty much a free open source tool.
It's really a network analysis tool that you can use to analyze a large volume of packet data, or PCAPs.
The simplest way to think about it is, if you've ever used Wireshark,
it's like a Wireshark frontend with a huge database backend,
so you can search tons and tons of PCAP data, gigs of data, hundreds of gigs of data,
of PCAPs very easily, very quickly.
That's a very, very, very 10,000, over 2,000 foot overview of Moloch.
For our purpose here, and for the CTF tomorrow, what I have done is, actually,
I have Moloch set up, and I got some, about four gigs of data as a sample
from the network forensics training of March 2015.
I downloaded these PCAPs, and I pretty much loaded them into Moloch
to kind of show you how we can use this tool to do our investigation
and answer the questions during the CTF tomorrow.
So, our scenario for today is, you're part of the security team,
and you receive a call saying, hey, around 1 p.m. today, or not today,
1 p.m. on March 12, 2015, our main company site has been de-fixed.
Somebody has changed the way our website looks like.
All we know is, we have this image of a file showing as a frog on our main site,
and we don't know how this happened. Can you please help us?
And all you know is, you have access to packet capture.
You have packet capture, and you have access to Moloch.
So, let's walk right through it.
So, if you have never seen Moloch before, this is what it looks like.
This is when you land or you log in.
You will land pretty much in the sessions tab,
and that's where you're going to probably spend most of your time tomorrow,
in the sessions tab.
Usually, I would like to go and just drop down here on the time, on the date,
and I would do all time, all day, just to have an understanding
of how big the incident is.
For the purpose of tomorrow, again, it's going to be a very specific time period.
But this is where I would start, and let's go ahead and deep dive into the investigation
and how can we use Moloch.
So, the first piece of information we know is the date of the incident.
So, we know it's on 2015.
So, as you can see, Moloch can give us this ability to just click through
and decide on the dates that we want to investigate.
I'm going to do 12.
So, we have our date here. That's going to be our starting date.
And then I'm going to just copy it, paste it here, and I'm going to change this to 13,
which will show us here now, oh, you're looking at one day time range.
So, I have my time range set up. I'm going to go search.
And now I'm going to narrow it down to that 24-hour period
to kind of figure out what happened during that day.
Now, the other piece of information that we were given was it was our main company's website.
So, how can I search for that? Probably I want to look for our host name.
So, what I can do is I can type host, and then Moloch would automatically parse
the different fields based on the protocols that exist in the packet.
So, if it was HTTP traffic, then Moloch will say, okay, well, this is an HTTP host name.
If it's an email, then it's an email host name and so on.
In my case, because I want to see everything, how can I post it?
I can just say host. And to specify what I'm looking for in Moloch,
I would just say equal equal.
So, equal equal means show me everything that matches exactly our host name.
On ad.ase. Okay? That's the first bit of it. And I can run that.
I also know, since it's our website, I want to say, well, it's a website,
it's going to only run on two ports, for example.
So, to kind of add more queries into Moloch, what you need to do is,
you just do two amp signs as an end.
And I'm going to open parentheses and add the ports that we need.
So, port equals 80, just like we did before.
And port equals 443, which we know they both are HTTP ports.
Now, before we go any further, you know, under ports I can say, well,
I can specify I want it to be a destination port, I can have it be a source port, or so on.
For, just to keep it general, and we can see everything here, I'm just going to say, okay,
these ports, this host name, and let's see what we find.
And I messed up something, of course.
Oh, I'm saying end here, and that should be or.
So, it's either port 80 or port 443.
So, in that case, I just do two pipelines, and run that.
Not pipelines, but pipes.
And now I'm saying, okay, show me everything for this host on port 80 and port 443.
And now I can see the traffic.
So, let's go and dive deeper.
On this traffic, I can see all kind of requests, and let's just open something very randomly.
Let's open up this request, and I see it's a get request.
And before we go down, let's spend some time here.
So, idcmalloc will parse all the fields in the packet.
So, I can click on any of these, and I can say, okay, well, what protocol did it come from?
Which IP, which ports?
If it's HTTP packet, then it will also parse the method, the status code, all of these things.
It will also parse the user agent.
Let's say I'm interested in knowing all the user agents that happened in that specific day that visited our website.
I can easily click on user agents, and I can say, okay, export unique user agents with counts.
Once I click that, I will see a new page showing me the unique user agents, along with how many times we've seen this in that specific day, and the other one.
So, we only see two different user agents, nothing abnormal, nothing suspicious.
So, nothing to worry about here.
If we scroll a bit down, we can actually see the actual requests, the raw requests.
So, I can see which hosts they're requesting, where the URI they're going after, and so on.
Because I know we had an incident, and I know the website has been defaced,
the attacker must have sent some kind of data to our website.
So, most likely they will not be doing a GET request.
When we see GET, it's just pulling data from our website.
They're going to be posting or sending some kind of data.
So, this excludes this.
So, I'm going to click GET, and we don't want GET anymore, so I'm just going to say net GET.
That automatically adds that to our query.
And let's hit search and see what we find.
So, now we went down to only 12 entries.
Okay, that's much easier to kind of go through and investigate.
Again, we're not sure what happened, but one thing I can sort for is by time,
to kind of understand the timeline of these different requests and the events.
And this just opens on the random.
So, again, same kind of thing.
So, now it's a POST request.
And it's just a request in index.php.
And I see a test on sleep.
I'm not sure what all this stuff really means.
And I also see this jumper stuff. What is this?
So, if we look at the header, which I've already displayed for you,
it turns out it's actually encoded with gzip.
Gzip is just a method of compression that web browsers use to compress the data
to transfer the least amount of traffic.
So, the nice thing with Molek, what we can do is I can just click uncompress,
and now it automatically will decode this packet for us.
And now I can easily read it and see, oh, okay, this is what loaded,
this is what the page is showing.
And from what we see here, nothing of interest yet.
Okay, that was useful.
But let's keep going. Let's find out what happened.
So, another request, and see this.
But this is like, this looks like an IP address.
But what is all this? I don't know.
Well, what we can do is Molek has Cybershift built in.
Well, Cybershift is a separate open source project,
that you can actually just go and do Cybershift,
and you can load it outside of...
Cybershift, there we go.
And you can just load it outside of Molek, and you can do your decoding.
But let's get back here.
The beauty of this is when we do it on Molek,
it will automatically take that packet data and put it in for us.
So, what is Cybershift?
It's pretty much a tool, a web GUI,
that you can use to do different decoding of different languages,
decoding methods, and so on.
So, in this case, it's taking the hex code and just decoding it.
And while I'm looking at this, I can see these percentage signs.
Percentage sign means it's a URL kind of thing.
So, I can easily just drag the URL decode.
And now I can see the decoded message here.
Now I can see, oh, it's trying to ping this IP address,
which is the same IP that's trying to visit.
Okay, this is interesting.
I'm not sure if they were actually able to ping,
but it looks like this IP is trying to do something here.
Let's keep going, see what else can we find.
Next packet, same thing.
Tests, okay, nothing here.
Next packet, so on.
Oh, there's an NC.
Okay, what is this? Hold on a second.
Let's pull it up again in CyberChef.
Do the same method, decode the URL.
And now we see an NC IP address and port.
So, NC stands for Netcat, which is the utility attackers can use
to have a server connect back to them and get a show in that box.
So, what this is saying is, okay, connect back to my IP over this port.
So, what this means, if this actually succeeded,
that means our server connected back on this IP address.
Well, let's see if this actually happens.
I'm going to take that port, I'm going to clean all this up,
and then I'm going to add the IP address.
It's not going to be the source.
And port equals the port that we're looking for.
Let's search for it.
And we have traffic. Uh-oh.
This is not good.
Looks like our box, which is the source here,
connected back to the server over this port.
We can see how many packets and the amount of data that was sent back and forth.
So, immediately, I would say, okay, well, this is the first connection
that has the highest number of packets, that might have something interesting in it,
so let me open it up.
Scroll down, and we can actually see the whole conversation back and forth now.
Well, it looks like the attacker ran a command, which is id,
which is equal to whoami on Windows,
to figure out who the attacker is running as on this box,
and they're running as apache.
Then they try to figure out which folder they're in,
and they try to access file systems.
Okay, this is not good.
And then they did this cat-index.php, which looks like it's our website,
so they're looking into what's inside our main file and so on.
Okay, what is all this?
Oh, and then I see another netcat command here,
and saving the connection as a cm0.php file,
and our box, locally.
So I'm interested in knowing what this is, but let's keep going.
Let's see what else they do in this box.
And if we come here, they actually did it for us.
They did a cat on this file that they created.
Okay, when they did that, we can see, oh, it's a PHP backdoor.
This is not good, so they used a PHP backdoor on our site.
So how am I going to now figure out what did they do?
I know because of how backdoors work,
they have to visit this PHP file explicitly to kind of load the command they want to run.
So what I can say to Molek is, well, show me all the URIs.
So when we say a URI is...
pretty much everything after the domain will be a URI,
so anything from here on, that's a URI.
So I want to say, show me everything that has this in it.
And since I can't just do, like, all,
what I do in Molek is I just use wildcards at the beginning,
so I don't care what's before this, and the end, meaning I don't care what's after it,
just show me anything that has this string in the URI.
And when I search it,
now, here, we can see all these URLs or URIs
with all these different links in them.
What are they trying to do?
Well, how can I know, like, how can I get all this in one nice place?
I can just click on info,
and I want to say export unique URI with two counts.
Now, Molek will take this for us and tell us,
okay, well, this command was run five times,
this command was run three times, and so on.
So now I kind of know which commands they ran,
because I can see it's command equal cat,
command equal cat, or else, or whatever they're trying to do.
And I kind of see here there's a JPEG file as well.
Okay, so this is how they probably got that JPEG file
or the image of the fraud into our website.
So let's find out where did they, like, how did they do this?
Let's go back here, and let's do...
Instead of this, we are looking for that specific JPEG file.
So I'm going to do wildcard and show me anything that has JPEG in it.
Load it up.
And it's going to show me a lot of stuff.
I'm going to say probably it's going to be the biggest file,
so I'm going to sort by the size of the data.
And this is the biggest file that we have.
So it's loading.
And here I can see, yeah, it's an image file.
But I'm not sure what it looks like.
So what I can do in Moloch is I can just click on show images and files,
and it will actually render it for us right here in the browser.
Now, let's say, you know, I'm not comfortable with doing this
or I want to dig in deeper to it or I want to understand what actually happens
using Wireshark because I've never used Moloch before.
At any session, at any point, you can always just click on download PCAP,
and it will kind of, like, save the PCAPs for you.
So you can open up in Wireshark and, you know, do your analysis manually
if you'd like to.
Pretty much that's how they get the file,
and that's how they deface our website using a backdoor.
If we have time, I think we have another... I think that's pretty much it.
Okay, so with that being said, I think that's the highlight of Moloch
and how to use it. I want to keep some time for questions.
Please let me know any questions you've got.
I'm also going to be in Discord. I'll be on Twitter if you need anything else,
but I'm going to be here waiting for any questions that you guys have.
Cool.
Thank you, Bashar.
I went ahead and put a note in the text window under the workshop track one
with a link over to Recon Episec's OpenSOC Moloch Discord channel.
So definitely check that out.
Obviously, hit Bashar up on Twitter and Discord,
but we're trying to help everybody kind of connect with the right people here
so you can get the help you need.
Perfect.
Thanks a lot, Bashar. I appreciate it.
Thank you. Thank you. I appreciate your time. Thank you.
Take care.