start	end	text
14640	18240	And welcome back, everybody, to DEF CON 28 Safe Mode.
18360	22940	Continuing on with the Blue Team Village OpenSOC CTF walkthrough,
22940	24920	we're going to be talking about Moloch today,
24920	28880	and we have Bashar Shama here to give us a quick discussion
28880	30520	and a walkthrough on the tool.
30740	32960	Welcome, Bashar.
33320	35380	Thank you. Hello, everyone.
35380	40200	I am Bashar, and I'm going to go over how we're going to use Moloch tomorrow
40200	41780	during the CTF.
41780	45780	I was actually introduced to Moloch two years ago
45780	49020	playing the same exact CTF that you're going to play tomorrow.
49020	52620	I played it two years ago, and I really, really fell in love with Moloch.
52620	56020	So since then, I started playing with it,
56020	58060	tinkering with it, just use it as much as I can,
58060	60220	and I keep using it day to day.
61740	67520	The goal today is to really prepare you on how to use Moloch on the CTF tomorrow.
67760	71260	So we will have time for questions at the end.
71260	77220	Please post any questions that you have to the TechWorkshops Track 1 channel in the Discord.
77620	83600	The moderators will monitor your questions, and we're going to ask them at the end,
83600	84640	towards the end of the session.
84640	87240	So keep your questions thrown away.
87240	89880	We'll have some time at the end to go over some questions.
91000	93960	So let's go ahead and get started.
94960	99240	So a very brief intro on what Moloch is.
99240	101860	It's pretty much a free open source tool.
102320	110080	It's really a network analysis tool that you can use to analyze a large volume of packet data, or PCAPs.
111040	115300	The simplest way to think about it is, if you've ever used Wireshark,
115300	120520	it's like a Wireshark frontend with a huge database backend,
120520	124940	so you can search tons and tons of PCAP data, gigs of data, hundreds of gigs of data,
124940	128240	of PCAPs very easily, very quickly.
129280	136240	That's a very, very, very 10,000, over 2,000 foot overview of Moloch.
136480	141520	For our purpose here, and for the CTF tomorrow, what I have done is, actually,
141520	148620	I have Moloch set up, and I got some, about four gigs of data as a sample
148620	152540	from the network forensics training of March 2015.
152620	157240	I downloaded these PCAPs, and I pretty much loaded them into Moloch
157240	162640	to kind of show you how we can use this tool to do our investigation
162640	166100	and answer the questions during the CTF tomorrow.
166860	173340	So, our scenario for today is, you're part of the security team,
173340	180100	and you receive a call saying, hey, around 1 p.m. today, or not today,
180100	184980	1 p.m. on March 12, 2015, our main company site has been de-fixed.
184980	188240	Somebody has changed the way our website looks like.
188300	195000	All we know is, we have this image of a file showing as a frog on our main site,
195000	198460	and we don't know how this happened. Can you please help us?
198680	202360	And all you know is, you have access to packet capture.
202480	205300	You have packet capture, and you have access to Moloch.
205300	207920	So, let's walk right through it.
208360	212900	So, if you have never seen Moloch before, this is what it looks like.
212900	217360	This is when you land or you log in.
217360	219600	You will land pretty much in the sessions tab,
219600	222900	and that's where you're going to probably spend most of your time tomorrow,
222900	224040	in the sessions tab.
225260	230380	Usually, I would like to go and just drop down here on the time, on the date,
230380	234260	and I would do all time, all day, just to have an understanding
234260	236320	of how big the incident is.
236980	240600	For the purpose of tomorrow, again, it's going to be a very specific time period.
240600	246560	But this is where I would start, and let's go ahead and deep dive into the investigation
246560	248260	and how can we use Moloch.
248260	253840	So, the first piece of information we know is the date of the incident.
254040	258520	So, we know it's on 2015.
258520	262160	So, as you can see, Moloch can give us this ability to just click through
263260	267180	and decide on the dates that we want to investigate.
267240	268960	I'm going to do 12.
268960	272100	So, we have our date here. That's going to be our starting date.
272320	276940	And then I'm going to just copy it, paste it here, and I'm going to change this to 13,
277440	282100	which will show us here now, oh, you're looking at one day time range.
282320	285540	So, I have my time range set up. I'm going to go search.
286560	289680	And now I'm going to narrow it down to that 24-hour period
290620	293440	to kind of figure out what happened during that day.
293440	299440	Now, the other piece of information that we were given was it was our main company's website.
299780	306140	So, how can I search for that? Probably I want to look for our host name.
306140	311600	So, what I can do is I can type host, and then Moloch would automatically parse
311600	317800	the different fields based on the protocols that exist in the packet.
317800	324380	So, if it was HTTP traffic, then Moloch will say, okay, well, this is an HTTP host name.
324380	327500	If it's an email, then it's an email host name and so on.
327880	330960	In my case, because I want to see everything, how can I post it?
330960	335700	I can just say host. And to specify what I'm looking for in Moloch,
335700	338480	I would just say equal equal.
339400	347060	So, equal equal means show me everything that matches exactly our host name.
347680	353980	On ad.ase. Okay? That's the first bit of it. And I can run that.
354200	359800	I also know, since it's our website, I want to say, well, it's a website,
359800	361720	it's going to only run on two ports, for example.
361720	367280	So, to kind of add more queries into Moloch, what you need to do is,
367280	371580	you just do two amp signs as an end.
371740	375540	And I'm going to open parentheses and add the ports that we need.
375540	380600	So, port equals 80, just like we did before.
382120	390200	And port equals 443, which we know they both are HTTP ports.
390200	394020	Now, before we go any further, you know, under ports I can say, well,
394020	399320	I can specify I want it to be a destination port, I can have it be a source port, or so on.
399540	403860	For, just to keep it general, and we can see everything here, I'm just going to say, okay,
403860	408320	these ports, this host name, and let's see what we find.
408560	411000	And I messed up something, of course.
411180	415140	Oh, I'm saying end here, and that should be or.
415140	418300	So, it's either port 80 or port 443.
419440	426920	So, in that case, I just do two pipelines, and run that.
427940	429460	Not pipelines, but pipes.
429460	434720	And now I'm saying, okay, show me everything for this host on port 80 and port 443.
434720	437140	And now I can see the traffic.
438300	442140	So, let's go and dive deeper.
442960	451840	On this traffic, I can see all kind of requests, and let's just open something very randomly.
451940	456500	Let's open up this request, and I see it's a get request.
456500	459380	And before we go down, let's spend some time here.
459380	464260	So, idcmalloc will parse all the fields in the packet.
464260	470280	So, I can click on any of these, and I can say, okay, well, what protocol did it come from?
470280	472220	Which IP, which ports?
473260	480360	If it's HTTP packet, then it will also parse the method, the status code, all of these things.
480680	482580	It will also parse the user agent.
482580	491980	Let's say I'm interested in knowing all the user agents that happened in that specific day that visited our website.
492040	498640	I can easily click on user agents, and I can say, okay, export unique user agents with counts.
498640	509800	Once I click that, I will see a new page showing me the unique user agents, along with how many times we've seen this in that specific day, and the other one.
509800	514780	So, we only see two different user agents, nothing abnormal, nothing suspicious.
514780	517580	So, nothing to worry about here.
518300	525360	If we scroll a bit down, we can actually see the actual requests, the raw requests.
525360	530600	So, I can see which hosts they're requesting, where the URI they're going after, and so on.
531320	536800	Because I know we had an incident, and I know the website has been defaced,
536800	541440	the attacker must have sent some kind of data to our website.
541440	544540	So, most likely they will not be doing a GET request.
544540	547280	When we see GET, it's just pulling data from our website.
547280	550040	They're going to be posting or sending some kind of data.
550040	552660	So, this excludes this.
552860	558160	So, I'm going to click GET, and we don't want GET anymore, so I'm just going to say net GET.
558420	560940	That automatically adds that to our query.
562580	564820	And let's hit search and see what we find.
564820	568280	So, now we went down to only 12 entries.
568280	574500	Okay, that's much easier to kind of go through and investigate.
575080	582360	Again, we're not sure what happened, but one thing I can sort for is by time,
582360	587460	to kind of understand the timeline of these different requests and the events.
588220	591000	And this just opens on the random.
593680	595800	So, again, same kind of thing.
596040	599660	So, now it's a POST request.
602920	605400	And it's just a request in index.php.
610470	612650	And I see a test on sleep.
612650	614850	I'm not sure what all this stuff really means.
614850	618770	And I also see this jumper stuff. What is this?
619070	623250	So, if we look at the header, which I've already displayed for you,
623250	625510	it turns out it's actually encoded with gzip.
625510	630710	Gzip is just a method of compression that web browsers use to compress the data
630710	633170	to transfer the least amount of traffic.
633370	637550	So, the nice thing with Molek, what we can do is I can just click uncompress,
638210	641750	and now it automatically will decode this packet for us.
641750	645550	And now I can easily read it and see, oh, okay, this is what loaded,
645550	647190	this is what the page is showing.
647570	652110	And from what we see here, nothing of interest yet.
652110	654130	Okay, that was useful.
654130	657730	But let's keep going. Let's find out what happened.
658270	662330	So, another request, and see this.
662330	665410	But this is like, this looks like an IP address.
665410	667470	But what is all this? I don't know.
667930	673810	Well, what we can do is Molek has Cybershift built in.
673950	677290	Well, Cybershift is a separate open source project,
677290	682010	that you can actually just go and do Cybershift,
682010	685510	and you can load it outside of...
686510	688330	Cybershift, there we go.
691600	695540	And you can just load it outside of Molek, and you can do your decoding.
695540	696380	But let's get back here.
696380	699480	The beauty of this is when we do it on Molek,
699480	703860	it will automatically take that packet data and put it in for us.
703880	705640	So, what is Cybershift?
705640	707880	It's pretty much a tool, a web GUI,
707880	712780	that you can use to do different decoding of different languages,
713440	715360	decoding methods, and so on.
715360	720600	So, in this case, it's taking the hex code and just decoding it.
720800	725560	And while I'm looking at this, I can see these percentage signs.
725960	729400	Percentage sign means it's a URL kind of thing.
729400	732860	So, I can easily just drag the URL decode.
732860	736700	And now I can see the decoded message here.
736920	741480	Now I can see, oh, it's trying to ping this IP address,
741480	745000	which is the same IP that's trying to visit.
745000	747200	Okay, this is interesting.
747200	750140	I'm not sure if they were actually able to ping,
750140	755120	but it looks like this IP is trying to do something here.
757380	760540	Let's keep going, see what else can we find.
762860	766620	Next packet, same thing.
766620	770060	Tests, okay, nothing here.
770480	774180	Next packet, so on.
775640	777780	Oh, there's an NC.
777840	779460	Okay, what is this? Hold on a second.
779460	782220	Let's pull it up again in CyberChef.
782220	785860	Do the same method, decode the URL.
785940	790960	And now we see an NC IP address and port.
790960	795040	So, NC stands for Netcat, which is the utility attackers can use
795040	799040	to have a server connect back to them and get a show in that box.
799040	804920	So, what this is saying is, okay, connect back to my IP over this port.
805600	808980	So, what this means, if this actually succeeded,
808980	814520	that means our server connected back on this IP address.
814800	817820	Well, let's see if this actually happens.
817820	822280	I'm going to take that port, I'm going to clean all this up,
822700	826600	and then I'm going to add the IP address.
827780	829500	It's not going to be the source.
832140	837400	And port equals the port that we're looking for.
837480	838520	Let's search for it.
838520	840420	And we have traffic. Uh-oh.
840880	842420	This is not good.
842420	846020	Looks like our box, which is the source here,
846020	848800	connected back to the server over this port.
849040	854240	We can see how many packets and the amount of data that was sent back and forth.
854600	858900	So, immediately, I would say, okay, well, this is the first connection
858900	862460	that has the highest number of packets, that might have something interesting in it,
862460	864960	so let me open it up.
866540	873280	Scroll down, and we can actually see the whole conversation back and forth now.
873280	877920	Well, it looks like the attacker ran a command, which is id,
877920	880620	which is equal to whoami on Windows,
880620	885400	to figure out who the attacker is running as on this box,
885400	887320	and they're running as apache.
887580	890300	Then they try to figure out which folder they're in,
890300	895220	and they try to access file systems.
895220	896820	Okay, this is not good.
897140	902460	And then they did this cat-index.php, which looks like it's our website,
902460	907740	so they're looking into what's inside our main file and so on.
907900	909840	Okay, what is all this?
909840	912420	Oh, and then I see another netcat command here,
913440	918920	and saving the connection as a cm0.php file,
918920	922220	and our box, locally.
922500	926820	So I'm interested in knowing what this is, but let's keep going.
926820	929020	Let's see what else they do in this box.
930180	932760	And if we come here, they actually did it for us.
932760	935140	They did a cat on this file that they created.
936420	940220	Okay, when they did that, we can see, oh, it's a PHP backdoor.
940480	944420	This is not good, so they used a PHP backdoor on our site.
945060	948800	So how am I going to now figure out what did they do?
949060	951840	I know because of how backdoors work,
951840	957820	they have to visit this PHP file explicitly to kind of load the command they want to run.
957820	963240	So what I can say to Molek is, well, show me all the URIs.
963520	966060	So when we say a URI is...
967880	972380	pretty much everything after the domain will be a URI,
972380	974300	so anything from here on, that's a URI.
974300	978480	So I want to say, show me everything that has this in it.
978600	980980	And since I can't just do, like, all,
980980	985120	what I do in Molek is I just use wildcards at the beginning,
985120	989360	so I don't care what's before this, and the end, meaning I don't care what's after it,
989360	993320	just show me anything that has this string in the URI.
993580	996620	And when I search it,
997680	1002060	now, here, we can see all these URLs or URIs
1002060	1004820	with all these different links in them.
1004820	1006400	What are they trying to do?
1006600	1011240	Well, how can I know, like, how can I get all this in one nice place?
1011240	1013540	I can just click on info,
1013540	1017240	and I want to say export unique URI with two counts.
1018380	1020320	Now, Molek will take this for us and tell us,
1020320	1023980	okay, well, this command was run five times,
1023980	1026560	this command was run three times, and so on.
1026560	1031000	So now I kind of know which commands they ran,
1031000	1033320	because I can see it's command equal cat,
1033320	1036900	command equal cat, or else, or whatever they're trying to do.
1037180	1040280	And I kind of see here there's a JPEG file as well.
1040280	1046080	Okay, so this is how they probably got that JPEG file
1046080	1049460	or the image of the fraud into our website.
1049820	1055920	So let's find out where did they, like, how did they do this?
1057240	1063000	Let's go back here, and let's do...
1063000	1067700	Instead of this, we are looking for that specific JPEG file.
1068220	1073020	So I'm going to do wildcard and show me anything that has JPEG in it.
1073960	1075180	Load it up.
1076060	1078180	And it's going to show me a lot of stuff.
1079620	1083200	I'm going to say probably it's going to be the biggest file,
1083200	1086640	so I'm going to sort by the size of the data.
1088060	1090740	And this is the biggest file that we have.
1094970	1096350	So it's loading.
1097010	1099950	And here I can see, yeah, it's an image file.
1103290	1105510	But I'm not sure what it looks like.
1105510	1110090	So what I can do in Moloch is I can just click on show images and files,
1110090	1113310	and it will actually render it for us right here in the browser.
1114390	1117370	Now, let's say, you know, I'm not comfortable with doing this
1117370	1121890	or I want to dig in deeper to it or I want to understand what actually happens
1121890	1125030	using Wireshark because I've never used Moloch before.
1125030	1130210	At any session, at any point, you can always just click on download PCAP,
1130210	1133090	and it will kind of, like, save the PCAPs for you.
1133470	1139090	So you can open up in Wireshark and, you know, do your analysis manually
1139090	1140710	if you'd like to.
1144650	1148950	Pretty much that's how they get the file,
1148950	1152270	and that's how they deface our website using a backdoor.
1152270	1157810	If we have time, I think we have another... I think that's pretty much it.
1157810	1163870	Okay, so with that being said, I think that's the highlight of Moloch
1163870	1167290	and how to use it. I want to keep some time for questions.
1168590	1170950	Please let me know any questions you've got.
1171170	1175070	I'm also going to be in Discord. I'll be on Twitter if you need anything else,
1175070	1178450	but I'm going to be here waiting for any questions that you guys have.
1179610	1180610	Cool.
1181290	1182470	Thank you, Bashar.
1182630	1187990	I went ahead and put a note in the text window under the workshop track one
1187990	1194370	with a link over to Recon Episec's OpenSOC Moloch Discord channel.
1194830	1196250	So definitely check that out.
1196250	1199570	Obviously, hit Bashar up on Twitter and Discord,
1199570	1203890	but we're trying to help everybody kind of connect with the right people here
1203890	1205370	so you can get the help you need.
1206870	1207590	Perfect.
1208830	1210990	Thanks a lot, Bashar. I appreciate it.
1211130	1213570	Thank you. Thank you. I appreciate your time. Thank you.
1213590	1214210	Take care.