Second Network Forensics Contest
I just wanted to go over my solution to the second network forensics contest.
First of all a little disclaimer, since this is a competition where scripting is encouraged I decided beforehand to write a script and not rely on any available tools to complete this task (or at least to minimize usage of previous tools).
To begin with, we know that Ann is being monitored closely, since she was an apparent flight risk. After Ann’s disappearance the police brings along a network capture, claiming it to quite possibly indicate her whereabouts.
There are definitely some questions that need to be answered. So to begin with, let’s examine the content quickly using tcpdump. We want to see every IP and port number that has issued any IP traffic. So let’s begin by quickly seeing all the possible sources.
tcpdump -nn -r evidence02.pcap | awk -F 'IP' '{print $2}' | \
awk '{print $1}' | sort -nu
reading from file evidence02.pcap, link-type EN10MB (Ethernet)
10.1.1.20.53
64.12.102.142.587
192.168.1.10.52111
And then to see all the destinations.
tcpdump -nn -r evidence02.pcap | grep IP | awk -F '>' '{print $2}' \
| awk '{print $1}' | sort -nu
reading from file evidence02.pcap, link-type EN10MB (Ethernet)
10.1.1.20.53:
64.12.102.142.587:
192.168.1.30.514:
We see a traffic that most likely is a DNS traffic (port 53) and then some other traffic that seems to going to the server 64.12.102.142 on port 587. Let’s examine the TCP traffic little bit closer using a script that I wrote for the previous network forensic challenge, pcapcat.
pcapcat -r evidence02.pcap -b 0 [1] TCP 192.168.1.159:1036 -> 64.12.102.142:587 [2] TCP 192.168.1.159:1038 -> 64.12.102.142:587
We see that there are only two TCP connections that have been set up in this dump. And they correspond with the output that we saw from tcpdump, that is Ann’s laptop is clearly communicating to the sever 64.12.102.142 on port 587. We need to examine this traffic little closer, so let’s dump it using pcapcat.
pcapcat -r evidence02.pcap [1] TCP 192.168.1.159:1036 -> 64.12.102.142:587 [2] TCP 192.168.1.159:1038 -> 64.12.102.142:587 Enter the index number of the conversation to dump or press enter to quit: 1 Dumping index value 1 Unable to determine output file Give the name of the output file: file_1
And the second stream
pcapcat -r evidence02.pcap [1] TCP 192.168.1.159:1036 -> 64.12.102.142:587 [2] TCP 192.168.1.159:1038 -> 64.12.102.142:587 Enter the index number of the conversation to dump or press enter to quit: 2 Dumping index value 2 Unable to determine output file Give the name of the output file: file_2
Now we have two files, file_1 and file_2 that contain the gathered TCP stream from the network capture. Start by checking out what this is. Try to identify the content using the command file, which uses magic values to determine the filetype.
file file_* file_1: ASCII HTML document text, with CRLF line terminators file_2: ASCII HTML document text, with CRLF line terminators
According to the file command, we are dealing with a HTML document. Let’s try to see if that is correct
head -3 file_1 220 cia-mc06.mx.aol.com ESMTP mail_cia-mc06.1; Sat, 10 Oct 2009 15:35:16 -0400 EHLO annlaptop 250-cia-mc06.mx.aol.com host-69-140-19-190.static.comcast.net head -3 file_2 220 cia-mc07.mx.aol.com ESMTP mail_cia-mc07.1; Sat, 10 Oct 2009 15:37:56 -0400 EHLO annlaptop 250-cia-mc07.mx.aol.com host-69-140-19-190.static.comcast.net
By examining the first three lines in each of these documents it becomes clear to use that this is in fact not a HTML document but a SMTP conversation. So now we know that Ann was actually sending e-mails to the server 64.12.102.142
What IP address is this, let’s examine that a bit:
dig -x 64.12.102.142 ; <<>> DiG 9.6.0-APPLE-P2 <<>> -x 64.12.102.142 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 57356 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 1 ;; QUESTION SECTION: ;142.102.12.64.in-addr.arpa. IN PTR ;; ANSWER SECTION: 142.102.12.64.in-addr.arpa. 3600 IN PTR smtp-mc.mx.aol.com. ;; AUTHORITY SECTION: 102.12.64.in-addr.arpa. 3600 IN NS dns-02.ns.aol.com. 102.12.64.in-addr.arpa. 3600 IN NS dns-01.ns.aol.com. ;; ADDITIONAL SECTION: dns-02.ns.aol.com. 51683 IN A 205.188.157.232 ...
We see that the reverse DNS (or the PTR record) for the IP address points to a server that looks to be a SMTP server belonging to AOL, which can be further strengthen by issuing a whois against the IP address:
whois 64.12.102.142 OrgName: America Online, Inc. OrgID: AMERIC-158 Address: 10600 Infantry Ridge Road City: Manassas StateProv: VA PostalCode: 20109 Country: US NetRange: 64.12.0.0 - 64.12.255.255 CIDR: 64.12.0.0/16 NetName: AOL-MTC NetHandle: NET-64-12-0-0-1 Parent: NET-64-0-0-0-0 NetType: Direct Assignment NameServer: DNS-01.NS.AOL.COM NameServer: DNS-02.NS.AOL.COM Comment: RegDate: 1999-12-13 Updated: 1999-12-16 RTechHandle: AOL-NOC-ARIN RTechName: America Online, Inc. RTechPhone: +1-703-265-4670 RTechEmail: domains@aol.net # ARIN WHOIS database, last updated 2009-10-15 20:00 # Enter ? for additional hints on searching ARIN's WHOIS database.
So we now know that Ann did in fact send two e-mails to this server that belongs to AOL. Now we need to examine the conversation a bit better. To do that I created a script called smtp_anex (SMTP ANalyse and EXtraction tool). So let’s use that script to analyse the traffic:
./smtp_anex -r file_1 -d data_1 ------------------------------------------------------------ SMTP_ANEX (SMTP ANALYSIS AND EXTRACTION) ------------------------------------------------------------ Information from e-mail header Mail from: sneakyg33k@aol.com Recipient: sec558@gmail.com Information from e-mail body Mail from: "Ann Dercover" <sneakyg33k@aol.com> Mail to : <sec558@gmail.com> Subject : lunch next week Authentication information: Username: sneakyg33k@aol.com Password: 558r00lz Header information: date : Sat, 10 Oct 2009 07 x-mimeole : Produced By Microsoft MimeOLE V6.00.2900.2180 x-mailer : Microsoft Outlook Express 6.00.2900.2180 content-type : multipart/alternative; boundary="----=_nextpart_000_0006_01ca497c.3e4b6020" : x-priority : 3 x-msmail-priority : Normal mime-version : 1.0 message-id : <000901ca49ae$89d698c0$9f01a8c0@annlaptop> Additional information: data_response: 250 OK cmd_ehlo: HASH(0x8b3610) banner: 220 cia-mc06.mx.aol.com esmtp mail_cia-mc06.1; sat, 10 oct 2009 15:35:16 -0400 auth_leftovers: 235 - AUTHENTICATION SUCCESSFUL data_cmd_response: 354 start mail input, end with "." on a line by itself header: HASH(0x8b6ec0) ------------------------------------------------------------ The message content ------------------------------------------------------------ -------- Text -------- Sorry-- I can't do lunch next week after all. Heading out of town. = Another time! -Ann -------- HTML -------- <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <HTML><HEAD> <META http-equiv=Content-Type content="text/html; = charset=iso-8859-1"> <META content="MSHTML 6.00.2900.2853" name=GENERATOR> <STYLE></STYLE> </HEAD> <BODY bgColor=#ffffff> <DIV><FONT face=Arial size=2>Sorry-- I can't do lunch next week = after all. Heading out of town. Another time! -Ann</FONT></DIV></BODY></HTML>
The script works by default by going through the SMTP conversation, and plocking out the relevant data.
It then prints the data both on screen and saves it to files (the printing to screen can be silenced using the option -q). I used the option -d to save all the data in the folder “data_1″, which now contains the following files:
- 1-HTML.html
- 1-RAW.txt
- 1-Text.txt
- 1-info.txt
We can clearly see from the output that Ann was sending this e-mail from the address sneakyg33k@aol.com and was sending it to the address sec558@gmail.com. The content of the conversation was (again taken from the output of the script):
Sorry-- I can't do lunch next week after all. Heading out of town. = Another time! -Ann
This looks to be quite suspicious. Ann is claiming that se cannot do lunch because she is heading out of town?
We also see the username and password that Ann uses in this conversation:
Authentication information: Username: sneakyg33k@aol.com Password: 558r00lz
The authentication information that the script reads comes from the command AUTH that is issued during the SMTP conversation:
AUTH LOGIN 334 VXNlcm5hbWU6 c25lYWt5ZzMza0Bhb2wuY29t 334 UGFzc3dvcmQ6 NTU4cjAwbHo= 235 AUTHENTICATION SUCCESSFUL
This is a very common authentication mechanism (LOGIN), where base64 is used to encode the messages, if we just decode it, we get:
S: 334 Username: C: sneakyg33k@aol.com S: 334 Password: C: 558r00lz S: 235 AUTHENTICATION SUCCESSFUL
where S: denotes server communications and C: client one. But we do not need to do this manually, the script does this for us.
Let’s examine the second e-mail a bit close, again using the script
smtp_anex -r file_2 -d data_2 ------------------------------------------------------------ SMTP_ANEX (SMTP ANALYSIS AND EXTRACTION) ------------------------------------------------------------ Information from e-mail header Mail from: sneakyg33k@aol.com Recipient: mistersecretx@aol.com Information from e-mail body Mail from: "Ann Dercover" <sneakyg33k@aol.com> Mail to : <mistersecretx@aol.com> Subject : rendezvous Authentication information: Username: sneakyg33k@aol.com Password: 558r00lz Header information: date : Sat, 10 Oct 2009 07 x-mimeole : Produced By Microsoft MimeOLE V6.00.2900.2180 x-mailer : Microsoft Outlook Express 6.00.2900.2180 boundary="----=_nextpart_000_000d_01ca497c.9dec1e70" : content-type : multipart/mixed; x-priority : 3 x-msmail-priority : Normal mime-version : 1.0 message-id : <001101ca49ae$e93e45b0$9f01a8c0@annlaptop> Additional information: data_response: 250 OK msg: Attachment dumped to file - name: secretrendezvous.docx cmd_ehlo: HASH(0x8b3610) banner: 220 cia-mc07.mx.aol.com esmtp mail_cia-mc07.1; sat, 10 oct 2009 15:37:56 -0400 auth_leftovers: 235 - AUTHENTICATION SUCCESSFUL data_cmd_response: 354 start mail input, end with "." on a line by itself header: HASH(0x8b6ec0) ------------------------------------------------------------ The message content ------------------------------------------------------------ -------- Text -------- Hi sweetheart! Bring your fake passport and a bathing suit. Address = attached. love, Ann -------- HTML -------- <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <HTML><HEAD> <META http-equiv=Content-Type content="text/html; = charset=iso-8859-1"> <META content="MSHTML 6.00.2900.2853" name=GENERATOR> <STYLE></STYLE> </HEAD> <BODY bgColor=#ffffff> <DIV><FONT face=Arial size=2>Hi sweetheart! Bring your fake passport = and a
bathing suit. Address attached. love, Ann</FONT></DIV></BODY></HTML>
Now this looks to be quite suspicious, we can see from the output that Ann is again sending an e-mail, and this time to mistersecretx@aol.com with the subject of “rendezvous”. The text from the message is:
Hi sweetheart! Bring your fake passport and a bathing suit. Address = attached. love, Ann
We also see from the output of the script the following additional information:
msg: Attachment dumped to file - name: secretrendezvous.docx
So there was an attachment with the message, let’s examine the output of the folder data_2
- 1-HTML.html
- 1-RAW.txt
- 1-Text.txt
- 1-info.txt
- 1-secretrendezvous.docx
We can therefore examine the content of the attachment. First of all, let’s calculate the MD5sum of the docx document that was attached to the e-mail.
9e423e11db88f01bbff81172839e1923 data_2/1-secretrendezvous.docx
Since this is a .docx document, we can use other scripts to read it, such as cat_open_xml.pl
cat_open_xml.pl 1-secretrendezvous.docx Meet me at the fountain near the rendezvous point. Address below. I'm bringing all the cash. returning from a call..
We don’t get much from this, perhaps there is more to this document than just text. Since we know that docx documents are nothing more than a simple ZIP file we can just extract the content of the document:
unzip -d doc 1-secretrendezvous.docx Archive: 1-secretrendezvous.docx inflating: doc/[Content_Types].xml inflating: doc/_rels/.rels inflating: doc/word/_rels/document.xml.rels inflating: doc/word/document.xml extracting: doc/word/media/image1.png inflating: doc/word/theme/theme1.xml inflating: doc/word/settings.xml inflating: doc/word/webSettings.xml inflating: doc/word/styles.xml inflating: doc/docProps/core.xml inflating: doc/word/numbering.xml inflating: doc/word/fontTable.xml inflating: doc/docProps/app.xml
Now we see that there is an image that is contained within the document. Let’s examine it
md5sum doc/word/media/image1.png aadeace50997b1ba24b09ac2ef1940b7 doc/word/media/image1.png
The image seems to be taken from Google maps, displaying the meeting place.
Playa del Carmen 1. Av. Constituyentes 1 Calle 10 x la 5ta Avenida Playa del Carmen, 77780, Mexico 01 984 873 4000
Meeting Place
Now we know that there are strong indications that Ann’s secret lover has the email address mistersecretx@aol.com (very sneaky address) and that Ann was sending him a message containing a possible meeting point (again a very subtle document called secretrendezvous). This could very well be the location where she is at right now (since she has disappeared already and this seems to be the only clue of her whereabouts).
The rest is up to the police chief, our job here is done…