Wireshark cheat sheet for malware analysis, CTF and so on

http.request or dns or tls.handshake.type= =1 

From the above filter result, we can select host and server name and apply as column. or we can do the following. 

Making custom column for malware analysis:

edit menu > preference > appearance > columns > +

Title: Host    Type: Custom    Fields: http.host

Title: Server Name    Type: Custom    Fields: tls.handshake.extensions_server_name

Changing time display:

View>Time Display Format>UTC Date and Time of Day (1970-01-01 01:02:03.123456) Ctrl+Alt+7

then View>Time Display Format>Seconds

Customize filter: As per brad duncan paloalto unit 42 lession

Type this filter keyword:

(http.request or tls.handshake.type eq1) and !(ssdp) in the display filter then save it by clicking the right most + sign. Then give a simple label name as basic. 

or old wireshark packet, you need to use ssl instead of tls.

(http.request or ssl.handshake.type eq1) and !(ssdp) in the display filter then save it by clicking the right most + sign. Then give a simple label name as basic.  

(http.request or tls.handshake.type eq1 or tcp.flags eq 0x0002) and !(ssdp) in the display filter then save it by clicking the right most + sign. Then give a simple label name as basic+. 

(http.request or tls.handshake.type eq1 or tcp.flags eq 0x0002 or dns) and !(ssdp) in the display filter then save it by clicking the right most + sign. Then give a simple label name as basic+dns.

For Adding host or server name column:

Go to column preference. Add the column. Give it a name as host. Then from the drop down select custom. Then type the below keyword:

http.host or tls.handshake.extensions_server_name

or

http.host or ssl.handshake.extensions_server_name

Adding TLS Pre-Master secret key:

Edit>Preferences>Protocol>TLS

ICMP data tunneling:

Statistics>Protocol Hierarchy   (observer percent packet column)

Check file menu>export objects > http to see, any icmpsh.exe tool is downloaded or not. 

During data exfiltration via icmp, the data size will be higher than the usual. so apply filter as,

icmp and data.len>60

frame contains "gmail.com"

strings icmp_tunneling.pcapng | grep -i gmail

strings -n 8 icmp_tunneling.pcapng | grep -i gmail

Detecting port scan, brute force and flooding attack using wireshark:

capinfo capture.pcapng (giving some important info about the pcap)

Brute force:

ftp (type ftp in display filter in order to detect ftp brute force)

Search for packets where info column is written as Login Successful

frame contains "incorrect"

frame contains "successful"

strings -n 8 filtered.pcapng | grep -i "successful"

So we come to an conclusion that, 192.168.6.2 our ftp server and malicious user from source ip 10.99.99.99 tried to ftp brute force. 

Port scan detection:

Nmap is a most popular tool for enumerating ip and port numbers along with other informations. The main characteristics of nmap is, attacker will start scanning the target network or server to see how many ports are open in the remote server. 

If you see in any packet that majority of the traffic are coming from different public ip to port 80 on the web server of 192.168.6.2 then this is not nmap behavior. Also this server 192.168.6.2 will give reply as source to those http request. Also previously we found that 10.99.99.99 was the brute force attacker ip. so we can filter out all of this. Then we can catch the nmap port scanner culprit.

! ip.addr = = 10.99.99.99 && ! tcp.port = = 80 && ! ip.src = = 192.168.6.2

Flooding detection:

The motive of flooding attack is make the server unresponsive. How you can make sure some flooding or ddos attack is happening in your network? Destination will be same and source will be multiple. They randomize source ip using a tool hping3. We can filter out our last two attackers ip address and we know our web server is at 192.168.6.2 so we can filter this ip as source as well because this ip will reply in response with those web request at port 80. We dont need to see those reply packet as source. We can not filter tcp.port = = 80 because the hit is coming at 80 port. If we filter that then we can not detect the actual one.

! ip.addr = = 10.99.99.99 && ! ip.addr = = 10.66.66.66 && ! ip.src = = 192.168.6.2

 

Finding username and password in http POST request:

When you need to find password in http 80 plain text protocol, then http POST method would help in wireshark packet capture. 

http.request.method = = POST && frame contains "Mozellobel-EiZ"

or 

http.request.method = = POST && http.file_data contains "Mozellobel-EiZ"

You should see some packets that contains password for Mozellobel-EiZ user. Now question is in which packet should i look for? Always look for last packet. 

We can also find password by leveraging strings and grep command. 

strings -n 9 capture3.pacpng | grep -i mozellobel-eiz

Check the last entry. 

In order to find hostname or computer name and username in wireshark:

filter with, kerberos.CNameString keyword. Then choose any packet>expand Kerberos>expand tgs-rep> expand cname>expand cname-string>right click on CNameString and select apply as column. 

NBNS and dhcp protocol filter will help sometimes when DC is not involved.

 

ssh private key finding:

filter with: frame contains "private" or "RSA"    filter with tcp protocol and see last packets as well.

take the key and save in a file say id. in this id file we saved the private key and we need to provide it id file during ssh connect using -i switch. 

ssh -i id username@servername

If told attacker or somebody search for some files in the web:

Then filter with http packets and GET request. http.request.method eq GET

Also keep an eye on the file name. Filter with that as well like frame contains "file name"

During extraction of files:

MZ --> for exe

ELF --> for Bin

For persistency establishment:

search with cron jobs in packet. 

QuickBot smtp packet:

(http.request or tls.handshake.type eq 1 or (tcp.port eq 65400 and tcp.flags eq 0x0002) or smtp or pop or imap) and !(ssdp) 

Finding the SYN packets with https requests:

tcp.flags == 0x0002 || tcp.flags == 0x00c2 || http.request || ssl.handshake.type == 1

Sometimes we need to examine wireshark in unintended way. Meaning use grep to find out the flag or export files or use binwalk -e pcapng or foremost command. Then examine the output files to get the flag. 

Avi