# HoneyBOT

{% hint style="warning" %}
Always open malware in a secure environment like a VM.
{% endhint %}

{% hint style="info" %}
We will be using the [REMnux](https://remnux.org/) distribution which is specifically made for reverse engineering.
{% endhint %}

##

> Q1. What is the attacker's IP address?

* We can see that the `Source address` field of the first packet is `98.114.205.102`.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2Fyz3pHopCvUjTwJW5d3K3%2FHoneyBOT%201.png?alt=media&#x26;token=27229181-f7a2-472a-a21f-ad55e757048e" alt=""><figcaption></figcaption></figure>

##

> Q2. What is the target's IP address?

* The target's IP address is included in the `Destination address` field.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FKPWqJE0OlambUXPnw9NQ%2FHoneyBOT%202.png?alt=media&#x26;token=73d45167-f1ab-4982-8cad-99fc9d449cf5" alt=""><figcaption></figcaption></figure>

##

> Q3. Provide the country code for the attacker's IP address (a.k.a geo-location).

* We can obtain more information about the attacker's IP address using [IPinfo](https://ipinfo.io/).&#x20;

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FG6tqVMh3V9qeggqdESuo%2FHoneyBOT%203.png?alt=media&#x26;token=eaa2c203-ceb2-45f1-a6d7-06ea1464983a" alt=""><figcaption></figcaption></figure>

##

> Q4. How many TCP sessions are present in the captured traffic?

* We can find TCP sessions by selecting the `Statistics > Conversations` option.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2F1fijuRLiFnFqQzxlGdtk%2FHoneyBOT%204%202.png?alt=media&#x26;token=7cff2539-8d55-4688-9414-a64b1857b0a5" alt=""><figcaption></figcaption></figure>

* We can see that there are 5 TCP sessions present.

##

> Q5. How long did it take to perform the attack (in seconds)?

* Let us set the time display format to `Seconds since beginning of capture`.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2Fnurj3to8xr0xWgWzTL6U%2FHoneyBOT%205.png?alt=media&#x26;token=5f083ba1-2297-42c9-b18b-82821997f058" alt=""><figcaption></figcaption></figure>

* We can see that the last packet arrives around 16 seconds after the first packet. So it took 16 seconds to perform the attack.

##

{% hint style="info" %}
For some reason there is no question number 6.
{% endhint %}

##

> Q7. Provide the CVE number of the exploited vulnerability.

* Using the following filter we can filter out SMB packets.

```
smb
```

* On observing the packets, we can see a few DSSETUP packets. These are used to obtain information about a remote hosts Active Directory.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2F5uI5cuk1mZOUlkSvb66q%2FHoneyBOT%207.png?alt=media&#x26;token=8cd0f52b-806a-4d92-ac30-908b99a4a005" alt=""><figcaption></figcaption></figure>

* The `Operation` field is set to `DsRoleUpgradeDownlevelServer`.
* A quick google search gives us the CVE number of the exploited vulnerability.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FzrtpDAgnOGP8hF5Xtynm%2FHoneyBOT%207%202.png?alt=media&#x26;token=6d0d41ed-29b1-4c69-a95f-e4e12ba59db3" alt=""><figcaption></figcaption></figure>

* It exploits a buffer overflow which in turn allows the attacker to perform [ACE](https://en.wikipedia.org/wiki/Arbitrary_code_execution) in order to create long debug entries.

##

> Q8. Which protocol was used to carry over the exploit?

* As we saw in the previous question, the protocol used was SMB.

##

> Q9. Which protocol did the attacker use to download additional malicious files to the target system?

* Let us follow the stream through `Analyze > Follow > TCP Stream`.
* On checking the 3rd TCP stream we can see the steps performed by the attacker.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FRGQfwD7dmYPSgQyEtomb%2FHoneyBOT%209.png?alt=media&#x26;token=d35d6a21-2f15-4d27-bb85-cdcafbf6f0b5" alt=""><figcaption></figcaption></figure>

* These steps resemble that of a [FTP login sequence](https://www.ibm.com/docs/en/zos/2.2.0?topic=ftp-logging-in).

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FTiaKXp9qTyTT4HCEfRQH%2FHoneyBOT%209%202.png?alt=media&#x26;token=02e8c5a8-40ed-4066-b5f7-587b091b1423" alt=""><figcaption></figcaption></figure>

* Alternatively, in TCP stream 2 we can see the command executed by the attacker.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FRIImNia58ZFf3DlrBwdt%2FHoneyBOT%209%203.png?alt=media&#x26;token=ea372309-2fb2-4dd6-87b3-8d5c6bd10d07" alt=""><figcaption></figcaption></figure>

* The attacker ran the `ftp` command using the script file `o` and disabled auto-login using the `n` flag.

##

> Q10. What is the name of the downloaded malware?

* Again in TCP stream 3 we can see that the attacker retrieved the copy of the `ssms.exe` file.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FKPEzGn4uthW5aoNyessM%2FHoneyBOT%2010%202.png?alt=media&#x26;token=8188542e-9093-4f7e-bfe7-30435c778cbe" alt=""><figcaption></figcaption></figure>

* In TCP stream 2 we can see that the attacker executed the `ssms.exe` file.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FxoJiOCoreP4CrPqyx7VE%2FHoneyBOT%2010%202.png?alt=media&#x26;token=fb8f7f98-602d-4447-abd6-81893d8ff6eb" alt=""><figcaption></figcaption></figure>

##

> Q11. The attacker's server was listening on a specific port. Provide the port number.

* In the 2nd TCP stream, we can see port `8884` specified in the `echo` command.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FH3YDN0iCYlFPTm1Ubcal%2FHoneyBOT%2011.png?alt=media&#x26;token=76c23524-d6a4-4aa3-bf5c-87fec8b1f20d" alt=""><figcaption></figcaption></figure>

* The result of this command is redirected into the script file `o` used during FTP login.

##

> Q12. When was the involved malware first submitted to VirusTotal for analysis? Format: YYYY-MM-DD

* TCP stream 4 contains the file sent from the attacker to the victim.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FkCVg5e7gr8hKnHzQUFbU%2FHoneyBOT%2012.png?alt=media&#x26;token=3fb444e2-aae8-4e5a-a359-36403c6d4b4e" alt=""><figcaption></figcaption></figure>

* We can download this file in the raw format via `Save as... > Raw`.
* Using the `md5sum` command we can find the hash of the saved file.

```
$ md5sum malware 
14a09a48ad23fe0ea5a180bee8cb750a  malware
```

* We can now search up this file hash using [VirusTotal](https://www.virustotal.com/gui/home/upload).&#x20;

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FLFUB9sJyHgfYsV3lZ77j%2FHoneyBOT%2012%202.png?alt=media&#x26;token=4145854b-5c14-4d7b-b09a-b03d1bf746c4" alt=""><figcaption></figcaption></figure>

##

> Q13. What is the key used to encode the shellcode?
