TryHackMe | TShark Challenge 1: Teamwork Write-up
This is my walk-through of the Tshark challenge room on tryhackme, hope you find it useful.
Scenario:
An alert has been triggered: “The threat research team discovered a suspicious domain that could be a potential threat to the organisation.”
The case was assigned to you. Inspect the provided teamwork.pcap located in ~/Desktop/exercise-files and create artefacts for detection tooling.
Your tools: TShark, VirusTotal.
Tasks:
1. What is the full URL of the malicious/suspicious domain address? Enter your answer in defanged format.
To identify the full URL of the malicious or suspicious domain address, we first navigate to the /desktop/exercise-files directory, where the .pcap file is located. This file contains the captured network traffic data that we need to analyse.
Next, we execute the following command:
[ tshark -r teamwork.pcap -T fields -e http.host | sort-r | uniq ]
This command uses tshark to read the “teamwork.pcap” file.
The “-T fields” extracts a specific field from the packets, in this case the “http.host” field specified using “-e http.host”.
“| sort -r | uniq” is used to sort the output in reverse order “showing the result that was found in more packets first” and to remove duplicate entries, showing us the desired results.
Now we’ll try both URL’s on VirusTotal to find out which of them is the malicious one.
The first URL “http://www.paypal.com4uswebappsresetaccountrecovery.timeseaways.com/…” was the malicious domain address, now we’ll use Cyberchef to defang the URL.
Answer: hxxp[://]www[.]paypal[.]com4uswebappsresetaccountrecovery[.]timeseaways[.]com/
2. When was the URL of the malicious/suspicious domain address first submitted to VirusTotal?
To solve this question we’ll refer to the “Details” tab on VirusTotal.
Answer: 2017–04–17 22:52:53 UTC
3. Which known service was the domain trying to impersonate?
Examining the URL “http://www.paypal.com4uswebappsresetaccountrecovery.timeseaways.com/…” we can clearly see that the attacker was attempting to impersonate “Paypal”, as an unsuspecting user would think this is a legitimate address by looking at the first part of the URL.
Get Mazen El-Mekawy’s stories in your inbox
Join Medium for free to get updates from this writer.
Answer: PayPal
4. What is the IP address of the malicious domain?
Enter your answer in defanged format.
To answer this question we would need a command to extract the DNS quires and their source IP. The command should look like this:
[ tshark -r teamork.pcap -T fields -e dns.qry.name -e dns.a | sort -r | uniq ]
The “-T fields” extracts specific data from packets, and the “-e dns.qry.name” extracts dns query names, while the “-e dns.a” extracts the addresses associated with the query.
The address associated with the malicious URL is “184.154.127.226”, defanging it on Cyberchef:
Answer: 184[.]154[.]127[.]226
5. What is the email address that was used?
Enter your answer in defanged format. (format: aaa[at]bbb[.]ccc)
To get the Email address we can search for http POST requests and output the raw content of the http request packet.
To do this we’ll use the next command:
[ tshark -r teamwork.pcap -Y “http.request.method == POST” -T fields -e http.file_data ]
The output of the http POST request reveals user and password credentials, the username is “johnny5aliv@gmail.com”
After defanging.
Answer: johnny5alive[at]gmail[.]com
Thank You..
