[SOLVED] Project MITM/PCAP

FALL 2023 Solution link: https://www.ankitcodinghub.com/product/cs-6035-man-in-the-middle-fall-2023-solved/

Learning Goals of this Project:

Students will get familiar with packet capture (PCAP) reading and some common man in the middle techniques. This is where a malicious user puts themselves in the middle of the conversation with another user or application and eavesdrops on all the traffic. Some papers which demonstrate this concept are the following:

• Man-In-The-Middle Attack in Wireless and Computer Networking- A review
• Detection of man-in-the-middle attacks using physical layer wireless security techniques
• On the Feasibility of Large-Scale Infections of iOS Devices

 

Students will familiarize themselves with Layer 2 – 7 network traffic and how to analyze network traffic using Wireshark, a network protocol analyzer, and its libraries such as pyShark.

• For more details about Wireshark you can visit https://www.wireshark.org
• For details about pyShark and tshark you can visit http://kiminewt.github.io/pyshark/

Students will also familiarize themselves with application layer protocols such as HTTP and IRC.

• If you are not familiar with HTTP, we strongly recommend you learn about the protocol, methods, and requests. You can find a good introduction at Mozilla’s developer page and Sam Barros’ Medium page
• IRC was a very common protocol in the early 2000s. For its simplicity and efficiency it’s still in use on multiple settings. Several Botnets use it for Command and Control (C&C) and hacking groups still rely on IRC to exchange information. You can read more and get familiar by reading this Medium article.

 

Finally, this is a graduate course. So it is expected that students will research and understand how these network protocols work by reviewing their RFCs:

• RFC1459 (Internet Relay Chat Protocol): https://datatracker.ietf.org/doc/html/rfc1459
• RFC2616 (Hypertext Transfer Protocol): https://datatracker.ietf.org/doc/html/rfc2616

 

 

The final deliverables:

There are two deliverables for this project, each is under their own Gradescope assignment named Man in the Middle – PCAP Analysis and Man in the Middle – Programming Assignment.

Man in the Middle – PCAP Analysis

A single JSON file named project_mitm.json. A template can be found below please See Submission Details for more information. This submission consists of Flag 1 to Flag 5.

 

Man in the Middle – Programming Assignment

The modified pcapanalysis.py file with the three new functions described under This submission consists of Flag 6 only. Please See Submission Details for more information

Important Reference Material :

• Read the RFCs provided.
• Official Wireshark Guide
• Youtube Video from our TA Renan showing how to install dependencies for Flag 6 and a short example
• If you have no experience with networking or application layer protocols, we STRONGLY encourage you to research those topics. There are many great resources online like Google and YouTube.

 

Submission

Gradescope (autograded) – see Submission Details

 

 

Requirements

Wireshark –  https://www.wireshark.org/download.html

Python3 – Download Python | Python.org

• Pyshark Library – https://github.com/KimiNewt/pyshark/
• TShark: https://tshark.dev/setup/install/

 

Ensure you have nslookup installed on your OS (DNSUtils) (it should come default on any Windows, MacOS or Linux environment)

 

 

Packet Capture – Part I

The packet capture can be downloaded at: https://cs6035.s3.amazonaws.com/MITM/mitm_summer2023.pcap

 

Programming Assignment – Part II

The programming assignment .zip including pcapanalysis.py and TCP.reflection_summer2023.pcap can be downloaded at: https://cs6035.s3.amazonaws.com/MITM/pocapanalysis.zip

 

Hint: You can watch the Youtube Video from our IA Renan showing how to install dependencies for Flag 6

 

 

BACKGROUND

The Necrocryptors (TNC) is a hacking group known for multiple data leaks and has been active at underground forums selling personally-identifiable information (PII) and credit card data stolen from vulnerable websites.

Recently, TNC led a DDoS campaign against multiple targets in the United States, leading to a Federal Investigation by​​ the National Cyber Investigative Joint Task Force (NCIJTF). This investigation was coordinated by the FBI Cyber Crime division and after months of undercover investigation, NCIJTF was able to capture unencrypted communication between members of TNC. While NCIJTF did not disclose how this communication was captured, we can infer that either it came from an insider member of the organization or a sophisticated attack led by NCIJTF allowed this communication to be captured.

In this project, you are playing the role of Mark, an FBI agent from the Cyber Crime division.

You walk into the office, just back from a nice vacation in the Bahamas, and pour some coffee from the shared pot near your cubicle when you hear, “Mark! Great to see you are back! Come over to my desk right now, we need to talk.” It’s your boss, Bill. You think to yourself, Geez! I just came back. This guy doesn’t give me a break.

You take your coffee to Bill’s office, close the door and listen as Bill starts.

“Mark, I have a task for you. We finally got our hands on some incriminating evidence against TNC. With this pile of evidence, the Attorney General is on my neck to bring those guys to justice. But we need some strong evidence of criminal activity that can’t be disputed in court.”

“Okay…” My wife told me to take some extra days off, but no. I had to come back today…

“I’m sending the packet your way,” Bill says, “You have one week to analyze the data and find clear evidence of criminal activity. The Attorney General sent us a list of things they are looking for. It’s all on your desk.”

“Sounds good, boss. It’s great to be back.”

You leave his desk, take a sip of coffee and go back to your computer. No time to slowly get up to speed, you think, but that’s OK. I’m excited to help take TNC down.

Office Setup

 

Ok, vacation is over. Now it’s time to configure your workspace and start the research.

You have two options to complete this assignment:

• Install Wireshark into the VM; or
• Create your own environment and install any tools needed.

 

 

This project does not require a lot of preparation. Just download wireshark, the provided PCAP file, and start analyzing.

 

The next few pages will guide you on installing Wireshark on Windows, MacOS and Ubuntu setup.

 

Installing Wireshark – Windows
To install Wireshark on Windows, please go to: https://www.wireshark.org/download.html. Once there, you will see a page like this:

Click the correct Windows Installer (64-bit or 32-bit), depending on your OS.

 

Here is an example of what the 64 bit option looks like while it’s downloading in the Chrome browser. (It may look different in your browser.)

 

After the file finishes downloading, execute it and you will see the following screen:

 

Just click “Next >” on each page to install with default settings. Then you will see:

A new installation window, for Npcap, will then come up. Please continue through this Npcap installation as well to proceed with the Wireshark installation.

Once the Npcap installation is finished, the Wireshark installation should continue automatically. Once that installation is done, you will see the following:

 

Click “Next” then “Finish.”

Congratulations! Wireshark is now installed on your computer!

 

 

 

Installing Wireshark – Ubuntu

Inside your Linux box, Open Terminal Emulator and run the following command:

sudo apt install wireshark

 

Type in the root password (debian) and “y” to download and install all required packages.

 

During the installation, if prompted, answer “Yes” for the question: “Should non-superusers be able to capture packets?”

 

 

Once the installation is complete, close the Terminal Emulator and locate Wireshark in Applications > Internet > Wireshark:

 

 

Congratulations! You are all set now!

 

Quick Intro to Wireshark

On the PCAP for this project there is a special IP address the Azure Wireserver which is 168.63.129.16 if you work on the azure platform you will have seen this IP address all the time for DNS, Health Probes and much more. Below we will use the IP and some wireshark filter commands to navigate through the PCAP. The command below:

 

ip.addr==168.63.129.16

 

 

If you would like to filter by a protocol and the IP address you would add the protocol before or after the IP address like the following:

 

ip.addr==168.63.129.16 and http

Similarly you can just put the protocol no IP address and that will show all source and destination traffic including that protocol.

Now you know the basics, I strongly recommend you review the Wireshark Guide at https://www.wireshark.org/docs/wsug_html_chunked/ChapterIntroduction.html and the DisplayFilters section at https://wiki.wireshark.org/DisplayFilters.

 

There are numerous videos on YouTube explaining basic Wireshark functionality. I recommend this one from Anson Alex: https://www.youtube.com/watch?v=TkCSr30UojM

 

Python

For this project, you will also need the Python interpreter which can be found here: Python download page

For a guided walkthrough on installing dependencies and going over pyshark, please refer to the Youtube Video from our IA Renan showing how to install dependencies for Flag 6 and a short example

 

For a guided walkthrough using VScode, please refer to the following document: Python tutorial

 

 

Good luck!

 

 

Task 1 (4 points):

Your first task is to figure out where the hackers are spending their time and gather some evidence for the Attorney General. This will also give you a good overview of Wireshark filters.

 

The Attorney General needs some evidence of The Necrocryptors’ associates and where the group meets. For this, you need to gather the following information:

 

• Task 1.1: What is the server address used by the hackers to communicate? g.: irc.someplace.net (1 point)
• Task 1.2: What is the nickname of the malicious actors involved in this conversation ? Add the names in the order they appear in the conversation For the autograder, use the following format: firstactor,secondactor,thirdactor (1 point)
• Task 1.3: What channel do they use to communicate? Hint: Channel names always start with #, so include # in your answer (1 point)
• Task 1.4: What is the hash used by the malicious actor to validate its identity? (1 point)

 

Task 2 (28 points):

Your second task will require you to recover a payload from the conversation. There are multiple ways to do this. You can use Wireshark, pyShark or any other library available.

 

As part of the evidence gathering, the Attorney General needs concrete evidence of malicious intent. For Task 2, you will need to review the conversation between members of TNC and gather incriminating data from this conversation.

 

• Task 2.1 : One of the hackers transfers a file to another hacker, after confirming their identity. What is the name of the file? (Including extension) (6 points)
• Task 2.2: It seems that the file transferred is encrypted. What encryption method or algorithm was used to encrypt the file? (Just the 3-letter name) (4 points)
• Task 2.3: If you decrypt and run the file, you’ll get a unique hash based on your GTID. What is the hash generated? (18 points)

 

Task 3 (26 points):

The Attorney General lets you know that they think there is a web server in here that is phishy and is spitting out long numbers and letters. The Necrocryptors hacking group is known to play tricks with these values. The Attorney General needs the following information to track the folks operating the website:

• Task 3.1: The site domain name (Record just the site’s domain name and the top-level-domain (TLD) name, with the period. E.G: host-name.tld) (2 points)
• Task 3.2: The public IP address (2 points)
• Task 3.3: The primary nameserver for this TLD (You may need to look outside the pcap for this information. Think about tools that will give you the nameserver data for a specific domain) (6 points)
• Task 3.4: The hash provided by entering your Georgia Tech ID in the field (i.e. 9021042) (NOTE: The website is real and safe to access) (16 points)

 

Task 4 (32 points):

The Attorney General is impressed by you but says they believe the group is also using another server to host a malicious file. It appears that one of the hackers recently accessed this server and downloaded a file from it.  As a last minute request, the Attorney General is asking you to investigate what this file is, and where it is hosted.

• Task 4.1: What is the IP address for the server in question? (2 points)
• Task 4.2: What is the username used to log in the server? (4 points)
• Task 4.3: What is the password used to log in the server? (4 points)
• Task 4.4: One file is downloaded from the server, what is the file name? (3 points)
• Task 4.5: What is the programming language used to create this file? (The hackers are using a common encoding format to hide the real contents) (5 points)
• Task 4.6 If you run this file you’ll get a Combined hash. What is the unique hash for your GTID (i.e 902042) ? (14 points)

 

 

Task 5 (5 points):

Exhausted from the prior exercises, the attorney general has two more exercises for you to prove you belong here and that he shouldn’t fire you despite doing a good job. He mentions to you the hackers are getting smart and they have a website called  that has absolutely nothing to do with Azure Firewalls but everything to do with web application firewalls. Apparently there are some weaknesses integrated into the website which allow you to get to different parts of the website something called a path traversal attack.

• Task 5.1: There is a flag labeled 5.1 that outputs a hash when you input in your GTID try to find the page and get the flag (2 point)
• Task 5.2 What is the directory name that contains the hint for 5.3? (1 point)
• Task 5.3: There is a flag labeled 5.3 that outputs a hash when you input in your GTID try to find the page and get the flag (2 points)

Suddenly, your phone rings. You see that the call is coming from Bill’ extension.You were ready to head back home and watch Netflix. Here we go again…

“Mark, great job so far! I was thinking here. This will not be the last time you will be doing this analysis on pcaps, so why don’t we start building a python class with several methods to automate some of the work for next time?”

“When you say we, you are say, why dont I build this class right?” you say.

“Of course not! I already created some skeleton code to help you out. You just need to build 3 functions now” Bill says.

“Oh, ok. Thank you Boss..”

As you hang up the call, Bill sends you via IM a zip file containing the python class and a attack pcap from a past incident so you can create the functions and test.

 

Task 6 (15 points):

For this task, you need to use the provided pcapanalysis.py and TCP.reflection.pcap files to create three functions. The screenshot below shows where you need to code the functions and the expected output on each variable n. You can create as many functions and variables you need, however the provided functions need to return the expected output.

To start, make sure that the package pyshark is installed on your system. Please review pyshark Github page to install the package and its dependency (tshark) : https://github.com/KimiNewt/pyshark/ and https://tshark.dev/setup/install/

When you open pcapanalysis.py, make sure student_id is updated with your 9-digit Georgia Tech id

Do not modify the import statements. All you need to complete this assignment is there. New imports may be ignored by the autograder and your code will fail. Completing Task 6.1 and 6.2 will grant you the remaining 5 points for the project. Task 6.3 is an extra credit of 10 points. Your maximum grade will be 110 points if you complete the entire project!

 

• Task 6.1: Modify def syn_ack(self):function to return n, being n (int) the number of packets on reflection.pcap file that contains ONLY the SYN+ACK flags (3 points)
• Task 6.2: Modify def rst(self):function to return n, being n (int) the number of packets on reflection.pcap file that contains ONLY the RST flag (2 points)
• Task 6.3: Modify def victim_ip_port(self): function to return d, p, being d the IP address of the victim of the attack (string) in the reflection.pcap file and p (int), being the TCP port of the service being attacked. (10 points. Extra credit)

 

 

 

Submission Details:

These are the instructions for how the Attorney General needs you to submit your findings.

 

File submission instructions:

This project needs to be submitted via Gradescope. Navigate to the course in Canvas and click ‘Gradescope’. On the Gradescope website, you will see two assignments for Man in the Middle project. Click on each assignment and submit the proper files there.

 

Man in the Middle – PCAP Analysis – Max of 95 points

Note that for the PCAP Analysis part you have a limit of 20 submissions.

The first test will show how many submissions you already made.

 

Once you hit the limit, your assignment won’t be graded anymore.

Note:  You can click on “Submission History” and activate any past submission you want. But be advised that your final grade will be based on the Active submission at the time the project closes. In the example below, the submission number 12 is active, so the grade on this part of the project is 95. If I activate the Submission number 10, my grade would be 93

 

 

To submit, name your submission file: project_mitm.json. In addition, ensure you replace the placeholders with the flags you retrieve from each relevant task.

 

Note: You can use Notepad++/TextEdit or Vim to create and edit this file. IMPORTANT: Do not use LibreOffice, Word, or any similar document editor. Your submission must be in proper JSON format with no special characters in order to pass the autograder; these document editors are likely to introduce special characters that will make your submission fail the autograder.

 

Here is an example of the provided JSON file:

{ “task1.1”: “<copy flag 1 here>”, “task1.2”: “<copy flag 2 here>”, “task1.3”: “<copy flag 3 here>”, “task1.4”: “<copy flag 4 here>”,”task2.1″: “<copy flag 5 here>”, “task2.2”: “<copy flag 6 here>”, “task2.3”: “<copy flag 7 here>”, “task3.1”: “<copy flag 8 here>”,”task3.2″: “<copy flag 9 here>”, “task3.3”: “<copy flag 10 here>”, “task3.4”: “<copy flag 11 here>”,”task4.1″: “<copy flag 12 here>”, “task4.2”: “<copy flag 13 here>”, “task4.3”: “<copy flag 14 here>”,”task4.4″: “<copy flag 15 here>”, “task4.5”: “<copy flag 16 here>”, “task4.6”: “<copy flag 17 here>”, “task5.1”: “<copy flag 18 here>”, “task5.2”: “<copy flag 19 here>”, “task5.3”: “<copy flag 20 here>” }

And here is an example of how your submitted file should look:
(Note: this is an example; none of these values are correct.)

{ “task1.1”: “something.something.something”, “task1.2”: “BigBird,CookieMonster,OscarTheGrouch”, “task1.3”: “#WOW”, “task1.4”: “a12342342bcde393202013434″,”task2.1”: “somefile.extension”, “task2.2”: “something”, “task2.3”: “a123242342342342342934234”, “task3.1”: “<something.something”,”task3.2″: “192.168.1.10”, “task3.3”: “ns-something-something.something.something”, “task3.4”: “abcdef1234567890953453434″,”task4.1”: “192.168.8.7”, “task4.2”: “something”, “task4.3”: “something”,”task4.4″: “something”, “task4.5”: “something”, “task4.6”: “12123123129413249121249aa”,”task5.1″: “tr95843fkdspugr8euyre0gfd”,”task5.2″: “something”,”task5.3″: “58437594ejgfdiohr8e054309” }

 

Man in the Middle – Programming Assignment – Max of 15 points

There is no limit for this assignment, you can submit as many times as you want.

 

To submit, name your submission file: pcapanalysis.py and wait for the code to execute. There are only three tests. Your grade will be displayed within a few seconds or minutes depending on how many submissions are being evaluated at the time.

 

Good luck!