Tunneling your connection over DNS

Tunneling traffic over DNS

Disclaimer: I am not responsible for any misuse of this tool and any malice you decide to commit with it. This article was written to educate security professionals about covert channels used to circumvent traffic filtering/blocking. 

Writing a brief post about how to tunnel traffic over DNS. Nothing fancy, just using a tool to get the job done. DNS tunneling is nothing new. It has been around for a while see https://dankaminsky.com/2004/07/29/51/. 

Why would you want to tunnel your machine's traffic over DNS? 

DNS tunneling can be used for many things but not limited to the following:

• Covert channel to hide traffic
• Getting around pay walls(captive portals) at airports or public wifi spots
• Exfilling data from a corporate environment 
• Tunneling a protocol which is blocked in your environment (like SSH)

Some downsides of using DNS as a communications channel are the following:

• Slow and inefficient. DNS traffic has limited bandwidth.
• UDP is used as the protocol for it's packets

To the first point, transfer limit is stated in RFC2035 https://tools.ietf.org/html/rfc1035#section-4.2.1. If the packets are too big, they will be fragmented (which may tip off a admin/analyst viewing the traffic). 

To the second point, UDP does not guarantee delivery of packet to the recipient like TCP. It is a fire and forget protocol. This means the acknowledging and retransmission of the data which may have been dropped needs to be handled by the application (in this case the tunneling tool). 

Demo and tool test

I wanted to test a tool I recently found which does exactly this (along with the use of other protocols). The tool is called XFLTReaT https://github.com/earthquake/XFLTReaT. 

What it does is 

I recorded a video on setting up the tool, running it and tunneling HTTP traffic between two linux machines. Link to the video is below. Enjoy your tunneling! 

Quick guide to dumping memory and creating a volatility profile

This will just be a quick guide on how to dump memory from a Linux server and create a volatility profile for it. 

Manual method

Creating the kernel module with LiME

Ideally you want to log onto a copy of the victim machine. You want to make sure it is the same distro and kernel version as the victim. This is because then you don't have to stop over potentially deleted files on the disk. 

1. sudo apt-get install build-essential
2. git clone https://github.com/504ensicsLabs/LiME
3. cd LiME/src/
4. make
5. scp the .ko file off this machine 
6. Copy the .ko file to the actual victim machine
7. Execute insmod lime_module.ko "path=/tmp/images/ram.lime format=lime"

Creating Volatility profile

Same comment as above, you want to run these commands on a server which is an identical copy of the victim. 

1. sudo apt install zip unzip dwarfdump build-essential
2. wget http://downloads.volatilityfoundation.org/releases/2.6/volatility-2.6.zip
3. unzip volatility-2.6.zip
4. cd volatility-master/tools/linux/
5. make
6. sudo zip linux_`uname -r`.zip module.dwarf /boot/System*`uname -r`
7. scp the zipped file off 
8. Copy the file to volatility-master/volatility/plugins/overlays/linux/ on your analysis machine

Remote capture with Margarita shotgun:

I recently compared two tools for remote capture, LiMEaide (https://github.com/kd8bny/LiMEaide) and Margarita shotgun (https://github.com/ThreatResponse/margaritashotgun). I would recommend you use Margarita shotgun and not LiMEaide, as LiMeaide stomps all over the disk drive which could overwrite data in unallocated sectors which have been recently cleared up after file deletion. 

How to use Margarita Shotgun on analyst machine:

1. Install with pip install margaritashotgun
2. Run margaritashotgun --server [server IP] --username [username] --key [key.pem] --module [lime-module].ko --filename memory_dump.lime

The victim machine simply needs insmod available. 

CTF challenge - Qream writeup

This is again a continuation of the write ups for the CTF competition held within the company I work for. This was in the MISC category and worth 300 points.

Questions/Challenge:

There was one file attach to this challenge.

Step 1. Download the file.

User the Google drive link within the challenge to download the file:

The file details are:

 Name: qream.7z-6e530127545031e65f8d66a408fe72fc98c7297f3b161fe3c6397e513e06eada  
 Size: 819 bytes  
 SHA256: 6e530127545031e65f8d66a408fe72fc98c7297f3b161fe3c6397e513e06eada  

Step 2. Extract contents.
Inside the .7z file we have one folder:

And inside that folder, one file:

Step 3. Assess the png file:

 Name: qream.png  
 Size: 638 bytes  
 SHA256: fd170f31c761404634420c0a903d097723ec13d8110c0f7ada0fea48031d6d4b  

Let's if there is anything odd with this file. We will start with the file command to see if it is indeed a png.

 file qream.png  

We see that it does indeed have a .png magic number at the start of the file.

Now let us see if there are any other magic numbers for any other files hidden in it

binwalk qream.png  

We see that a Zlib compressed data was found but according to the PNG specification sheet, this is normal because this is how PNGs store image data: https://www.w3.org/TR/PNG-Compression.html

Well with no leads now, let us just open the image and see what we see.

The image is a QR code.
Scanning it with my phone reveals that it a URL to an imgur.com link:

And opening this link(https://i.imgur.com/NPwU4xM.png) takes us to another QR code. As the challenge states, this seems like it will be quite a rabbit hole to dig into with the flag at the end of it.

Step 4. Automate the solution.
Since we do not know how deep this rabbit hole goes, this is a perfect opportunity to automate this task! Off to python we go!

Below is the code I wrote to first fetch decode a QR code png, then fetch the data as if it were expecting a URL out of it.
The script uses the qrtools library to decode png images and extracts the data value.

The results of the script are below:

Yes, the script is not perfect and I could have spent more time catching the exception, but when you are trying to solve the problem as fast as possible the means do not matter as long as you reach the goal. You can see in the exception that it could not reach the url, well because it isn't a URL, it is the flag.

flag{QR_Rules_Everything_Around_Me_QREAM}

Forensics CTF challenge - RAMDisk writeup

This is a continuation to the write ups for the CTF competition held within the company I work for. I am bringing you all another forensics challenge I was able to solve. This one was valued at 400 points.

Question/Challenge:

Step 1. Download the file.
The link takes you to a google drive hosted file.
The file's details are: 

 Name: flagflag_crew.7z-89b4071371d484987c8a0431636128b46e8ee99a9185d50fa74f34df9ff40ae7   
 Size: 55.5 MB (58,230,361 bytes)
 SHA256: 89b4071371d484987c8a0431636128b46e8ee99a9185d50fa74f34df9ff40ae7  

Step 2. Extract contents.
Inside the .7z file is one file:

 Name: lime.dump   
 Size: 0.99 GB (1,073,207,392 bytes)
 SHA256: 2ee1ad807663d951bd8f3f3dff88d2321ae343e3e6c26c5f8cf90d261e30cef2  

Lime of course is a linux memory dumping tool. The content of the .7z is a linux memory dump, as stated by the challenge.

Step 3. Acquire Volatility profile.
The description of the challenge states that this image was taken from a 16.04 Ubuntu server. Since I will use Volatility as my memory analysis tool, I will need the proper profile for this OS version. After some Googling I landed on this page which has a collection of Ubuntu profiles:
https://github.com/volatilityfoundation/profiles/tree/master/Linux/Ubuntu/x64

We will need Ubuntu1604.zip.

Save the zip file to the following location:

 volatility/plugins/overlays/linux/  

Instructions here: https://github.com/volatilityfoundation/volatility/wiki/Linux
Verify that the memory profile has been loaded:

 python vol.py --info  
 Profiles  
 --------  
 LinuxUbuntu1604x64 - A Profile for Linux Ubuntu1604 x64  

You should see something like this if it was loaded properly.

Step 4. Investigate the memory image.
I used pslist, pstree and psxview to get an idea of what is running:

 python vol.py --profile=LinuxUbuntu1604x64 -f ../lime.dump linux_pslist  
 python vol.py --profile=LinuxUbuntu1604x64 -f ../lime.dump linux_pstree  
 python vol.py --profile=LinuxUbuntu1604x64 -f ../lime.dump linux_psxview  

I will then take a look at the bash history since I saw that NC was running on the system:

 python vol.py --profile=LinuxUbuntu1604x64 -f ../lime.dump linux_bash  

Interesting.. Netcat is writing to flagflag.7z on the Ramdisk.

Let's see what is mounted on the system:

 python vol.py --profile=LinuxUbuntu1604x64 -f ../lime.dump linux_mount   

We see that the location of the ramdisk is at /home/user/ramfs

Step 5. Investigate the "flagflag.7z" file.

Let's see if this file is open currently:

 python vol.py --profile=LinuxUbuntu1604x64 -f ../lime.dump linux_lsof  

We now have the location of the flagflag file.

We have two options here:

Option 1: Is there a way to dump the entire ramfs from memory to disk?

No time to research and do that!

Option 2: Just carve the entire memory image for .7z files.

This one is much quicker to do and no research involved.

Step 6. Carve the file

We will use a tool called scalpel to carve for magic numbers of files. In our case we want the .7z files.

To specify byte signature, we need to edit the config file:

 nano scalpel.conf   

Edit it so that it contains the following entry to only find .7z files:

    7z  y   2147483648   \x37\x7a\xbc\xaf\x27\x1c  

Make a directory for the output:

 mkdir scalpel_output  

Run scalpel on the memory dump:

 scalpel -b -c ./scalpel.conf -o scalpel_output/ ../lime.dump   

Extract one of the .7z files

 cd scalpel_output/  
 cd 7z-0-0/  
 ls -alh  
 7za e 00000000.7z   

cat out the contents of the flag:

 ls  
 cat flagflag.txt   
 flag{Memory_Forensics_is_hard_Let's_go_shopping}  

We now have our flag.

Pictures for the above commands below: