CY 620 Malware_Capturing and Analyzing Network Traffic Using a Sniffer_CEH Exam Domain: Sniffing

downloaded from

Scholarfriends

https://scholarfriends.com Downloaded by: writerforacademic@gmail.com | https://scholarfriends.com/singlePaper/309493/cy-620-malware-capturing-and-analyzingnetwork-traffic-using-a-sniffer-ceh-exam-domain-sniffing Distribution of this document is illegal.

Capturing and Analyzing Network Traffic Using a Sniffer OBJECTIVE: CEH Exam Domain: Sniffing

OVERVIEW: In this lab, you will capture and analyze traffic using a sniffer.

Key TermDescription user name or account which has access to all commands along with read and write privileges to root all files on a Linux or other Unix-like operating system a protocol where the data is transmitted between two machines over in clear text. The use of TELNET TELNET, which uses port 23, should be avoided on networks because it is not secure. a free and open source protocol analyzer, which will allow a user to capture network traffic or to Wireshark analyze a capture file.

Post Office Protocol is an application-layer Internet protocol used by local e-mail clients to POP retrieve e-mail from a remote server over a TCP/IP connection.

Transmission Control Protocol is a network protocol designed to send and ensure end-to-end TCP delivery of data packets over the Internet.

Starting the Sniffer 1. Click on the internal Kali 2 Linux icon on the topology.

KALI 2 LINUX MACHINE 2. After the machine is fully loaded, type root for the Username. then click Next.

EXTERNAL KALI 2 USERNAME 3. For the Password, type toor (root spelled backwards), and click the Sign In button.

EXTERNAL KALI 2 PASSWORD 4. Click the black and white icon (second from the top) to launch the Linux terminal.

OPENING THE KALI 2 TERMINAL 5. Type the following command and press Enter, to check for the IP Address of the system. root@kali2:~# ifconfig

NMAP 6. Type the following command and press Enter, so your system will not have an IP Address. root@kali2:~# ifconfig eth0 0.0.0.0 up

NMAP 7. Type the following command and press Enter, to verify that no IPv4 address is listed for eth0. root@kali2:~# ifconfig

REDIRECTION 8. Type the following command and press Enter, to open Wireshark. root@kali2:~# wireshark

WIRESHARK 9. Click OK to the Lua Error when Wireshark opens.

LUA WARNING 10. If asked, click OK to the Running as "root" user and group warning. Otherwise, proceed to the next step.

USER AND GROUP WARNING 11. Select Capture from the Wireshark menu and choose Interfaces.

INTERFACES 12. Select the check box in front of eth0. Notice in the IP column it says none. Click Start.

CLICK START 13. If needed, expand the Packet List Pane by slowly hovering your mouse in the area circled until the up and down arrows appear. Then left-click and drag the Packet List Pane downward. Otherwise, proceed to the next step.

EXPAND THE PACKET LIST PANE 14. After a short while, packets should start appearing in the Packet List.

PACKET LIST

Generating the Traffic 1. Click on the Windows 10 in the topology. After the machine boots up, right-click the cmd – Shortcut and select Run as administrator.

WINDOWS 10 MACHINE

WINDOWS 10 DESKTOP 2. Type the following command and press Enter, to go back to the root of C:\.

C:\Windows\system32>cd \

ROOT OF C:\ 3. Type the following command and press Enter, to ftp to the Windows Server.

C:\> ftp 192.168.1.10

FTP 4. For the User, type ftp. Then press Enter,

FTP 5. For the Password, type zombie. Then press Enter,

FTP Note: For security reasons, the password is not displayd.

6. Type the following ftp command and press Enter, to list all of the files and folders. ftp> ls

FTP 7. Type the following command and press Enter, to switch to binary mode to download the picture file. ftp> bin

FTP SESSION 8. Type the following ftp command and press Enter, to download the JPEG file from the Windows

Server. ftp> get 2008.jpg

FTP SESSION 9. Type the following command and press Enter, to leave the ftp session and exit the ftp sub-prompt. ftp> bye

FTP SESSION 10. Type the following command and press Enter, to leave the Command Prompt session.

C:\> exit

EXIT COMMAND 11. Click the File Explorer icon on the taskbar.

FTP DOWNLOAD 12. Click This PC in the left hand window.

THIS PC 13. Double-click on Local Disk (C:).

LOCAL DISK 14. Double-click on 2008.jpg.

JPG 15. Hover your mouse over the Picture icon. Notice the flag of 999818. Click on the Challenge icon and type the flag number into the answer box. This is just to show you how to capture Challenge Flags you will see throughout this lab..

Challenge Sample # 16. Get the information for below Challenge Flag by using the same techniques from the previous steps.

Challenge #

16. Click the X in the expanded box to close the picture window. Click the X in the top right corner to close the Windows explorer.

CLOSE ALL WINDOWS 17. Click on the Windows 10 icon on the topology. Double-click on the cmd – Shortcut.

WINDOWS 10 DESKTOP 18. Type the following command and press Enter, to connect to the Windows server using telnet.

C:\Users\student>telnet 192.168.1.10

TELNET COMMAND 19. Type y when asked about sending your password information to a remote computer. Then press Enter,

TELNET CONNECTION 20. Log into the remote Windows Server as administrator and press Enter. Type the password of P@ssw0rd. Then press Enter.

Note: The password will not be displayed for security reasons.

TELNET LOGIN 21. Type the following command and press Enter, to add a user account called creeper to the Windows server.

C:\Users\Administrator>net user creeper P@ssw0rd /add

ADDING A USER 22. Type the following command and press Enter, to add creeper to the Enterprise Admins group.

C:\Users\Administrator>net group "domain admins" creeper /add

ADDING A USER TO A GROUP 23. There is another account on the system called superman. View the information about the superman account by typing the following command (Notice the flag of 999818).

C:\Users\Administrator> net user superman

SUPE

RMAN ACCOUNT INFORMATION 23. Get the information for below Challenge Flag by using the same techniques from the previous steps.

Challenge # 23. Type the following command and press Enter, to leave the telnet session on the Windows server.

C:\Users\Administrator>exit

EXIT COMMAND 24. Type the following command and press Enter, to leave the Command Prompt session.

C:\> exit

EXIT COMMAND 25. Double-click on the shortcut to Opera Mail on the desktop.

OPERA MAIL 26. Click the Compose button which is located on the left side of Opera Mail.

COMPOSE EMAIL 27. In the To box, type student@campus.edu.

In the Subject box, type minecraft.

In the body, type You should buy minecraft.

COMPOSE EMAIL 28. Click the Send button to send the email.

OPERA MAIL 29. Click Opera Mail, select Mail, then Check/Send, and then click Check All.

OPERA MAIL 30. The minecraft message should appear in the list.

OPERA MAIL 31. Click Opera Mail and then select Exit.

EXIT

Analyzing the Traffic 1. Click on the Kali 2 Linux machine in the topography.

KALI 2 LINUX MACHINE 2. FTP is in plain text, so you will be able to view the user’s password of zombie. Type the following in the Wireshark Filter pane and then click Apply to view the FTP password of zombie.

frame contains zombie

WIRESHARK FILTER 3. Next, we will examine email traffic. POP is in plain text so you will be able to view the student’s password of P@ssw0rd. Type the following in the Wireshark Filter pane and then click Apply to view POP traffic including the password for the student account.

pop

WIRESHARK FILTER 4. Type the following in the Wireshark Filter pane and then click Apply to view the word buy from the email message you sent previously.

frame contains buy

WIRESHARK FILTER 5. Right-click on the POP frame and select Follow TCP Stream.

WIRESHARK FILTER 6. Read the plain text traffic. Scroll down to read the email about the buying minecraft. Click Close.

TCP STREAM 6. Type the following in the Wireshark Filter pane and then click Apply to view telnet traffic.

telnet

WIRESHARK FILTER 7. Right-click on the first telnet frame in the list and select Follow TCP Stream.

WIRESHARK FILTER 8. Click Entire conversation and then click on the bottom choice in the list.

WIRESHARK FILTER 9. Read the command where the creeper account is crated and added to domain admins. Click Close.

CLICK CLOSE 11. From the Wireshak Menu bar, select file and then select open

CLICK OPEN 11. Click the Continue without saving button

CONTINUE

WITHOUT SAVING 11. Click the Home link in the left hand pane

CLICK HOME 11. Click the capture.cap file and then click open. (Or just double click on the file)

OPEN CAPTURE.CAP 11. Get the information for below Challenge Flag by using the same techniques from the previous steps.

Challenge # 11. Get the information for below Challenge Flag by using the same techniques from the previous steps.

Challenge # 11. Get the information for below Challenge Flag by using the same techniques from the previous steps.

Challenge #

Note: Press the STOP button to complete the lab. © Infosec Learning, LLC. All rights reserved.