My Watch has Ended, but Yours Just Started!

In this lab, I will install Zeek and utilize it to detect and analyze suspicious network traffic. This will be done through analyzing PCAP files, running Zeek Scripts, and more!

Requirements

For this lab, I am using my Kali VM and my Ubuntu VM. As well as this, I have a Zeek script that I will use (along with a PCAP file) located here or here. Password infected.

Installing Zeek

To begin, I will be installing Zeek on my Ubuntu VM. For the easiest way to copy and paste commands and instructions, I will ssh into my Ubuntu via my Kali VM:

ssh [email protected]

After this, I ran the following commands:

echo 'deb https://download.opensuse.org/repositories/security:/zeek/xUbuntu_22.04/ /' | sudo tee /etc/apt/sources.list.d/security:zeek.list
curl -fsSL https://download.opensuse.org/repositories/security:zeek/xUbuntu_22.04/Release.key | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/security_zeek.gpg > /dev/null
sudo apt update
sudo apt install zeek-8.0

I did not opt in for web courier config settings:)

Moving to my Ubuntu VM, I created a new directory called traffic and copied the given Zeek script file into it from my Kali VM:

scp /home/kali/Downloads/Lab2-NetworkTraffic.7z   [email protected]:~/traffic

# Password = infected

p7zip -d Lab2-NetworkTraffic.7z

I edited my .bashrc. file on Ubuntu and added the following lines:

PATH=$PATH:/opt/zeek/bin
export PATH

This allows for me to run the zeek command from any folder without typing the full installation location!

Lastly, I saved and ran source ~/.bashrc, which reloads the .bashrc after making changes. I can now see my Zeek version number from my install:

Capturing and Analyzing Network Traffic

Now, it's time to start utilizing Zeek by capturing network traffic! I used the following command to do so:

sudo /opt/bin/zeek -i ens18 -C -w goad.pcap

I determined the network interface via ip a.

During the time I was capturing, I generated some traffic, pinging google, champlain, and curling wikipedia. When this was done, I stopped the capture with Ctrl+C:

To verify the creation of this file and that it is formatted properly, I ran file goad.pcap:

Now that I have my packet capture, I can analyze the traffic using Zeek. I used the following command to analyze the file:

This created five files: conn.log, packet_filter.log, ssl.log, dns.log, and ssh.log. conn.log represents TCP/UDP/ICMP connections, ssl.log represents SSL/TLS handshake information, dns.log represents DNS activity, and ssh.log represents SSH connections. Lastly, packet_filter.log seems to be for storing configurations used for filtering for the capture.

Looking in the contents of the conn.log file, I researched what the headers mean:

ts: timestamp
uid: unique ID
id.orig_h: source IP
id.orig_p: source port
id.resp_h: dest IP
id.resp_p: dest port
proto: transport protocol
service: application protocol
duration: time connection lasted
orig_bytes: bytes sent by source
resp_bytes: bytes recieved from dest
conn_state: ending state of the connection
local_orig: where the source is on the network
local_resp: where the dest is on the network
missed_bytes: bytes dropped
history: letters showing flow of packets and flags
orig_pkts: packets sent by source
orig_ip_bytes: total IP packets sent by source
resp_pkts: packets sent by dest
resp_ip_bytes: total IP packets sent by dest
tunnel_parents: UID of the parent connection (if encapsulated in a tunnel)

I used the zeek-cut command to only display the source IP and port, the dest IP and port, and the transport protocol used.

The results displayed here are connections to 10.2.10.140 and 10.2.10.254 mostly, with connections to 8000 and 53. To add to these results the duration and unique identifier, I could add the uid and duration headers via zeek-cut.

To find the details for the domains I accessed in testing, I ran the following commands:

Configuring Zeek using ZeekControl

Zeek can be controlled and configured through the ZeekControl shell, which provides the ability to check Zeek and deploy/start/restart/stop Zeek.

To begin ZeekControl, I ran the following command:

sudo /opt/zeek/bin/zeekctl

From here, I am provided with a shell and a ZeekControl command prompt.

Below shows the status of Zeek, the deployment type, where it is running, and when it started. It is not currently running so there is no time for when it started:

I can use the help command to get an idea of what commands can be utilized, and for what!

Below are sets of screenshots showing the following information:

Disk usage stats

Currently loaded scripts

What the deploy command does

Where the zeekbase and zeekscriptdir for Zeek is

Running version of Zeek

Via config:

Where Zeek logs are stored

I made sure I had a deployed Zeek instance before continuing, and I exited the ZeekControl shell.

Using Zeek Scripts

With the help of written scripts, Zeek can provide more features to help with my analysis. I am going to use a script to extract all files that were seen within the .pcap file.

Zeek scripts have the file extension .bro or .zeek.

Before beginning, I created a new directory for each pcap file, otherwise the files will be overwritten by Zeek. The password for the script is infected_20180524.

Within my pcap1 directory, I ran:

sudo /opt/zeek/bin/zeek –Cr 2018-05-24-Trickbot-infection-in-AD-environment.pcap ~/traffic/extract-all-files.bro

Within my pcap2 directory, I ran:

sudo /opt/zeek/bin/zeek –Cr 2018-05-24-Trickbot-infection-on-single-host.pcap ~/traffic/extract-all-files.bro

After running these commands, I am able to see that log files were created, as well as a directory called extract_files. Within this directory are a series of files:

I can check what file types have been extracted like below. The mime_type will show the file types, which are plaintext files and Windows executable files.

I can then check where exactly the file was downloaded from with the same command, but instead looking at the filename section. This shows each file and where it was downloaded from!

Traffic Analysis using Zeek + Friends

Now, I will now start doing some recon against the domain environment and see how I can discover this using Zeek and other tools!

Clear Windows Event Logs

Before I start with the discovery process, I want to clear the logs on the target system so I can focus on one threat at a time. To clear the event logs, I used the below command with administrator privileges (via cmd.exe). Since I am going to focus on one system only, I will only be running this on GOAD-DC01. However, it is better to do this on all systems generally.

for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"

Using CrackMapExec

Now, I will begin the discovery process by running CrackMapExec using the smb protocol! I made sure my Zeek instance was running prior to starting:

To examiine the traffic created, I utilized the conn.log Zeek-generated file, filtering for only port 445, aka the port used for SMB traffic. However, there was no logs of such connections within this view. I'm not really sure why this happened, and will probably need to discuss it with my professor.

Now, I will check the endpoint, aka GOAD-DC01, for its Windows Event Logs. Below shows my findings:

Network Connections

Can't see anything, 5156, event viewer, etc:(

Null Sessions

Below shows how CrackMapExec operates when scanning SMB, as it creates an anonymous session without credentials to gather info.

User Enumeration

I was unable to find logs of User Enumeration:

Weird User Logon/Logoff

Other Findings

n/a

Starting Fresh

Before moving forward, I deleted all the Zeek logs:

And then I cleared all Windows Event Logs:

Running Nmap

Time to run a full nmap scan and save the results to later use against my domain! I used the below command:

The result of this command generated information from all of the hosts, except for the Windows 11 VM. This did not have any open ports.

Looking at the created files, I have a .gnmap, .nmap, and a .xml file.

I was able to analyze the connections made between Kali and Zeek (Ubuntu) using the below command. This was able to capture the SSH traffic created with the scan.

Now, moving back to Windows (DC-01). I checked the following Event Logs again:

Network Connections

I was unable to record any network connections. I am not sure what the reason for this is, as I should be able to see some connections via nmap, but even after restarting this task (clearing event log/zeek and starting over), I was unable to capture any traffic.

Null Sessions

There were no records of Null Sessions from DC-01, using the Event ID 4624. I believe this is due to the fact that nmap doesn't create sessions, unlike CrackMapExec.

User Enumeration

I could not find any instances of User Enumeration. This is due to the fact that nmap was used with the flags -sV and -sC, which do not attempt authentication, rather just run version and service detection.

Weird User Logon/Logoff

I was unable to find any weird user logons or logoffs.

Other Findings

n/a

Reflection

• This lab gave me a very hard time. Initially, I had to completely redo lab01 because I did not notice the document drift for our Ubuntu OS version. The lab instructions were listed for a 24.04 installation of Zeek while i was on 26.04. This completely broke my Ubuntu VM somehow and made me have to redo everything.
• Another issue I ran into was not being able to get any information from Windows Event Logs. I tried researching countless Powershell commands as well as looked within the physical Windows Event Viewer, and I was not able to access information I assume I should be able to get.
• Overall, I did learn a lot about Zeek and its ability to collect information via logs! I hope to be able to learn more about Zeek in different settings to see how it would interact with systems within a real enterprise infrastructure.