Forensic Blogs

An aggregator for digital forensics blogs

by

Network Scanning Version 1.0

New Progress

Welcome back to Automated Network Scanning % teams official blog. We have been up to some exciting things since our last post. The first and most exciting thing that we did this month was get our script working. This was the main focus of the team since the beginning of the semester and we spent the majority of our time working on it. We went above and beyond to make sure our script was fully functional and had no bugs. We also were able to get our Raspberry Pi’s working which included adding some servers onto them to test our scanner.

Our First Script

Our team worked hard this month on creating a basic version of our script. Through a lot of trial and error we ended up creating a pretty in depth script. It allows us to perform many different types of scans including a TCP SYN scan, a UDP scan, a TCP connect scan, and a SCTP INIT scan. We also added a feature that allows us to perform a full comprehensive TCP SYN and UDP scan on all available ports, not just the default 1,000.

From here, the team decided to choose email for our output option in our script. Every time we run a scan using our script, each member gets an email with the results of the scan. This email includes information like the IP address of the scanned host , the scan date and time, how long the scan took, the MAC address of the scanned host , the status of the host, what OS the host is using, which ports are open, what services are being run on those ports, and what OS those services are using. We are very happy with the current state of our scanner. We are farther along with it then we thought we would be at this point. Now, the only aspect of our script that we know needs improvement is automation.  

Raspberry Set Up

In October, the team made a lot of headway into setting up our Raspberry Pi. The first thing we did was configure the SD card. This entailed wiping the card and reinstalling all the services we would need. From there we needed to find a way to get our Pi connected to the internet. Our first idea was to use the USB WiFi adapter to connect to the school WiFi. While this method ended up working, but was extremely slow. We instead decided to connect to the internet using Ethernet. This method proved to be much faster. We used our new internet connection to install server software onto our Pi. We installed an SSH server, a file server using Samba, and a web server using Apache. Our Pi’s are now imaged and ready to go.

www.ebay.com/itm/EEEKit-for-Raspberry-Pi-B-2-3-Model-B-Protective-Enclosure-Box-Shell-Case-Cover-/401175589303.

Image from ebay

In the Next Month

We are making haste towards completing our project goal of creating an Automated Network Scanner. In the next month, we will be testing our script on our Pi and the servers we installed, as well as move to some more advanced networks. We hope that November will see us test our Network Scanner on the LCDI Network itself. We will be tweaking our script while we run these scans to try to get faster scan times and add more automation to it. In the meantime, stay connected to us by tuning into the LCDI twitter feed where we will post weekly updates as we continue working on our project.

The post Network Scanning Version 1.0 appeared first on The Leahy Center for Digital Investigation.

by

Automated Network Scanning + Update

Our Progress So Far

Now midway into our network scanning project, things here at the LCDI are moving right along. Our team has continued to build our script and has completed a solid script to run with. We are now testing the script and getting information on ports, their state, and what service is being hosted. We are continuing to build on this and are hoping to have this finished by Thanksgiving break.

Future Plans

Moving forward, we are focusing the bulk of our time and energy into more scripting. We are also beginning to work on our final report which will detail our work and the project as a whole. Thus far, we have completed the introduction. While writing this, we reflected on the work we did which gave a real perspective of how far we’ve come since the beginning of this project at the start of the semester. Starting with little to no experience, we have both come a long way, and now have at least some idea about what we’re doing. A lot of it is still figuring things out as we go and learning on the fly, but we’re already much more knowledgeable than we were at the start.

With the remaining time we have, we will be building both a file server and an SSH server. We’ll use the file server as a remote location to store the results of our scans. This allows us to have our data stored on a separate location, and not use storage on the primary Pi. We’ll use the SSH server so that we can remotely log on to the primary Pi. This allows us to log in to the Pi off-site and still have access to the results. This is useful because it allows one Pi to monitor activity, record it, and use it as evidence to show illegal activity. Instead of only being able to work on one device when there are two of us, we can both access the Pi at the same time, and monitor scan progress and results from remote locations.

Conclusion

Overall, we are still moving at a solid pace on our project and feel we’re in a decent position. Despite not being as far along in our script as some other teams, we are more than making up for lost time and look forward to completing our work.

To learn more about this and other blogs of the LCDI visit us here: LCDI Blog.

Stay in the loop on our current and upcoming projects and events by following us on Facebook,  Twitter, or Instagram. 

 

The post Automated Network Scanning + Update appeared first on The Leahy Center for Digital Investigation.

by

Update: cut-bytes.py Version 0.0.8

cut-bytes.py is a tool I use to select (cut) a sequence of bytes out of a file, using a cut-expression. This expression specifies the start of the sequence and the end of the sequence.

In this example, I use a cut-expression to find the first occurrence of MZ (i.e. [‘MZ’]) and select 8 bytes (8l) starting at the position of that occurrence (-a is ASCII dump):

I realized that with a few changes, I could add a binary grep feature to cut-bytes. Option -g activates this binary grep:

In stead of one occurrence (the first), with option -g, all occurrences are selected.

JSON output is now also available with option –jsonoutput:

This JSON output contains all the selected byte sequences (BASE64 encoded and with metadata), and it can be piped into tools that accept this format, like file-magic.py:

file-magic will then identify each byte sequence. As you can guess, I’m looking for PE files embedded in file update.bin. But the byte sequences are too short (8 bytes) for file-magic.py to properly identify file types. By increasing the length to 512 bytes, file-magic.py has enough data to locate 2 PE files (a 32-bit DLL and a 64-bit DLL) inside update.bin:

Option -G is identical to -g, except that the selected byte sequences will not overlap.

And I also added a “run length encoded” ASCII dump (-A). If 2 or more consecutive output lines are identical, the duplicates are suppressed:

cut-bytes_V0_0_8.zip (https)
MD5: 1A69542E7E9D7348101B7E91884674B7
SHA256: 15BC253323FF162F26BEF784172A502383970E63514DF6B88A09952A19DAE826