{"id":333,"date":"2019-01-17T06:35:07","date_gmt":"2019-01-17T06:35:07","guid":{"rendered":"https:\/\/mrjsec.co.uk\/blog\/?p=333"},"modified":"2019-01-17T06:35:14","modified_gmt":"2019-01-17T06:35:14","slug":"objective-8-network-traffic-forensics","status":"publish","type":"post","link":"https:\/\/mrjsec.co.uk\/blog\/objective-8-network-traffic-forensics\/","title":{"rendered":"
Objective 8: Network Traffic Forensics<\/center>"},"content":{"rendered":"\n

\ufeff\ufeffIn objective eight we need to find the name of the song described in the document sent from Holly Evergreen to Alabaster Snowball.<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

If we have completed Python Escape from LA Cranberry Pi terminal challenge by SugarPlum Mary, then we can get this hint.
\n“Yay, you did it! You escaped from the Python!
\nAs a token of my gratitude, I would like to share a rumour I had heard about Santa’s new web-based packet analyser – Packalyzer (https:\/\/packalyzer.kringlecastle.com\/).
\nAnother elf told me that Packalyzer was rushed and deployed with development code sitting in the web root.
\nHe found this out by looking at HTML comments left behind and was able to grab the server-side source code.
\nThere was suspicious-looking development code using environment variables to store SSL keys and open up directories.
\nThis elf then told me that manipulating values in the URL gave back weird and descriptive errors.
\nI’m hoping these errors can’t be used to compromise SSL on the website and steal logins.
\nOn an unrelated note, have you seen the HTTP2 talk at KringleCon by the Chrises? I never knew HTTP2 was so different!”<\/p>\n\n\n\n

Also, two hints link1<\/a> and link2.<\/a><\/p>\n\n\n\n

So, let’s jump into this! Heading too https:\/\/packalyzer.kringlecastle.com\/ we can see this website.<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

We have a login screen and a register link, let’s first register an account (before trying anything else, i.e. password spraying?)<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

So let’s try to login with the account created now, it worked! Now we can see this screen.<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n

Let’s try and sniff some traffic and see what we get?<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

Well. I guess that has worked, and if we go to “Captures” we even have a .pcap file, let’s open it in Wireshark and see what we get here.<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

In Wireshark, this is what we can see here, so there are some encrypted captured packets. I bet there is an SSL key somewhere on the website to decrypt.<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

Going back to Packalyzer let’s see what files we can find here, using view-source within firefox we can view the HTML of the page.
\nAlso, we can find this line of code.<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

\u2026. Now, need to find the app.js file!<\/p>\n\n\n\n

Well, I guess they haven’t made it easy to find for us.<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

let’s, do some more digging within the HTML page, and we can see this line of code.<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

So they keep all .js files in \/pub\/, which means.<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

Ummm, nope. Hang on.<\/p>\n\n\n\n

Ah, here we go!<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

So the app.js is here (https:\/\/packalyzer.kringlecastle.com:80\/pub\/app.js)
\nAnd we can see this line of text “const key_log_path = ( !dev_mode || __dirname + process.env.DEV + process.env.SSLKEYLOGFILE )” That’s what we need a key to decrypt the encypted captured packets!
\nHowever, where is the key kept?<\/p>\n\n\n\n

Scrolling down within the app.js file source code, we can see this line of code.<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

load_envs ()
\ncreates each process.env as a subdirectory within this websites root folder!<\/p>\n\n\n\n

So, this means for us we should be able to access this folder “DEV” at (https:\/\/packalyzer.kringlecastle.com\/DEV\/) <\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

Cool! But we stil don’t have that damm Key! Grrr, But do you remember eariler in this line “const key_log_path = ( !dev_mode || __dirname + process.env.DEV + process.env.SSLKEYLOGFILE )”
\nLet’s try and goto (https:\/\/packalyzer.kringlecastle.com\/SSLKEYLOGFILE\/) and see what we get now?<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

Sweet! Now we know the name of the Key which we can find in \/DEV\/ so going too (https:\/\/packalyzer.kringlecastle.com\/DEV\/packalyzer_clientrandom_ssl.log) We can see our SSL key! Wooop!<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

Now let’s copy all of this (yes, all of this!) save it as key.txt<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

Next, let’s go back into Wireshark and load in that key.txt (Note, if you have closed Wireshark or no longer have the .pcap file, do another sniff in packalyzer)
\nTo add the key.txt within Wireshark (first load the .pcap file) and then go to Edit – Preferences – Protocols – SSL and load the key.txt<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

Using the set Key, we have told Wireshark to use; the encrypted captured packets decrypt for us to view, using the filter “http2.data.data” we find what encrypted in a better view.<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

Interesting. Now we can decrypt the encrypted packets were able to see login’s that were made to packalyzer, earlier in this guide you could see we were not admin, I wonder if one of the users here is an admin?
\nWe can see the name “alabaster”, and as we know Alabaster is Santa’s right-hand ma\u2026 Elf. So let’s try his login? (Sorry Alabaster!) “alabaster:Packer-p@re-turntable192”<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

Moreover, we’re now an admin! (Sorry again Alabaster!) <\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

Also, if we look at the Captures tab, we can see one has already done, I wonder what super secret is here?<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

Opening the file “super_secret_packet_capture.pcap” we can see it’s SMTP traffic, in Wireshark let’s select one and “Follow – TCP Stream”, and it seems we have an email, could this be the code to unlock the piano door?<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

There is also an attachment within this email, let’s copy the whole BASE64 told from start to end.<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

So let’s save it to a file, we don’t know what sort of data this is it could be an mp3, pdf, doc, txt? So we save it without any extension.<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

Moreover, we can use Linux’s built-in BASE64 command line to decode the file (https:\/\/linux.die.net\/man\/1\/base64)
\nCommand: “base64 -d file > newfile” we can use the “file” to see what sort of file it is.<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

So it’s a PDF file<\/a>!<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

Moreover, within the PDF file, we can find the following text “We\u2019ve just taken Mary Had a Little Lamb from Bb to A!” So our answer is “Mary Had a Little Lamb.”
\n<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n

Could this be the door code to the piano lock?. Find out Soon.
\n(Spoiler: It’s not) <\/p>\n\n\n\n

References:
\nhttps:\/\/linux.die.net\/man\/1\/base64<\/p>\n","protected":false},"excerpt":{"rendered":"

\ufeff\ufeffIn objective eight we need to find the name of the song described in the document sent from Holly Evergreen to Alabaster Snowball. If we have completed Python Escape from LA Cranberry Pi terminal challenge…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[10],"tags":[13,14,12],"class_list":["post-333","post","type-post","status-publish","format-standard","hentry","category-kringlecon-2018","tag-13","tag-ctf","tag-kringlecon"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/paD3U6-5n","_links":{"self":[{"href":"https:\/\/mrjsec.co.uk\/blog\/wp-json\/wp\/v2\/posts\/333","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mrjsec.co.uk\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mrjsec.co.uk\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mrjsec.co.uk\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mrjsec.co.uk\/blog\/wp-json\/wp\/v2\/comments?post=333"}],"version-history":[{"count":2,"href":"https:\/\/mrjsec.co.uk\/blog\/wp-json\/wp\/v2\/posts\/333\/revisions"}],"predecessor-version":[{"id":368,"href":"https:\/\/mrjsec.co.uk\/blog\/wp-json\/wp\/v2\/posts\/333\/revisions\/368"}],"wp:attachment":[{"href":"https:\/\/mrjsec.co.uk\/blog\/wp-json\/wp\/v2\/media?parent=333"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mrjsec.co.uk\/blog\/wp-json\/wp\/v2\/categories?post=333"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mrjsec.co.uk\/blog\/wp-json\/wp\/v2\/tags?post=333"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}