Cyber security

9/19/2020 CSCI 397 F20: Analyzing ICS Network Traffic with Network Analysis Tools: ANALYZING SMB TRAFFIC

https://training.icscsi.org/mod/lesson/view.php?id=1813&pageid=81 1/4

Dashboard / My courses / CSCI 397 F20 / Week 4 - Lab Exercise - Network Analysis Tools / Analyzing ICS Network Traffic with Network Analysis Tools

Fundamentals of Industrial Control System Cyber Security

Analyzing ICS Network Traffic with Network Analysis Tools ANALYZING SMB TRAFFIC

(EXPECTED TIME TO COMPLETE = 20 minutes | 1:20)

The remainder of the lab exercise will focus on applying some basis skills using the three network analysis tools. This first portion applies to common IT protocols and services. You are encouraged to spend some free time experimenting on your personal network. This section will show you how to extract file data from a network capture. You can re-create this on your home network by sharing a file between two devices while you run Wireshark one of them. Feel free to share your thoughts in the LAB EXERCISE 1 submittal. Questions will be asked throughout this section - your answers should be provided on the LAB EXERCISE 1 submittal document.

This section will use the “multi-network-architecture.pcap” network capture file downloaded in LAB EXERCISE 1. Begin by opening this file in all three network analysis tools – GrassMarlin, NetworkMiner, and Wireshark.

The Server Message Block or SMB is an Application Layer protocol used by multiple operating systems to allow sharing of files across the network. It is also known by the name Common Internet File System In a Windows environment, it can also be used for legacy NetBIOS traffic, and facilitates an access mechanism for inter-process communications (IPC) via the $IPC administrative file share using named pipes.

In the network capture provided, there are primarily two major types of communications using 445/tcp: [1] authentication between Windows Domain Members (10.1.1.60, 10.1.1.251) and Windows Domain Servers (10.1.1.1), and [2] file sharing services between clients (172.16.100.240) and the Windows Server (10.1.1.1).

Using Wireshark, create a Display Filter that will narrow the traffic down to just these three assets.

QUESTION 1: What would the Wireshark Display Filter look like?

Apply the filter now.

You will notice that there is more than just SMB traffic using 445/tcp. You should scroll down the filtered packet list and find the start of the 3-way handshake for the first occurrence of traffic using 445/tcp.

QUESTION 2: What packet number does this occur?

One of the protocols that SMB uses is the NetBIOS Session Service. This should be the first set of packets following the successful completion of the 3-way handshake. Using the data panel within Wireshark, along with what you learned during Week 3, you can identify the position in the OSI 7-Layer Model for the protocol.

QUESTION 3: What layer would you expect the “NetBIOS Session Service” to reside?

Now let us append to the existing Display Filter to limit the information displayed to only contain traffic using the SMB protocol.

QUESTION 4: What would your new Display Filter look like? (Hint: you will need to use a logical "AND")

Apply the filter now.

9/19/2020 CSCI 397 F20: Analyzing ICS Network Traffic with Network Analysis Tools: ANALYZING SMB TRAFFIC

https://training.icscsi.org/mod/lesson/view.php?id=1813&pageid=81 2/4

You should notice that the 3-way handshake is no longer displayed because the filter is looking for traffic using the SMB protocol. The 3-way handshake is establishing a connection on 445/tcp which may not be for SMB in all cases.

Find the first SMB packet after the handshake completes between 10.1.1.60 (client) and 10.1.1.1 (server). This should be “Negotiate Protocol Request”.

QUESTION 5: What packet number contains this file?

Scroll down and observe the sessions that follows. Most of the traffic at this point is associated with a domain login occurring between 10.1.1.60 and 10.1.1.1 and the exchange of policy information that follows.

What we are really trying to find is the transferring of files across the network using SMB on 445/tcp. We can do this by appending a Display Filter that displays SMB Transaction2 Extensions that will show the browsing of remote directories and identification of files that will be transferred. This is done using “smb.trans2.cmd” and “ANDing” it with the previous Display Filter limiting traffic to SMB.

QUESTION 6: What would your new Display Filter look like? (Hint: append "&&" to the previous Display Filter and start typing "smb.trans2." and see what choices your have)

Your Display Filter should start to look like "... && smb && smb.trans2.cmd".

Apply the filter now.

QUESTION 7: List some of the files that you see transferred across this connection

It is important to understand that just because username/password authentication is encrypted does not mean that all the traffic that is transferred after authentication is also encrypted. We are going to see what files have been transferred in cleartext across the network!

Wireshark provides the ability to export certain Objects that are contained in network traffic. You can access this by selecting “File” from the menu, and “Export Objects” at the bottom. For this exercise, select “SMB”.

The packet numbers on the Export report correspond to the packet that “completed” the transfer. Search for the file “shared_file_on_server.txt”.

QUESTION 8: What packet number contains this file?

QUESTION 9: What other text file ending in ".txt" was transferred in this capture file?

Save the the contents of both .txt files to your local hard disk, and open each of them (using Notepad, Wordpad, Write, etc.).

QUESTION 10: Provide the name and contents of the file(s)

Now, switch to NetworkMiner and if you have not already done so, select "File" -> "Open" to import the capture file. Notice how NetworkMiner provides a basic inventory of devices on the network.

Select the "Files" tab at the top. You should see a similar list of files that were extracted from the capture file. You will notice on the "Files" tab that information about the Source and Destination TCP port number is provided. You can also see that NetworkMiner has automatically downloaded the files and placed them in a temporary directory on your local hard disk. This is listed in the "Reconstructed file path" column.

QUESTION 11: What ports is the Domain Server servicing (e.g. the Destination port) in this example containing the two text files?

Go to the "Hosts" tab in NetworkMiner and expand the information for the Domain Server (10.1.1.1). It summarizes the Incoming and Outgoing sessions. Expand the Incoming sessions by clicking the "+". You will notice more than just our SMB traffic has been accessing the server. Four additional TCP sessions have been enumerated.

QUESTION 12: What service is used on each of these ports? (Hint: use Wireshark and a web search)

9/19/2020 CSCI 397 F20: Analyzing ICS Network Traffic with Network Analysis Tools: ANALYZING SMB TRAFFIC

https://training.icscsi.org/mod/lesson/view.php?id=1813&pageid=81 3/4

NetworkMiner also enumerates Outgoing sessions for the Domain Server. Expand the Outgoing sessions and review the information presented.

QUESTION 13: What is the IP address of a server that the Domain Server (10.1.1.1) has acted as a client in an Outgoing session?

QUESTION 14: What service to you think that server is running?

Go back to the “Files” tab and look for the sessions between the Domain Server (10.1.1.1) and this other "server" (10.1.1.254). Notice that you see additional files that were not available from Wireshark. These files are the TLS certificates used to connect to the other "server" using HTTPS on 443/tcp.

Find the file "shared_file_on_server...", and open it by right-clicking and selecting "Open file" to view its contents.

QUESTION 15: What are the contents of this file?

QUESTION 16: What packet number was this file first referenced in?

Go back to Wireshark and look for this packet number. You will have to clear the Display Filter if you have not already done so. Right-click on the packet and select “Follow” and “TCP Stream”. This will display all the packets in the session as a contiguous data stream.

Enter “abcd1234” in the Find field at the bottom and select “Find Next”.

QUESTION 17: What did you find?

Now, go to GrassMarlin and look at the visualization of the packet capture data. If you have not already done so, import the capture file into GrassMarlin. GrassMarlin defaults network definition using a CIDR /24. The networks are listed in a tabular fashion on the left, and visually in the center.

QUESTION 18: How many “groups” or “networks” are shown? (Consider a network as more than one device)

You should notice a couples networks that contain only two assets, one having an IP address that ends with .255. Remember that this is the Broadcast Address for that particular network, and does not usually reflect a physical device. This can easily be confirmed by looking at the hardware MAC address, and can be done by right-clicking the shaded area containing the address. If the MAC address is "FF:FF:FF:FF:FF:FF", then it is the Broadcast Address.

QUESTION 19: Which network(s) appear to have connections to external devices on the public Internet?

QUESTION 20: What countries do these addresses most likely reside in? (Hint: View Details for the address by right-clicking)

QUESTION 21: What transport, port number, and service(s) are used in the external connections? (Hint: View Frames for the details of the packets)

QUESTION 22: Is this traffic legitimate? Why or why not? (Hint: When viewing Frames in GrassMarlin, a right-click will allow the frame to be opened in Wireshark)

QUESTION 23: Do you know what the destination IP addresses represent?

9/19/2020 CSCI 397 F20: Analyzing ICS Network Traffic with Network Analysis Tools: ANALYZING SMB TRAFFIC

https://training.icscsi.org/mod/lesson/view.php?id=1813&pageid=81 4/4

You are logged in as Manish Khatri (Log out) CSCI 397 F20 Copyright (c) 2016-2020 ICSCSI LLC. All rights reserved.

PREV < Objectives NEXT > Analyzing Modbus/TCP Traffic

You have completed 33% of the lesson 33%

◄ Downloading and Using Network Analysis Tools

Jump to... QUIZ 2 - ICS Fundamentals 2 ►