It's DNS again 😢 Did you know this Malware Hack?

Key Takeaways

that's why packets to me are so important to learn how to capture and understand it will make you better at troubleshooting and it will also help you with exercises like this in threat hunting or when we have been compromised help to back up and piece together what happened the idea here is that this could walk right by that it looks it's buried in plain sight right so that's what makes this example so interesting what do you think David are we dealing with malware or not it looks like it doesn't it [Music] I really want to thank brilliant for their fantastic partnership and for sponsoring this video it doesn't matter if you want to learn cyber security ethical hacking networking artificial intelligence programming you need to learn about numbering systems in this example I've captured some Network traffic I'm capturing traffic sent to and from this router notice the format of this number Fe 80 sending traffic to ff02 what numbering system is this this is IPv6 and these are hexadecimal numbers hexadecimal is only one numbering system that you need to learn another one is binary do you understand this joke there are two types of people in this world those that understand binary and those that don't you need to understand binary you need to understand hexadecimal you need to understand decimal it's important that you understand numbering systems again doesn't matter if you want to be a network engineer doesn't matter if you want to do programming artificial intelligence Etc you need to learn this and there's no better place to learn math and computer science than brilliant brilliant gives you some history of how numbers were used by different different cultures and then moves on to Modern applications of decimal binary and hexadecimal brilliant goes beyond the basics when it comes to teaching your numbering systems in binary and helps you developed a more well-rounded understanding and intuition surrounding numbering systems if you want an easy interactive way to learn then brilliant is the answer for you brilliant now offers a 30-day trial with a 20 discount if you sign up using my link brilliant.org forward slash David Bumble I really want to thank brilliant again for the partnership and for sponsoring this video if everyone is watching Chris is going to show us some something really cool with DNS please put in the comments below did you know this so when you've finished watching this video or part of the video put in the comments below did you actually know that this was possible to do with DNS and that DNS could be used as a way to attack your clients as they commonly say it's always dns's fault and here's another example of where DNS could be used by a malicious actor to attack your network yeah David and this one gets a little bit scary and and really the intent here is that this would if we don't have a properly configured IDs IPS system the idea here is that this could walk right by that it looks it's buried in plain sight right so that's what makes this example so interesting I think a lot of people are under the misconception that DNS is just used to resolve a domain name like packet Pioneer to IP address but actually you're going to show us that it can do a lot more than that right yes exactly so that's exactly what many people just think DNS only does here's an IP address what's a name or here's a name what's an IP address but DNS can do a whole lot more and let's let's take a look now as you mentioned before this is an example and this is actually taken from a course that I've been teaching on threat hunting with Wireshark and we'll talk a bit more about that course later but this specific example can you see my screen okay so if we just take a walk through it just take a breeze through it real quick we can see that a lot of it is DNS okay so if I just go up to the top I can see that the the one that is sending the DNS requests is this 100.121 device so we're going to call that our client okay so this client is initially talking to this allegedly 888 server now we know from that a lot of us use that as Google DNS however in this case there's something interesting that happens and that's why we know that we might not be directly talking out to that server itself so I want to show you something so we send this request for a reverse record for 8888 we're just asking who is the name that's associated with this IP if I come down to the response here I can see if I go down to DNS here's their answer and coming down here to the lower left you can see dns.google okay if I take a look at the next query this time so here we can see that the client is requesting a text record all right so l dot n s ostrichebs.pl okay so what does that mean well let's just take a look at this request a little bit closer so with DNS DNS is more than just IP addresses and names DNS has the ability to do different types of requests so the query type in this case is a text string just a note about that David real quick I'm just bringing in my browser right here there's a really nice description on cloudflare this was a quick one that I was able to find but just what is that DNS text record well if we take a look at cloudflare I thought this was a really good description of what it is and basically what it does is it allows us originally it was intended as a place for human readable notes to be in records however now it's possible to put some machine readable data into text records and that's where things get interesting so basically it's a way of putting text in a DNS reply okay so a bit more detail in there if you want to go digging through that however I'd rather demo this for you so let me come back to my pcap now we're asking for a text record and we're also asking for this interesting looking site something that I like to do and like to teach others to do is when you see a site that you're not quite sure about one one thing that we can do is always use virustotal to take a closer look at it okay so what I'm going to do is I'm just going to right click I'm just going to do copy value so I can pull that right out of the packet I'm just going to peek into virus total this is something that I like to encourage people to do when you see a DNS record or anything really that that just looks funny okay so I just put this into the search and I'm going to say okay let's go get it and what this does is it looks up that DNS name and it goes to some common vendors and checks to see if it's okay well what do you think David are we dealing with malware or not it looks like it doesn't it it sure does yeah it doesn't look too happy okay so let's go back into our packet capture all right so we go and we ask for a text record from this server so let's see what happens or rather in this record let's see what happens so this alleged 88888 address which may or may not be true we come down let's take a look at the text record that's returned for this lookup and this is where we get this text record now David we don't have to be super amazing coders and scripters and all the things does this look like a good nice happy DNS record to you yeah right but a code right yeah this is code so let's do this I'm just going to take a take a look there's a while loop or something in there it's matching something excellent exactly so right away we can see this isn't happy in fact this is what I'm going to do I'm just going to take and I'm just going to copy this as well or you know what I could do real quick let me just do this let me just right click and I'm just going to do uh show packet bytes now this is where I can see this full string and that's just basically typed out for me and without going too deep into the Weeds on the string itself basically what this is doing is it's giving an instruction to the client to continually come back and ask more questions for more pieces of this code and then when it's finished it will then execute that code all right so let's actually see how that works so this is just the initial request okay so this just came in from this server but now check this out so now we're going to go to a local box which has absolutely been compromised and if I come down here now this is basically in a demo environment this was run but let's go ahead and start to take a look at some more of these DNS records so now this client this client is now starting to do the bidding of the attacker it's going to 100.2 DNS hitting us on a on Fifth Port 53 and let's take a look at what what's happening so first here we have this first request it's going to l.1 NS okay give me your text this server comes back or alleged server comes back and says oh great thank you here's your first instruction dot one now truncated so this text record it's keeping it small basically so to speak so what we're trying to do here is we're trying not to do this massive script in one DNS packet because that might trigger an IDS system an IPS system say whoa wait a second you have a huge DNS record or very large DNS packet that can't be good it's usually DNS requests and responses are smaller packets you know 200 bytes ish or so here's 254 bytes this text record comes back check it out does that look dangerous to you necessarily yeah it's encoded in a weird way but yeah on it on its own it doesn't look too crazy but if we go back to that original request we noticed that there was actually base 64 in the previous request and to come down here you see in Wireshark I can do a decode as and I'm going to say base64. now when I decode it as base64 what's our thought here David you think we're starting to see some safe things yeah it looks extreme more and more dodgy right yeah right this probably isn't something I want to see just in a text value coming back from DNS okay so let's just remember that okay there's that one and if I close this I'm going to come back to my packets we do another query but this time it's for l.2 so the first one was dot one this is dot two okay we do a text query same thing let's kick back let's see what it sends us now another 254 gonna come down here going to right click show packet bytes I'm going to come up here and this is where I can decode as base64 uh oh this looks like the next chunk of that script okay so what's happening is we're requesting this uh basically this script and this we're getting sent this chunk one chunk at a time 254 bytes at a time so you can see request this is one two three four five right so six all of these different ones so all these different pieces well what happens when the client gets all those pieces extracts that text and puts it all together that's what we want to find out so next thing I'm going to do David is I want to show you something super cool that we can do on the command line with terminal shark all right so I just showed you uh in Wireshark we can see that we have these obfuscated or encoded pieces of a script that are being sent over DNS all right so here I am on the command line and something one reason why I do this is because I can take tshark and I can throw a packet capture at it and I can extract certain fields from those packets using t-shark and put them all in one place you can do this without other tools for me it's just something I like to do with t-sharks a terminal shark this is what I'm going to do I'm going to say t shark all right that calls that utility which by the way David if you install Wireshark by default t-sharp will get installed as well so you already have this in your machine if you've installed Wireshark all right so the first thing I need to do is just tell it to read so I'm going to read in and as I recall my let me just as a recall I'm just going to look the C2 analysis that was the name of our file so C2 analysis dot P CAP NG all right and so now I'm going to throw a filter at it I'm going to do dot y or Dash y That's how I set a filter and what I want to do is I just want to filter for all packets coming back basically these 347s and I want to if I click on this this string down here if I go down to the lower left I can see that this is showing me that this string value or this location rather in DNS is dns.txt all right so if I just set a filter for this so let's just do that dns.txt enter what I see is I'm getting all of the responses from that server right because they actually have a dns.txt value in them so that's going to be a good filter for me so let's just do this dns.txt great now what I want to do is I want to extract that field out so I'm just going to do this I'm going to do it's called Dash T and then what I do is I say Fields so that tells me go into whatever field I specify and print that out to my command line now which field do I want Dashie I'm going to do dns.txt all right now if I execute this do we see what we're doing here t-shark hey go read this P CAP use this filter and pull out this field now I have all of those strings in one place for me so David I'm going to introduce you to another buddy of mine and that is cyber Chef so it allows us to take different strings and whatever's been encoded decoded and Tinker around with it so I'm going to go ahead and input that string here so here's all the messy code but let's go ahead and say from base64 so this will decode it and now we have the full string or the full script rather so you and I can now begin to look through this and see hey if this was sent to a victim machine and it ran this script what would it do well here I'm not the best person in the universe with scripting maybe together we can help sort out some of this so basically what we're doing is we're saying hey go go look for or get a text value from that server and I want you to pull out that text information and I want you to Loop and do this until you get a full string once you get this full script back if we come down here this is the type of stuff that my eye looks for what are you gonna do well you're going to reassemble it and then this guy IEX so what is that we'll pop that in Google and just IEX right there and a Powershell script we this is invoke expression okay well that can't be good so that means that I'm sending you pieces of a script and as soon as you get all the pieces invoke it do it okay and we can see send results so what starts to happen here is after the victim machine gets all of these pieces of the script and invokes it the next aspect of this attack is it's now a it's now start sending instructions back now we actually start to see a callback conversation that can be heavily encoded between the attacker and the victim machine using DNS text Fields is the way that that first instruction gets sent and it's sent in pieces to try to flip below the radar of an IDs or IPS once it's actually all pulled out and executed now that invoke expression makes that machine call back to our server and we can begin to control it like how does the very first step happen is it something to do with the DNA so that machine is compromised somehow to go to the wrong DNS server or how does the initial thing kick off to actually request that text file because you've shown us the DNS and then it's requesting the text file but how does it actually start that process David that's a great question so I would imagine a few ways that this could happen one standard good old phishing sending a user a link and then redirecting them to a malicious device that then further runs a script spoofing a DNS server acting like we're the one the authority I'm the captain now initially we're going out to an allegedly known address and we're doing this lookup for uh what looks like to be a good DNS record but then that record gets implanted and the text is what actually starts the script so initially this client is just going out and asking this question but in order to ask that question how did that get to them how did they begin that probably from some type of phishing attack but it's amazing I mean mean the fact that you're doing a DNS query like what you're showing on the screen there and then the answer is here's a text file exactly exactly and the DNS server can just control that client to pull down some crazy text yeah so it's interesting how this malware could be implanted using the text string of a DNS query I think this is just crazy as I always say Chris it's always DNS right that is true and this is also why modern IDs systems are going to be taking a much closer look at inspecting DNS right it used to be that this kind of thing probably would just walk right by but now if you have a string like this or if I come back down to one of the previous records we're looking at even a base64 encoded string isn't as complicated to decode for our detection systems because this was so prevalent and it was about about 2017 18 was where we started seeing this this is this is basically the malware is called DNS messenger and it was really designed to illustrate straight how this could happen how we could bury C2 traffic in DNS calls thankfully now many systems are tuned to be able to detect this better than at that time however it's still something we want to be aware of and how we could deliver that using DNS Chris that's amazing so thanks so much for showing us this example what I really love about what you do is you always take it down to the wire where you can actually see stuff I think you've said it before and correct me because I'm probably going to say it wrong something along the lines that packets don't lie absolutely packets don't lie this is the traffic that's actually on the wire which is another reason why I'm so passionate about anybody not just Network Engineers but cyber Security Professionals if you're just getting started with cyber security studying for your SEC Plus or even net plus or any any entry level certification that's why packets to me are so important to learn how to capture and understand it will make you better at troubleshooting and it will also help you with exercises like this in threat hunting or when we have been compromised help to back up and piece together what happened for everyone who's watching Chris does this stuff day in and day out and Chris we can't say names because of ndas and the like but I know that you're doing some work with government agencies and Banks and big institutions to try and help them with their capturing malware and other stuff just basically teach people how to use Wireshark like you do so I really appreciate you sharing all of this knowledge with us oh no problem David I love coming on and chatting with you and we always find some interesting things so until next time I think I'm gonna go back and and hit my books so for everyone who's watching please put in the comments below what you want Chris to talk about perhaps in future videos we've also got a whole bunch of videos which I've linked below where Chris teaches us why shark teaches us a whole bunch of other things Chris all the very best thanks David all the very best