0

I have some malware I want to study, intercepting its "phone home" connections, sniffing where and how it is trying to connect and then somehow, by pretending I am the host(s) he is connecting to, answer back and thus try to learn its "protocol".

I assume VirtualBox will be part of the solution. But I also noticed that I will need special precautions so my LAN does not get exposed.

So my question is:

  • How to configure VirtualBox guest so it can not, by any means, access my PC (the host) files, or my LAN? From my previous question, I think I need to disable networking in guest. But then...

  • How can I (either at host or guest) sniff all connections he is trying to make? Hostnames, IPs, ports, content, etc? Installing Wireshark? Where, in host or guest? How?

  • Once I know the IPs/hostnames, how can I (again, at either guest or host) pretend to the malware that I am such hostname and reply its connections, communicating with it? Installing Apache and using cgi/php scripts etc? Where and how?

I know this is a complex question, so to simplify: what really I need is the outline of a solution, a strategy that satisfy the goals. The list of tools, how they fit, and a general description of how it would work.

Something like, example: "Set VirtualBox network to xxx mode, install wireshark on guest to sniff, edit /etc/yyyy so all conections are redirected to daemon zzz which will in turn invoke your scripts so you can reply to the malware"

Useful info:

  • Host is Ubuntu 12.04
  • Malware is a java jar, so guest can be anything
  • Most connections are plain HTTP/HTTPS requests (but there may have more I'm unknown of)
Improve this question
2
  • This seems to be a whole boat full of questions in one, making this statment true "Your questions should be reasonably scoped. If you can imagine an entire book that answers your question, you’re asking too much.", so edit it down start with the first question.
    – Mateo
    May 2, 2013 at 20:06
  • @mateo_salta: That's precisely why I said that "a general outline of the solution is enough, no details needed". And suggestions on how to approach the problem and describe "the big picture" is far from "an entire book". I can dig the details myself, I just asked for directions.
    – MestreLion
    May 2, 2013 at 22:39

1 Answer 1

Reset to default
3

I think it would be easier to decompile the .class files that are zipped in the .jar, and inspect the source code. Or inspect the bytecode directly, with javap. This is not applicable if you need to inspect native libraries in the jar.

To answer your question: Set the VM's network mode to Internal Network, and have it share the internal network with another VM, that either has Squid and plays the role of a proxy, or has Apache/nc and pretends to be the remote machine.

If you want Internet access, have 2 network controllers on the proxy: one on the Internal Network, and the other one as Bridged or NAT. But you'll have that problem again, the networking mode will not distinguish your LAN from the rest of Internet.

To monitor connections, you can use netstat, possibly in combination with watch.

To sniff packets, you can use Wireshark on the proxy.

To fake connections at a low level, look into netcat (nc). To fake HTTP connections, either set a static IP on the proxy, or change the infected VM's /etc/hosts to redirect connections to the proxy IP.

Edit: To emulate connections and services, there is a tool called INetSim, available from the Ubuntu repositories starting with Bionic (https://packages.ubuntu.com/search?keywords=inetsim).

Improve this answer
5
  • I've tried decompiling (btw, check askubuntu.com/questions/272189 ), but it is heavily obfuscated, and I'd better not to rely on my java reading skills to assert what a software does. But that's how I know it makes http connections.
    – MestreLion
    May 2, 2013 at 17:24
  • 2 VMs is an interesting approach. If one can fake the HTTP connections, then I think I don't need internet connection. I can always connect to the real destination with my machine to learn how the server replies, and adjust the fake VM to reply in a similar way, keeping the malware isolated from host pc and lan
    – MestreLion
    May 2, 2013 at 17:29
  • Can you please elaborate more on the /etc/hosts to redirect connections part? Can it redirect all connections to the fake server? If malware connects to multiple sites, can fake server distinguish them, and reply appropriately so malware sees replies as coming from the several places it connected to? URLs for any tutorial on that topic is appreciated
    – MestreLion
    May 2, 2013 at 17:34
  • /etc/hosts maps hostnames to IP addresses. It is only useful if the malware makes use of hostnames. Edit the file so that the hostname is mapped to the fake server's IP address. On the contrary, if the malware uses IP addresses, it will be of no use. If the malware contacts multiple sites, you'll have to set up a fake server for each IP. Well, you could try to attach multiple "Internal Network" cards on the same fake server and make it have a different IP address on each of them, but I've never tried it, don't know whether it works, and don't know how to distinguish between them.
    – ignis
    May 2, 2013 at 17:58
  • Looks a very promising approach... I'll investigate more on that route, thanks!
    – MestreLion
    May 2, 2013 at 18:34

Not the answer you're looking for? Browse other questions tagged .