Step by step pull out the LAN "moles"

Not long agoDomainA network failure occurs. The main symptoms are: the company's lan network speed is very slow, and there is a delay. The Login server has not responded for a long time and often prompts timeout. The author preliminarily judges that this is a common network fault. It may be caused by viruses that cause abnormal network data streams, occupying a large amount of bandwidth and congested the network. Because the switch and router lights in the network are bright and flashing. Who knows, this ordinary network maintenance, but found a LAN "moles ".

First, explain the company's network structure: the company's intranet is divided into VLANFinallyInternetThere are about 200 computers in the network, and the network topology is 1. (Figure 1)

　　I. Tracing for the first time

1. Case Analysis

As a helper, I analyzed the network faults of this enterprise. It may be because the company's network management is not strong enough, the network deployment is not strict enough, and there may be ARP spoofing in the network. ARP storms consume network bandwidth and affect the speed of network response.

Because the company has a large number of hosts, it is difficult to manually find them one by one, so I decided to use network analysis software to find the faulty host. After some image settings, I installed the "kelai network analysis software" on my laptop and connected it to the mirror port of the company's central switch device to capture packets. 30 minutes later, stop the capture and start analysis. There is a lot of key data. By viewing captured data packets, I first felt that the company's network may be infected with the worm virus, which infected other hosts on the network, resulting in a data storm, reduces network performance.

First, check "diagnosis View" and find the"TCPThe number of repeated connection attempts has actually reached 31126. This is abnormal. In order to find more evidence, I sorted the endpoint view by network connection and foundIPThe number of network connections for hosts in 10.8.24.11 reached the top of the list. (Figure 2)

At this point, the author decided to analyze the host, view the TCP connection in the "session View", and found that all the connections that the host initiated to port 445 of the target host. This proves the author's speculation that the host may be infected with the worm and the virus is trying to infect another host 3. Then, in "Summary Statistics", I checked the TCP data packets of hosts with IP address 10.8.24.11 and found that in the time of 30 minutes and 12 seconds, the host sends a total of 29622 TCP synchronization data packets, and the ending data packets and reset data packets are respectively 3253 and 1387 4. Based on the above analysis of the host connection, the author basically confirmed that the host is infected with the worm. (Figure 3) (Figure 4)

2. tamper with the virus nest and the hand blade Virus

Based on this, the author concluded that: After the host with IP address 10.8.24.11 is infected with the worm virus, the virus automatically establishes a connection with the TCP445 port of other hosts through the network, trying to infect other hosts, seriously consuming network resources, the overall performance of the network is reduced. In severe cases, a large area of the network is infected with viruses, resulting in all the hosts on the network being paralyzed. The author isolates the host with the IP address 10.8.24.11 from the network, performs virus scanning and removal on the host, and then re-accesses the network.

　　Level 2 and Level 2 tracking: Find hackers

1. Failed to reproduce

I thought the problem had been solved. Who knows that the company's network manager told me one day that the company's network flow rate was unstable, although it was not as long as the previous long period of stagnation, however, there will also be regular network congestion during work hours, and the network speed will be slow.

2. tool first and step-by-step tracking

First, I use the network analysis software to capture packets on the central node of the network. The time is 20 minutes. Through analysis, I found that there is a large amount of data from the Internet through the router to a host with IP address 10.8.9.17. This data stream accounts for inbound data from the Internet.80% Or above. The author views the list of IP addresses and MAC addresses sorted by the Administrator. the MAC address of this host is 00-0A-E6-98-84-B7. It was originally a file server used to share files within the enterprise. Why is there data from the Internet forwarded to this server? I will check this server immediately. The results surprised the administrator of the enterprise-this file server was configured as a proxy host! (Figure 5)

Is this file server hacked? It's not that simple. Why do intruders need to configure it as a proxy server? Is it not just this server that has intruded into the vro? The author logged on to the vro through the Administrator and found that some people made settings on the vro, many ports were forwarded to this file server.

The reason is clear: Someone intruded into the file server and configured it as a proxy server. Then, the administrator password was used to control the router and port forwarding was set on the router, forward the Internet data to the file server, and then set the proxy to access the Internet on your host.P2PSoftware downloads of large files, movies, and games can cause network congestion.

So why should intruders do this? Originally, the enterprise stipulated that employees could not join the Internet, and the network management service imposed restrictions on routers. Some employees are bound to the Internet during work hours in this way. Then how does he control the router? I learned that the router uses the default user name, a combination of English letters and numbers, and a combination of name and phone number. Apparently, intruders obtain the vro password through social engineering and then control the vro.

3. MAC access, hacker

The next step is to find the intruders. I still use the network analysis software. First, I cancel the file sharing function of this file server, simplify data capture, and set up the network monitoring software. It wasn't long before the software got a lot of data. Through data analysis, I quickly identified several suspicious IP addresses and found the relevant hosts based on the list of IP addresses and MAC addresses. Then, I restored the sharing Function of the file server, canceled the proxy, and reset the complex password for the router. Then, follow suit and find the MAC address.Attack. An employee of the Unit is an employee who broke through the file server and router and then informed several friends to access the Internet through proxy. Later, the employee admitted that a virus had been planted on a machine in the LAN in order to avoid confusion and protect himself. (Figure 6)

Summary:

This tracing result was successfully completed by a common network fault. The network analysis software was indispensable. In addition, the careful analysis of security personnel also plays a key role in highly sensitive network exceptions. This case also provides a warning to malicious users in the enterprise: if you do not know what you are, do not use technology to conduct illegal activities. Of course, network administrators must deploy network devices securely and set robust passwords to prevent network intrusion to the maximum extent possible.