Violent Python: A Cookbook for Hackers, Forensic Analysts, Penetration Testers and Security Engineers (16 page)

analyst# wget
http://geolite.maxmind.com/download/geoip/database/GeoLiteCity.dat.gz

--2012-03-17 09:02:20--
http://geolite.maxmind.com/download/geoip/database/GeoLiteCity.dat.gz

 Resolving geolite.maxmind.com… 174.36.207.186

 Connecting to geolite.maxmind.com|174.36.207.186|:80… connected.

 HTTP request sent, awaiting response… 200 OK

 Length: 9866567 (9.4M) [text/plain]

 Saving to: ‘GeoLiteCity.dat.gz’

 100%[======================================================================================================================================================>] 9,866,567 724K/s in 15s k

 2012-03-17 09:02:36 (664 KB/s) – ‘GeoLiteCity.dat.gz’ saved [9866567/9866567]

 analyst#gunzip GeoLiteCity.dat.gz

 analyst#mkdir /opt/GeoIP

 analyst#mv GeoLiteCity.dat /opt/GeoIP/Geo.dat

Jennifer Ennis produced a pure Python library to query the GeoLiteCity database. Her library can be downloaded from
http://code.google.com/p/pygeoip/
and installed prior to importing it into a Python script. Note that we will first instantiate a GeoIP class with the location of our uncompressed database. Next we will query the database for a specific record, specifying the IP address. This returns a record containing fields for city, region_name, postal_code, country_name, latitude and longitude, among other identifiable information.

Running the script, we see that it produces output showing the target IP’s physical location in Jersey City, NJ, US, with latitude 40.7245 and longitude −74.0621. Now that we are able to correlate an IP to a physical address, let’s begin writing our analysis script.

In the following chapter, we will primarily use the Scapy packet manipulation toolkit analyze and craft packets. In this section, we will use a separate toolkit, dpkt, to analyze packets. While Scapy offers tremendous capabilities, novice users often find the directions for installing it on Mac OS X and Windows extremely complicated. In contrast, dpkt is fairly simple: it can be downloaded from
http://code.google.com/p/dpkt/
and installed easily. Both offer similar capabilities, but it always proves useful to keep an arsenal of similar tools. After Dug Song initially created dpkt, Jon Oberheide added a lot of additional capabilities to parse different protocols, such as FTP, H.225, SCTP, BPG, and IPv6.

For this example, let’s assume we recorded a pcap network capture that we would like to analyze. Dpkt allows us to iterate through each individual packet in the capture and examine each protocol layer of the packet. Although we simply read a pre-captured PCAP in this example, we could just as easily analyze live traffic by using pypcap, available at
http://code.google.com/p/pypcap/
. To read a pcap file, we instantiate the file, create a pcap.reader class object and then pass that object to our function printPcap(). The object pcap contains an array of records containing the [timestamp, packet]. We can then break each packet down by into Ethernet and IP layers. Notice the lazy use of our exception handling here: because we may capture layer-2 frames that do not contain the IP layer, it’s possible to throw an exception. In this case, we use exception handling to catch the exception and continue on to the next packet. We use the socket library to resolve IP addresses stored in inet notation to a simple string. Finally, we print the source and destination to the screen for each individual packet.

Running the script, we see the source IP and destination IP address printed to the screen. While this provides us some level of analysis, let’s now correlate this to physical locations using our previous geo-location script.

Improving our script, let’s add an additional function called retGeoStr(), which returns a physical location for an IP address. For this, we will simply resolve the city and three-digit country code and print these to the screen. If the function raises an exception, we will return a message indicating the address is unregistered. This handles instances of addresses not in the GeoLiteCity database or private IP addresses, such as 192.168.1.3 in our case.

Adding the retGeoStr function to our original script, we now have a pretty powerful packet analysis toolkit that allows us to see the physical destinations of our packets.

Running our script, we see several of our packets headed to Korea, London, Japan, and even Australia. This provides us quite a powerful analysis tool. However, Google Earth may prove a better way of visualizing this same information.

Google Earth provides a virtual globe, map, and geographical information, shown on a proprietary viewer. Although proprietary, Google Earth can easily integrate custom feeds or tracks into the globe. Creating a text file with the extension KML allows a user to integrate various place marks into Google Earth. KML files contain a specific XML structure, as show in the following example. Here, we show how to plot two specific place marks on the map with a name and specific coordinates. As we already have the IP address, latitude and longitude for our points, this should prove easy to integrate into our existing script to produce a KML file.

Let’s build a quick function, retKML(), that takes an IP as input and returns the specific KML structure for a place mark. Notice that we are first resolving the IP address to a latitude and longitude using pygeoip; we can then build our KML for a place mark. If we encounter an exception, such as “location not found,” we return an empty string.

Integrating the function into our original script, we now also add the specific KML header and footer required. For each packet, we produce KML place marks for the source IP and destination IP and plot them on our globe. This produces a beautiful visualization of network traffic. Think of all the ways of expanding this that could prove useful for an organization’s specific purpose. You may wish to use different icons for the types of traffic, specified by the source and destination TCP ports (for example 80 web or 25 mail). Take a look at the Google KML documentation available from
https://developers.google.com/kml/documentation/
and think about all the ways of expanding our script for yourorganization’s visualization purposes.

Running our script, we redirect output to a text file with a .kml extension. Opening this file with Google Earth, we see a visual depiction our packet destinations. In the next section, we will use our analysis skills to detect a worldwide threat posed by the hacker group Anonymous.