Incident Response Lab

Investigation Guide

Did you see that?

Something feels off on this machine. No alerts. But the network is not quiet.

Snort is installed. It should be catching something. So either:

There is no attack
Or we are completely blind

I don't like either answer. Let's find out what's really happening.

Step 01

Get On the Machine

Wait for the Snort VM on the right to finish booting. Once the login prompt appears, log in.

At the login prompt

root

No password. Just hit Enter.

Step 02

Where Is the Traffic Landing?

If something is hitting this machine, it has to come in somewhere. That somewhere is called a network interface.

A network interface is the connection point between your machine and the network. All traffic, incoming and outgoing, passes through it. It has a name and an IP address assigned to it.

You need to identify yours before you can do anything else. If you don't know which interface to watch, Snort watches nothing useful.

Run this

ip addr show

You'll get a list. Look for one marked UP with an IP address on it. Something like:

2: ?????: <BROADCAST,MULTICAST,UP>
    inet A.B.C.D/24 brd ...

Not sure what you're reading? Search: "how to find network interface name linux". You'll understand the output immediately.

Write down what you found:

My interface is:

My IP address is:

Good. Now you know where traffic arrives. Every command from here uses that interface name.

Step 03

Why Is Snort Silent?

Snort is installed. But it's doing nothing. Here's why: Snort runs on rules. Without rules, it sees traffic and reports nothing.

Rules live here on this machine:

/etc/snort/rules/local.rules

Check what's in there

cat /etc/snort/rules/local.rules

You'll see a mostly empty file. Maybe some comments, no real rules. That's why Snort is blind.

Somewhere in the traffic hitting this machine, the attacker is sending a pattern, a keyword. Your job is to write a rule that catches it.

What does a Snort rule look like?

Every rule follows this structure:

alert udp tcp 10.0.0.0/24 192.168.1.2 any any 4444 -> 10.0.0.10 any (msg:"label"; sid:1000001; rev:1;)

alert — what to do when it matches. We want an alert.
udp / tcp — the protocol. Either tcp or udp.
10.0.0.0/24 — source IP. This can be a range (like a subnet), a specific IP (like 192.168.1.2), or any.
10.0.0.10 — destination IP. That's this machine, your IP.
any — source/destination port. You can specify a random port like 4444 or use any.
msg — the label that appears in the alert output. Example: "alert".
sid — a unique ID. Use 1000001 and count up for each rule you add.

Since we don't know the attacker's details yet, what will you enter to catch them? Write the whole rule:

              alert
               
              tcp/udp
               
              ->
              10.0.0.10
               
              any
               
              (msg:"alert"; sid:1000001; rev:1;)

Step 04

Write the Rules

Open the rules file in an editor and add your rules. Use nano if you want something simple, or vi if you're comfortable with it.

Open with nano

nano /etc/snort/rules/local.rules

Or open with vi

vi /etc/snort/rules/local.rules

Write your rules, one per line. Save when done.

In nano: save with Ctrl+O, exit with Ctrl+X.
In vi: press i to start typing, then Esc and type :wq to save and exit.

Step 05

Start Snort

Rules are ready. Start Snort and point it at the interface you found in Step 2.

Replace <interface> with your interface name

snort -A console -q -i <interface>

-A console — print alerts directly to this terminal
-q — skip the startup banner, show only alerts
-i <interface> — the interface to listen on

After starting it'll look like it froze. It hasn't. It's listening. Give it a few seconds. Alerts will come.

Step 06

Read What Snort Is Telling You

When traffic matches your rules, Snort prints something like this:

[**] [1:1000001:1] UDP TRAFFIC [**] [Priority: 0]
{UDP} 10.0.0.???:48752 -> 10.0.0.10:????

That second line is the important one. It shows where the traffic came from and where it's going.

Source: 10.0.0.??? — the attacker's IP. You need the last number after the final dot.
Destination port: :???? — the number at the end of your machine's address.

Now for the payload. The alerts show you the IP and port, but not what's inside the packet. To see the content being sent, you need to look deeper.

Stop Snort with Ctrl+C, then run it in sniffer mode:

Sniffer mode

snort -v -d -e -i <interface>

This dumps the full packet. On the right side you'll see readable text. Look for a word in there:

50 4B 54 3A 36 30 34 20 67 68 6F 73 74   PKT:604 ????

That word is what the attacker is sending. Write it down.

You have all three. Now put them together.

Step 07

Build the Flag and Submit

The IT team needs a report. Package what you found into a single string.

The last octet

The attacker's IP is four numbers separated by dots: A.B.C.D. You only need D, the last one.

10.0.0.138  →  use 138

The destination port

From the alert line, the number after the colon on your machine's side:

10.0.0.138:48752  ->  10.0.0.10:3306
                                        use this one

The keyword

The word you spotted in the packet dump:

PKT:604 ghost  →  use ghost

Put it together:

<keyword>_<last_octet>_<port>

using the example values above:
ghost_138_3306

Submit your flag

found

Type your flag when prompted. Use your actual values, not the example.

Wrong flag tells the attacker someone is watching. They'll go quiet and slow down.

// Quick Reference

Check current rules

cat /etc/snort/rules/local.rules

Edit rules

nano /etc/snort/rules/local.rules

Start Snort

snort -A console -q -i <interface>

View packet content

snort -v -d -e -i <interface>

Submit flag

found

INCIDENT RESPONSE LAB