0

I'm trying to get a particular piece of malware to beacon, and I have my box connected to remnux, with inetsim and fakedns running. Using this setup I have been able to acquire good pcap from most samples, but this one is a bit vexing.

I can see that my sample is reaching out over TCP to the correct C2 server, but ICMP returns "destination unreachable (network unreachable)". I went ahead and used route/iptables as described in this post: https://techanarchy.net/blog/installing-and-configuring-inetsim but now I'm finding it difficult to find the traffic since it's all to my IP in wireshark, and it seems to be ssl encrypted.

Where do I go from here?

1

Ok, nevermind.

The answer to my question is that my particular sample uses it's own custom protocol that it sends over SSL. I can't go into further detail without mentioning the particular sample family I was working on.

I didn't need to decrypt SSL traffic or anything, my previous steps actually did expose the web traffic the way I wanted it.

Also, I was wrong that my steps changed the source/destination in wireshark, it was actually fine.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.