## 4 DPI Applied to Honeynet Traffic and Attacks
### Layer 5 to 7 Payload Analysis
#### 4.4.3 Traffic Analysis of Ports 445 and 139  
W32.IRCBot-TO is a malware that creates another kind of botnet that opens a backdoor exploiting a buffer overflow vulnerability for Windows systems (CVE-2006-3439), allowing attackers to remotely execute code via a crafted Remote Procedure Call (RPC) message. Most of the traffic from these hosts infected with the malware of this botnet towards the Honeynet were destined to ports 445 and 139. The worm spreads itself using the Internet Relay Chat (IRC) protocol as a backdoor, which grants the botmaster access to the infected machines, and can be used, for instance, to collect information from the infected machine, perform DDoS attacks and terminate and run arbitrary processes [74]. As modus operandi, it downloads and executes a binary file named _netadp.exe_ and then scans for other vulnerable victims. For these protocols, the analyzed fields were _path_ and _file_, which are usually assigned in the presence of this malware to, respectively, \<target-ip>\IPCV$, \<browser or \ssrvsvc.  
In the following, there is the sequence of packets transmitted by an attacker (SEQ 1), whose IP was 9x.4x.53.209 (georeferenced to Ireland) towards the XP honeypot. The first number in each line is the transmitted packet number, and the arrows represent its direction.  
SHQ 1  
522379 <-> 9x.4x.53.209 TCP 1963 - 172.30.20.36 TCP 139 [SYN, SYN,ACK]  
522380 > SHB Negotiate Protocol Request  
522385 <- SHB Negotiate Protocol Response  
522387 > SHB Session Setup Anal Request, NTLMSSP_NEOUTIATE  
522388 <- SHB Session Setup Anal Response, NTLMSSP_CHALLENGE, Error: STATUS_MORE_PROCESSING_REQUIRED  
522389 > SHB Session Setup Anal Request, NTLMSSP_AUTH, User: \  
522390 <- SHB Session Setup Anal Response  
522391 <- SHB Term Connect Anal Request, Path: \<honeypot-public-Ip\IPC$  
522392 <- SHB Tree Connect Anal Response, Path: \<honeypot-public-Ip\IPC$  
522393 >- SHB Tree Connect Anal Response  
522394 <- SHB NT Create Anal Response, Path: \ssrvvc  
522395 <- SHB NT Create Anal Response, FID: 0x0000, Error: STATUS_ACCESS_DENIED  
522394 <- SHB NT Create Anal Response, FID: 0x0000, Error: STATUS_ACCESS_DENIED  
522397 <- SHB NT Create Anal Response, FID: 0x800e  
522398 > DCREDC Bird: call: id: 1, UUD: SRSVRC  
522399 <- SHB Write And Response, FID: 0x0800e, 116 bytes  
523401 > SHB Read AndK Request, FID: 0x0800e, 1024 bytes at offset 0  
523402 <- SHB Bind_ack: call_id: 1, result: Provider rejection  
After the TCP handshake, the attacker tried to connect to the victim and then download and execute _netadp.exe_, using the IPC share to connect to the SRVSVC pipe. Host 9x.4x.53.209 did not succeed in its attack because it had its access denied by the honeypot. As reference, there is another sequence of transmitted packets (SEQ 2) obtained from the work of [PERSON] [75]. This sequence represents a successful attack by W32.IRCBot-TO.  
SBQ 2  
6 <-> cinfector-ip> TCP 2971 - <honeyp-i9x 445 [SYN, SYN,ACK]  
13 -> SHB Negotiate Protocol Request  
14 <-> SHB Negotiate Protocol Response  
17 >-> SHB Session Setup Anal Request, NTLMSSP_AUTH, User: \  
18 <-> SHB Session Setup Anal Response  
19 >-> SHB Tree Connect Anal Request, Path: \<honeyp-iyp\IPCV$  
20 <- SHB Tree Connect Anal Response  
21 -> SHB NT Create Anal Request, Path: \honeyp  
22 <- SHB NT Create Anal Response, FID: 0x0000  
23 >- DCREDC Bird: call_id: 0 UUUU: SRSVRC  
24 <-> SHB Write And Response, FID: 0x0400, 72 bytes  
25 >-> SHB Read AndK Request, FID: 0x0400, 4292 bytes at offset 0  
26 <- DCREDC Bird_ack  
27 >-> SRV NetworkPatchConicalize request  
28 <- SHB Write And Response, FID: 0x0000, 1152 bytes29 -> SMB Read AndX Request, FID: 0x4000, 4292 bytes at offset 0  
Initiating Egg download  
30 c-> dheney-ip TCP 1028 - cinfector-ip> 8295 [SYN, SYNACK]  
34-170 114572 byte egg download...