Analyzing a Log4j Exploit with Wireshark (and how to filter for it) // Sample PCAP!

[@ChrisGreer]

Let's get some hands-on with Log4j! Download the pcap in the description and follow along. We'll look at how the attack works, how to filter for it, and how to config Wireshark to see where it is coming from. Hope you all enjoy and thank you so much for watching! I appreciate the comments and feedback.

[@KaySwiss21]

I'm curious to know what you think about Intel ME. There's some claims that ME is spyware from Intel. Do you think it's more of a risk or benefit to keep ME, being there's a way to disable it with me_cleaner

[@plushplush7635]

thanks bro

[@Devopscreator]

Hi Chris, It's been 2 years since I started following you. Thanks for making such great video and your video are always to the point, short, simple and easy to understand. No one has explained the Wireshark better than you do. And it really helped in troubleshooting network issues.

[@ChrisGreer]

I appreciate that! Thanks for the comment!

[@kiranjoshi6721]

Thanks!

[@ChrisGreer]

Thank you so much Kiran!

[@NarendraS]

You are AMAZING!!!!! The quality and the content and the way you explain is top notch

[@ChrisGreer]

Thank you!

[@vq8gef32]

Amazing Chris. As always awesome. I liked the way you checked to make sure the server hasn't reacted. (was my question)

[@hackebeil20]

Chris, sincerely, there has not been a single video from you that didn't provide massive value to me! Just learned about cyberchef and virustotal - great tools, man!

[@ChrisGreer]

Awesome! Yeah those two are VERY useful. Glad the video helped. I'll be posting another as soon as I can get my hands on that script. Stay tuned!

[@vnthks]

Thank you Chris, for providing such an incredible packet analysis. Keep up the great work.

[@ChrisGreer]

Thanks, will do!

[@andyh3970]

Excellent pace and details- 11/10 !

[@ChrisGreer]

Thank you Andy!

[@clementyves6154]

Very nice video ! Good references and a lot of stuff learned again ! thanks for your job.

[@ChrisGreer]

Thanks!

[@derrickdike5709]

Another incredible video with a lot of knowledge to help with analysis. Thanks Chris

[@ChrisGreer]

My pleasure Derrick!

[@songtrush2711]

Wow. I am flashed. This is great (and nicely cat assisted) content. Glad I discovered your channel.

[@ChrisGreer]

😂 I was wondering when someone would comment on my cat.

[@mystiqkc]

You are awesome. The way you explain things is clear and I feel excited to learn more. Thanks a lot for this. I have set a goal for myself to complete your Pluralsight courses for the coming holidays :-)

[@ChrisGreer]

Awesome! Reach out if you have any questions.

[@chrishuston4445]

Amazingly helpful video, thank you for your time putting this together.

[@TNothingFree]

Wonderful commentary, useful examples and short video. Very well done

[@ChrisGreer]

Glad you liked it! Thank you for the comment.

[@yogeshkhurana5014]

I am in TAC for a switch company. This came to us as an vulnerability issue with device. But thankfully no device was vulnerable. And from video I got chance to know about this attack. Thank you..

[@ChrisGreer]

Great to hear. Thanks for the feedback!

[@hadestech8147]

Chris, outstanding lesson. Thanks for the update.

[@ChrisGreer]

My pleasure!

[@DynastyKiller__]

This is awesome work, Chris. Thanks for this video.

[@ChrisGreer]

Thanks for the comment Jorge!

[@309Jolly]

Thanks for the info. We are bombarded with tickets and I can now understand whats cooking in the backend

[@ChrisGreer]

Glad it was helpful! More to come about this vuln as I get more pcaps.

[@vyasG]

A ton of useful information in this video! Thank you.

[@ChrisGreer]

Thanks Vyas!

[@faran_siddiqui-d3t]

Wow just about to suggest you this idea. You read my mind sir !!

[@ChrisGreer]

We were thinking the same thing... I just had to get my hands on the pcap!

[@deepaknarayanan3619]

Woww Most Needed Content for current Situation ❤️👌 Much Appreciated video

[@ChrisGreer]

Thanks for the comment!

[@venkatesh4760]

Hey Chris thanks for this great informative video ..

[@edisontan2440]

Incredible video !👍🏻

[@ChrisGreer]

Thanks a lot!

[@GaryHammell]

Great explanations and pace!

[@ChrisGreer]

Glad you liked it! It's always hard to strike a balance in pacing. Keep the advanced folks interested while not losing the new folks. Thank you for the comment.

[@vishalpandita9857]

Very helpful video with simple explanation. Thanks!

[@ChrisGreer]

Glad it was helpful!

[@ThePumbaadk]

Thanks Chris, this was great and with very good explanations

[@ChrisGreer]

Thank you!

[@alandoran]

Thanks for sharing this Chris. Very helpful.

[@ChrisGreer]

Glad it was helpful!

[@RyanBess]

Look forward to seeing the next video on log4j. I too want to see the shell code

[@ChrisGreer]

Thanks for the comment Ryan. No kidding! I do too... as soon as I can get my hands on a clean, share-able pcap I will get the video out.

[@jjames7206]

That's very useful, so smart!! Chris

[@letsgopacket4419]

By watching your videos I realised how important the wireshark is..

[@msa3218]

Thanks a lot from Egypt keep your great work !!

[@ChrisGreer]

Thanks, will do!

[@peterborcik322]

Man ! You are really cool ! Best wireshark stuff ever ;-)👍👍👍

[@peterborcik322]

I need one monitor extra for this wireshark map ;-)

[@ChrisGreer]

Thanks! 👍

[@HashirrRoblox]

Chris you are a good teacher 😀 Question why my Wireshark don't show the option for map it is grayed out ?

[@ChrisGreer]

Do you have the geoIP databases loaded?

[@petrprochazka7891]

Thank you very much for such excelent video and very useful links.

[@ChrisGreer]

You are welcome!

[@joepereira8690]

This is great. Thank you for sharing.

[@ChrisGreer]

You are so welcome!

[@benhartsimbolon6457]

Very nice video. Really like the explanation !!

[@ChrisGreer]

Glad you liked it!

[@triumphant_54]

hi Chris, i saw your Wireshark course on David Bombal Training platform. do you offer certification for it?

[@Seansaighdeoir]

Great job Chris many thanks for this.

[@ChrisGreer]

You are welcome! More to come as I get more pcaps!

[@penguin--_--]

Hi Chris, Why my wireshark is only capturing 802.11 packets?

[@ChrisGreer]

Hey - can you tell me a bit more about exactly what you see? by 802.11 do you mean control and mgt frames?

[@yuvarajlakshmanan767]

Great video at right time!. Thanks a lot.

[@ChrisGreer]

Glad it was helpful!

[@wingman2k]

Wow this is such a great video

[@ChrisGreer]

Thanks!

[@zahidjaan1319]

Good work, hope we will get more informative videos, like,subscribed !!

[@ChrisGreer]

Thanks!

[@kevinaltizer]

Great info Chris. Thanks.

[@ChrisGreer]

Thanks for the comment Kevin!

[@FRD-HDD]

Very insightful. Thank you.

[@MrBitviper]

awesome video chris.. thank you so much

[@haogedeng8842]

Very informative - thank you very much for sharing!!

[@ChrisGreer]

Glad it was helpful!

[@chockalingamchidambaram1948]

Thanks for the video. Very informative. Do you know what is in that script that this attack is trying to execute (which you said opens up a connection back to the attacking host). Did you get a copy of that lh.sh script?

[@ChrisGreer]

Hey! This particular one wasn't captured. However I did get my hands on a pcap with a similar attack and the script was captured too. I'm prepping the content for that video now. Stay tuned!

[@chockalingamchidambaram1948]

@@ChrisGreer Thanks !

[@dedkeny]

FYI the IP in the Base64 encoded message is still active... the IP may not be static but I found this interesting.

[@ChrisGreer]

Hmmmm, nice. Thanks for the comment!

[@compeec]

Thank you Chris, Good explanation.

[@ChrisGreer]

Glad it was helpful!

[@tweedle634]

Your content. is AMAZING. THANK YOU FOR THIS!!!!!

[@ChrisGreer]

Glad you enjoy it!

[@ShadyNetworker]

Thanks for making the video! Is there anything you can share about the shell script referenced?

[@ChrisGreer]

Not much yet - but the more I learn the more I will share. Thanks for the comment!

[@GiorgioCamozzi]

Very interesting! Would it be possible for the server being attacked to initiate a connection back to the malicious IP through UDP? Or is wget always with TCP? Because then the server wouldn't do a SYN (as far as I'm aware it doesn't with UDP) and we would also need to filter for UDP connections originating from the attacked server.

[@ChrisGreer]

Hey Giorgio! So the server could totally start a stream back to the callback server, no rules against that. It may use another utility to do so however. I haven't tried using wget over UDP so I'm not sure on that one.

[@GiorgioCamozzi]

@@ChrisGreer Thanks Chris!:)

[@FayOnis]

thank you for this video, very knowledgable

[@ChrisGreer]

Thanks Fay!

[@malkeetkalera7520]

I'm waiting for this

[@shawn8163]

This is exactly right and if this was successful you could see the same dest port outbound as in the Jdni request in your example 1389

[@ChrisGreer]

Nice detail! Thanks for sharing.

[@chrismachabee3128]

Thanks for the video. I'm a web designer. I have some Wireshark courses on thee shelf but, never got to them. watching an expert at the craft was very enliightening. It's funny too. I have been hearing of this Log4J thing I thought it was another language, until a day or so ago I hear that it is a malware. Not really my thing, but important nonetheless. I don;t think I would have been bored had you shared more details, but I understand. Can you tell by loking at that hack if it is s script kiddie or a major attempt? Thanks again.

[@ChrisGreer]

Hey Chris thanks for the comment. I was able to get my hands on a pcap with more detail, so I plan to release a follow-on video soon. Stay tuned!

[@chrismachabee3128]

@@ChrisGreer Sure, sure, I subbed for sure. I have also a ethical hacker course. I really have to fit in with everything else I'm trying to wrap my head. We standing by.

[@germancastillo681]

Hi from Colombia @Chris, could you give us a clue on how to tshoot this in wireshark but not for http (port 80) but for https (port 443) conections?

[@ChrisGreer]

Hey German, good question! So the outbound TCP SYN filter would still work. I would probably add "!ip.dst==10.0.0.0/8" or whatever my internal address range was. Just because even though I might miss lateral movement from the server, I would definitely catch anytime it is going external to connect to somebody out there. I'd also keep a close eye on the number of small https connections that are made and the payload sizes. The post is a TCP connection all its own and is just a quick exchange. If I saw that behavior, followed by the server connecting externally, that would be suspect.

[@ohkay8939]

Awesome video, thank you.

[@ChrisGreer]

Glad you liked it!

[@majiddehbi9186]

thx Chris just a question is it useful to the level of ccna200-301 thx

[@ChrisGreer]

Great question. I think it is great info for a CCNA to know, but it will not be on the exam. As far as TCP and Wireshark goes, the exam is very light on the details.

[@S2eedGH]

Thanks for great content, I tried GeoIP on Kali linux but when I click "open in browser" it shows blank page

[@ChrisGreer]

I wonder if it is the way the file is being unzipped?

[@AmazingJayB51]

I downloaded the trace packet but how do you view or open it in WireShark?

[@ChrisGreer]

I usually just double click it, or find it from within the Wireshark user interface.

[@AmazingJayB51]

@@ChrisGreer Thank you!

[@JoeClyde579]

Great video

[@roarman75]

Well explained.. nice!

[@washburnlane]

Thank you 🤘😎

[@ChrisGreer]

No problem!

[@HariKrishna-mw2rr]

Thank you 😊

[@ChrisGreer]

You're welcome 😊

[@bhaskarmallarapu2392]

Thank you, good video

[@ChrisGreer]

Thank you too!

[@SoulJah876]

Very cool video, thank you.

[@ChrisGreer]

Glad you liked it!

[@kevingendron5586]

Excellent!

[@ChrisGreer]

Many thanks! Glad you liked it!

[@Abdelilahjghii]

Good ☺️

[@ChrisGreer]

Thanks 😊

[@aga01]

🔥

[@levvyNok]

Nice one

[@Avinashahn]

Nice

[@plushplush7635]

wooow so cool

[@domagoj19zg]

Cool stuf

[@WokwithLan]

Wokwithlan here

[@stadingschool9054]

Pub rarib Amin😂😂

[@TamazghaLandOfGod]

اللي جا من عند أمين رغيب Amine Raghib إعفط على جييييم نحسبكم 👍👍

[@ChrisGreer]

Welcome!

[@saidibra9231]

you are going very fast, try to explain slowly

[@mystiqkc]

Thanks!

[@ChrisGreer]

Thank you!

[@Black_Swan68761]

Thank you so much, Chris, for sharing this video. You explained it very well. Much appreciated!!!