And now it's demo time.
In this one,
we'll be reviewing the Zeek package and corresponding scripts to
allow us to carve files from the network stream.
Then,
we'll validate that the functionality is there before we
move along to the next learning objective.
Let's hop in.
All right, and here we are in the lab.
Now I'm in my Zeek box. And what we're going to use in this demo to
expedite the process of file extraction and the configuration for it
is we're going to use a prebuilt package.
And then once we install that, we'll dive into the configs and check them out,
see how we can use them in different ways.
So if you remember from one of the previous modules,
we were able to install packages using the ZKG,
or the Zeek Package Manager.
So let's do the zkg command.
And the package that we're going to install is
zeek/hosom/file‑extraction just like that.
So now that that's installed, what we need to do is load it.
We can use the zkg load command as well to go ahead and load the package,
and I see that it already did after the installation.
But I'm just going through this in case we ever need to go
through and manually load the packages.
And there we go.
So now the first thing we should do is go check out the
configs for this file extraction package.
All right, and as you can see, we have a plugins directory here.
We have a config.zeek file and a file‑extensions.zeek file.
So let's check out that config.zeek first.
But first, I'm going to go ahead and just jump into that directory,
and there we go.
All right, so let's go ahead and more config.zeek.
And as you can see, it's super long.
I'm just kidding.
So it's not very long.
Really,
all it's doing is telling us which of the scripts or
plugins inside of this package to load.
And as you can see right here, it defaulted to just the common exploit types.
So now let's go check that out and see what it actually entails.
So we're going to more that one.
And again, it's not very long, right?
But what it's doing is it's calling additional loading
directives into the Zeek instance.
So we have extract‑java, extract‑pe, extract‑ms‑office, and pdf.
So what this is telling me is that out of the box for this package specifically,
when we load it,
it's going to just extract files from these four
categories or these four configurations.
And we can actually jump into one of those too and see what those entail.
Again, another short one.
But this is because with extracting files with Zeek,
the configurations can get pretty robust and complicated,
but they don't have to be.
So for this one, we're looking for the mean type of application/pdf.
And that's it.
It's going to call the file extraction hook and extract
it and save it wherever we need to.
Now there's another script in here that we're actually going to turn on,
and that's the extract‑all file one.
So let's go ahead and look at that one real quick.
And really, this one's indifferent about the application type or the meme type.
It's just telling us extract everything.
So let's use that one to go ahead and configure Zeek for file extraction.
That way we can get everything extracted instead of just
certain documents or certain file types.
So what I'm going to do is I'm going to go ahead and
just nano the config.zeek file.
I'm going to comment out the extract‑common‑exploits one,
and I'm going to add a new load directive for the plugins and
extract‑all‑files just like that and save it.
Oh, and there's one more thing that I have to do in there.
We have to define this path where the extracted files will be stored.
So what I'm going to do is just place that in this extracted
folder inside of my Zeek home directory,
just for testing purposes in this lab.
All right, let's save that, and I'm going to redeploy Zeek.
Now that that's redeployed, let's jump back over to our home directory.
And as you can see, we have this extracted folder here.
So let's hop into there.
And as you can see, we're already starting to get files.
We have this SSL user‑cert file here.
But let's really test it and see if it's working properly for us.
What I'm going to do now is pull up Cyberduck.
I'm going to use that to pull a file from my FTP server on the Zeek
network and drag it into a folder on my current desktop just to
replicate a file being transferred somehow.
And I'm using FTP just to show it.
Let's go ahead and do something like the FileZilla EXE file.
So that's transferred.
Let's hop back over into Zeek and see what's here.
And it looks like that EXE file didn't want to be extracted.
So let's try a different one.
Let's try the module 2 slides from my Writing Zeek Rules and Scripts course.
How about that one?
And Zeek doesn't seem to be wanting to extract my files,
so trying to investigate it.
And after some troubleshooting, I was having network interface problems.
And just to give you a little insight into what the issue was,
when you go look at the current log for files,
it tells you if you're missing any bytes.
And if you are, it's not going to be able to extract the entire file.
And so my NIC was oversaturated,
and it wasn't able to capture all of the packets as it was sniffing the network.
So we had missing bytes in the files section,
so we were unable to actually extract the entire file.
Now that that's fixed, let's try to make that work with a text file real quick.
Before we do though, I'm going to go ahead and clear out this extracted folder,
remove everything, and then allow us to do the transfer.
So let's test it with this helloworld.txt file.
All right, that transferred in, and we have two different FTP docs here.
This first one is the actual file, Hello World. And then the second one,
it has the listing of all the files that are available
that we saw in Cyberduck right here.
Now if we wanted to open that file ourselves and test it out,
we can see that it's 12 bytes just like it matches up in the
FTP server as well. And we can open it up,
download it. When it pulls up, you can see that it's just that helloworld.txt.
So here, we were able to validate that we were able to
extract files from the network stream,
validate that they were extracted, and validate the file itself was intact.