Trigger an executable file once wireshark finds a “keyword” on live capture

Question

Hi,

I'm setting up a trap for hackers on my server, by putting an attractive file named: "source-code.zip" (as an example) so only hackers can see. (If the hacker is using a PHP shell trap or something)

Once the hacker trys to open or access the "source-code.zip" file, I need wireshark to trigger an executable file that will shut down the network card on my server to prevent any other theft, just in case.

How can I do this using wireshark or tcpdump ? is it possible ? for example using a filter where if any packet (TCP/UDP/ETC..) contains the word "source-code.zip" it should trigger an executable.

Of course the file name "source-code.zip" will be changed to someting more unique and complex.

I need your help guys, is it possible to trigger files using filters on wireshark ? It also should not slow my network or CPU usage..

Thank you. (and sorry if my english is bad)

Accepted Answer

Yes, you can do this through Wireshark Lua, but as the other answers indicate, there are better ways to accomplish your goal.

If you really wanted to use Wireshark, you could create a tap/listener that runs a specified program (using os.execute, which runs a shell command, or io.popen, which starts a program in a separate process...you probably want the latter) upon detecting a packet of interest.

Here's an example Lua script (based on this answer) that opens iTunes whenever UDP packets, containing XML, arrive at port 2000. The script is put in ~/.wireshark/plugins/itunes_tap.lua. (Note that the script automatically loads in tshark)

-- use display-filter syntax here
local _filter = '(udp.port == 2000) && xml'
– command to be executed for each packet
local _cmd = 'open /Applications/iTunes.app'
local _run = io.popen
local function make_tap(filter)
local tap = Listener.new(nil, filter)
function tap.packet()
    _run(_cmd)
end

return tap

end
– If not running from Wireshark, enable the tap immediately, then
– abort, or else we'll get an error below for trying to do GUI
– stuff from the command line.
if not gui_enabled() then
make_tap(_filter)
return
end
local function make_win()
local tap = nil
local win = TextWindow.new("Watcher")
local function remove_tap()
if tap then tap:remove() end
    tap = nil
end

win:set(&quot;Press Start to begin watching&quot;)
win:set_atclose(remove_tap)

win:add_button(&quot;Start&quot;, function()
    if tap then
        report_failure(&quot;Already started&quot;)
        return
    end

    win:set(&quot;Watching for:\\n&quot; .. _filter)
    tap = make_tap(_filter)
end)

win:add_button(&quot;Stop&quot;, function()
    if not tap then
        report_failure(&quot;Not started&quot;)
        return
    end

    remove_tap()
    win:set(&quot;Press Start to begin watching&quot;)
end)

return win

end
register_menu("Lua/Test", make_win, MENU_TOOLS_UNSORTED or 8)

Answer 2

No, Wireshark does not have any facility to trigger an executable based on filters. Also, you have no guarantee that the file name would be contained in a single packet. It could, for example, be spread over two TCP segments in two different IP packets.

I'm not clear on what you're trying to do, but it doesn't seem like Wireshark is the right tool.

If you're actually trying to attract a hacker for whatever reason, then build a real honey pot that is not a production server, so that it isn't a problem if it gets destroyed. A virtual machine would be an excellent choice. You could use a snapshot to restore the machine if it was compromised in an attack.

If this is a production server that you're really trying to protect, use the tried and tested tools that are available for that purpose, instead of trying to cobble together your own system. Make sure the server has a host-based firewall, or is behind a network firewall, or both. Deploy an intrusion detection system, like Snort. Make sure that the server is properly and frequently backed up and can be restored if it does get compromised. If you can't afford commercial protective software, there are free programs available.

No matter how cleverly you name your file, you have absolutely no assurance that a hacker will go after this file first, so it will not serve as a reliable early warning of an attack.

Answer 3

Wireshark does not have a built-in capability to launch arbitrary external programs (if it did, it could be abused by hackers attacking a system on which they knew wireshark to run). I doubt seriously the effectiveness of your honeypot. If your server's security is critical, and you anticipate it to be compromised so easily, I would very strongly recommend a different approach to network security. Moreover, Wireshark comes with it's own list of problems, not the least of which is the known out of memory memory problem that would certainly cripple your security setup.
Wireshark is really intended for manual analysis of network activity to help determine what might be wrong with the network itself. It is not a security tool, even though it sometimes helps in analyzing the network state during/after a security event.

Why not try a tool that is actually intended for catching malicious packets (snort, for example)?