Securinets Tekup CyberTek 2.0:FAX

TASK

Netcat Questions

Q1:whats the attackers ip @

Q2:whats the attacker mac @

Q3:the username found

Q4:the password found

Q5:whats the protocol used for data exfil

Q6:whats the mail transfer agent used

Q7:whats the data being stealed

Q8:in what format their being encoded

Q9:give me the sha256 for the coockies

Q10:whats the expiry value for the host .reddit.com

Solve

A1:the attackers ip @ 10.1.31.101

A2:the attacker mac @ 00:08:02:1c:47:ae

A3:the username found

A4:the password found

we can find them by filtering text

the username value is

ZGlyZWN0b3JAaWdha3Vpbi5jb20=

which is the base64 encoding for director@igakuin.com

the password value is

  R2xvYmFsNzg2QA==

which is the base64 encoding for Global786@

A5:whats the protocol used for data exfil

we can distinguish the protocol used for data exfil by filtering the pcap by size looking for the largest packet sent

A6:whats the mail transfer agent used

we can find the mail transfer agent by looking in the smtp packets

A7:whats the data being stealed

by following the tcp stream of smtp packets we can find base64 encoded data

if we decode this data we can see that its cookies

A8:in what format their being encoded

the data is being encoded in base64 format

A9:give me the sha256 for the coockies

A10:whats the expiry value for the host .reddit.com

looking in the decoded cookies we can find the expiry value for the host .reddit.com

Flag

Flag Securinets{Y0u_4r3_7oo_0ld_aNd_5m4rt}