A company's internal server has been flagged for unusual network activity, with multiple outbound connections to an unknown external IP. Initial analysis suggests possible data exfiltration. Investigate the provided network logs to determine the source and method of compromise.
- Wireshark
- MAC Lookup
1. What is the FTP password?
First, we opened the pcap file in Wireshark and navigated to Tools -> Credentials .
3 packets revealed the same user "kali" via the FTP protocol. Therefore we selected 1 of them and followed the TCP stream of the packet.
The FTP password of the user kali was AfricaCTF2021.
2. What is the IPv6 address of the DNS server used by 192.168.1.26?
We can find the dns packets queried by 192.168.1.26 using display filter.
dns && ip.src==192.168.1.26 
192.168.1.26 made DNS queries to the same destination. Therefore, we can check one of those packets.
According to the detailed information of the packet, we identified that the Ipv4 and the Mac address of the DNS server was 192.168.1.10 and ca:0b:ad:ad:20:ba respectively. Therefore, we can find the Ipv6 of the DNS server using its MAC address in the display filter.
ipv6 && eth.dst==ca:0b:ad:ad:20:ba 
We clicked one of those packet and looked at the ipv6 of the DNS server, which was fe80::c80b:adff:feaa:1db7.
3. What domain is the user looking up in packet 15174?
First, we navigated to Go -> Go to Packet... and entered 15174 then pressed Go to Packet.
We located the DNS query for the domain www.7-zip.org.
4. How many UDP packets were sent from 192.168.1.26 to 24.39.217.246?
We can find the total number of the udp packets using the display filter.
udp && ip.src==192.168.1.26 && ip.dst==24.39.217.246 
The displayed packets were shown at the bottom right of the window and was 10.
5. What is the MAC address of the system under investigation in the PCAP file?
The MAC address of the investigated system can be found in one of the screenshot in Q2.
The MAC address was c8:09:a8:57:47:93.
6. What was the camera model name used to take picture 20210429_152157.jpg?
First, we can find the packet related to "20210429_152157.jpg" using the display filter.
frame contains "20210429_152157.jpg" 
According to the result, the picture was uploaded from the investigated system 192.168.1.26 to the FTP server 192.168.1.20. We can navigate to File -> Export Objects -> FTP-DATA... to retrieve the picture.
we saved the image and right clicked the image -> Properties -> Details and can find the Camera model.
The Camera model of this picture was LM-Q725K.
7. What is the ephemeral public key provided by the server during the TLS handshake in the session with the session ID: da4a0000342e4b73459d7360b4bea971cc303ac18d29b99067e46d16cc07f4ff?
We can find the targeted TLS handshake packet using display filter.
tls.handshake.session_id==da4a0000342e4b73459d7360b4bea971cc303ac18d29b99067e46d16cc07f4ff 
We clicked the packet to find the ephemeral public key.
The public key was 04edcc123af7b13e90ce101a31c2f996f471a7c8f48a1b81d765085f548059a550f3f4f62ca1f0e8f74d727053074a37bceb2cbdc7ce2a8994dcd76dd6834eefc5438c3b6da929321f3a1366bd14c877cc83e5d0731b7f80a6b80916efd4a23a4d. This key which was generated by the server was used for encryption for this specific session.
8. What is the first TLS 1.3 client random that was used to establish a connection with protonmail.com?
We can find the targeted packet related to "protonmail.com" using the display filter.
tls && frame contains "protonmail.com" 
We clicked the first packet to find the client random.
The client random was 24e92513b97a0348f733d16996929a79be21b0b1400cd7e2862a732ce7775b70. The client random and server random were used for generation of a secret key to encrypt and decrypt the network traffic between the host and the domain protonmail.com.
9. Which country is the manufacturer of the FTP server’s MAC address registered in?
Since we knew the IP address of the FTP server from the previous question, we can find the related packets using display filter.
ftp && ip.addr==192.168.1.20 
We can click the first packet to find the MAC address of the FTP server.
The MAC address of the FTP server was 08:00:27:a6:1f:86. In order to find the manufacturer of the server, we can query MAC Address Lookup .
By searching the MAC address, the manufacturer of the FTP server was in United States.
10. What time was a non-standard folder created on the FTP server on the 20th of April?
To view the actual contents, file transfers, or detailed directory listings from the FTP server, we can use display filter quering FTP-DATA (Port 20).
ftp-data 
We can click the first LIST packet showing the metadata of the files and directories.
The "non-standard" folder created should be ftp. The creation time was Apr 20 17:53.
11. What URL was visited by the user and connected to the IP address 104.21.89.171?
To find the related HTTP packet, we can use the display filter.
http && ip.dst==104.21.89.171 
We can follow the HTTP stream to find the URL visited to the targeted destination.
The visited URL was hxxp[://]dfir[.]science/.