CyberDefenders — WireDive Lab Writeup

Open dhcp.pcapng in Wireshark.

Apply the display filter dhcp (or bootp.option.dhcp == 3 for DHCP Requests specifically) to isolate DHCP traffic.

Inspect the DHCP Request packet (Packet 189) where the client requests its allocated IP address.

Expand Dynamic Host Configuration Protocol ➔ Option: (50) Requested IP Address, which shows 192.168.2.244.

With the dhcp filter active, look at the very first packet in the trace: Packet 176 (DHCP Release).

Click on Packet 176 and expand the Dynamic Host Configuration Protocol (Release) tree in the Packet Details pane.

Locate the Transaction ID field directly under Message/Hardware type: 0x9f8fa557.

In the same DHCP Release packet (Packet 176), inspect the client hardware identification.

In the Dynamic Host Configuration Protocol header, locate the field Client MAC address.

It shows VMware_82:f5:94 (00:0c:29:82:f5:94).

Switch to the second capture file: dns.pcapng.

Filter for the target domain: dns.qry.name == "flag.fruitinc.xyz" or scan standard queries.

Locate the Standard query response for flag.fruitinc.xyz.

Expand the Answers section of the DNS packet: the TXT record contains acooldnsflag.

Common Pitfall Avoidance: Packet 2 shows a root query, but it is merely requesting the list of root servers (NS <Root>), NOT answering for google.com!

Look right below it at Packet 3: The client sends a query for google.com to destination IP 192.203.230.10.

Look at Packet 4: IP 192.203.230.10 responds to the google.com query by providing a referral pointing to the .com name servers (gtld-servers.net).

Resolving the fixed root server IP 192.203.230.10 (via reverse DNS lookup nslookup 192.203.230.10 or standard IANA root server lists) reveals: e.root-servers.net.

Switch to the third capture file: smb.pcapng.

To quickly pinpoint file access without manually scrolling through hundreds of packets, apply a filter for SMB2 Create / Open requests: smb2.cmd == 5 or smb2.filename contains "txt".

Inspect the SMB2 Create Request (Packet 147). Under SMB2 (Server Message Block Protocol Version 2) ➔ Create Request (0x05), locate the Filename field: HelloWorld\TradeSecrets.txt.

Search for user jtomato by filtering: ntlmssp.auth.username == "jtomato" (or press Ctrl+F ➔ String ➔ jtomato).

Wireshark isolates Packet 75: Session Setup Request, NTLMSSP_AUTH, User: SAMBA\jtomato.

The Trap: Packet 75 is a client request and will never contain a status code. The status code is returned by the server in the response!

Double-click the blue generated [Response in: 76] link in the SMB2 Header (or step to Packet 76).

In Packet 76 (Session Setup Response, Error: STATUS_LOGON_FAILURE), expand the SMB2 Header: NT Status: STATUS_LOGON_FAILURE (0xc000006d).

In SMB2, connecting to a shared network directory is designated as a Tree Connect. Before a client can browse files, it issues a Tree Connect Request.

Filter specifically for Tree Connect commands: smb2.cmd == 3.

Two Tree Connect requests are observed: Packet 124 connects to \\192.168.2.10\IPC$ (system RPC management), and Packet 133 connects to \\192.168.2.10\public.

Packet 133 is the actual shared filesystem tree where subsequent directory operations and HelloWorld\TradeSecrets.txt reside: \\192.168.2.10\public.

We know the client accessed TradeSecrets.txt. To extract its unencrypted contents, use Wireshark's built-in file carver: File ➔ Export Objects ➔ SMB....

Locate \HelloWorld\TradeSecrets.txt (50,166 bytes), select it, and save it to disk.

Open the saved file (which contains the Bee Movie script) and search for flag:

... Order in this court! flag<OneSuperDuperSecret> - You're all thinking ...

*(Alternative method)*: In Wireshark, press Ctrl+F ➔ Packet bytes ➔ String ➔ flag to jump straight to the data frame.

Switch to shell.pcapng.

Strategy: Rather than analyzing packet-by-packet, follow the TCP Stream to reconstruct the entire interactive terminal session.

Right-click Packet #1 ➔ Follow ➔ TCP Stream (Stream 0).

In Statistics ➔ Conversations ➔ TCP or Packet #1: Client 192.168.2.5:52242 connects to 192.168.2.244:4444.

The Linux shell prompt jtomato@ns01:~$ appears over port 4444.

Stay in the same TCP Stream 0 window and scroll down to observe attacker commands.

Towards the end of the session, the attacker spawns a second netcat listener:

echo "*umR@Q%4V&RC" | sudo -S nc -nvlp 9999 < /etc/passwd

The flag -p 9999 specifies port 9999. Netcat confirms: Listening on [0.0.0.0] (family 0, port 9999).

In Stream 0, examine the package installation command executed prior to spawning the listener:

echo "*umR@Q%4V&RC" | sudo -S apt install netcat

Review the APT package manager output lines:

Get:1 http://us.archive.ubuntu.com/ubuntu bionic/universe amd64 netcat all 1.10-41.1

Unpacking netcat (1.10-41.1) ...

The installed netcat package version string is 1.10-41.1.

In Stream 0, analyze the command line syntax used to initiate the listener on port 9999:

echo "*umR@Q%4V&RC" | sudo -S nc -nvlp 9999 < /etc/passwd

The input redirection operator < streams the file /etc/passwd directly into netcat for any incoming connection to download.

Linux privilege escalation in this session is executed via sudo -S (which reads credentials from standard input).

Notice the attacker pipelines their password into sudo across several commands:

echo "*umR@Q%4V&RC" | sudo -S apt update

echo "*umR@Q%4V&RC" | sudo -S apt install netcat

echo "*umR@Q%4V&RC" | sudo -S -i

The password used for elevation is *umR@Q%4V&RC.

In Stream 0, examine the output of the apt update command:

Hit:1 http://us.archive.ubuntu.com/ubuntu bionic InRelease

Hit:2 http://us.archive.ubuntu.com/ubuntu bionic-updates InRelease

In Debian/Ubuntu distributions, repository paths reflect the OS release codename (Ubuntu 18.04 LTS is bionic).

In Q13, we saw /etc/passwd was served over port 9999.

Filter for the second shell traffic: tcp.port == 9999.

Right-click any packet ➔ Follow ➔ TCP Stream (Stream 6).

The complete /etc/passwd file is dumped in plaintext (from root:x:0:0... down to bind:x:111:113...).

Counting the individual user entries line-by-line yields exactly 31 accounts.

Switch to the fourth capture file: network.pcapng.

Filter for Network Time Protocol traffic: ntp.

Inspect the IPv6 packets. The external NTP server communicating with the local host is 2003:51:6012:110::dcf7:123.

Filter for DHCP traffic: dhcp (or filter specifically for DHCP Request messages: bootp.option.dhcp == 3).

The DHCP DORA handshake proceeds: Discover ➔ Offer ➔ Request ➔ Ack.

Inspect the very first DHCP Request in the trace (Packet 1254).

Expand Dynamic Host Configuration Protocol ➔ Option: (50) Requested IP Address, which shows 192.168.20.11.

Filter for DNS traffic: dns.

Locate the first DNS query response: Packet 243 (resolving blog.webernetz.net).

In Packet Details, expand the Authoritative nameservers section.

The very first authoritative nameserver record returned is Name Server: ns1.hans.hosteurope.de.

Spanning Tree Protocol (STP) signals network topology reconfigurations using the Topology Change (TC) bit flag.

Filter for STP BPDUs where the TC bit is active: stp.flags.tc == 1.

Examine the very first packet returned: Packet 42.

In Packet Details, expand the IEEE 802.1Q Virtual LAN header or Spanning Tree Originating VLAN (PVID): it indicates VLAN 20.

Cisco Discovery Protocol (CDP) broadcasts layer-2 neighbor details between Cisco switches and routers.

Filter for CDP packets: cdp.

Locate the announcement from device CCNP-LAB-S2.webernetz.net (Packet 133).

Expand Cisco Discovery Protocol ➔ Port ID: Sent through Interface: GigabitEthernet0/2.

Filter for STP traffic specifically tagged on VLAN 60: vlan.id == 60 && stp.

Select any matching BPDU packet (e.g., Packet 20).

Expand Spanning Tree Protocol ➔ Root Identifier.

Read the Root Bridge System ID MAC: 00:21:1b:ae:31:80.

Return to the CDP announcement for switch CCNP-LAB-S2 (Packet 133).

Expand the Software Version TLV.

It displays: IOS (tm) C2950 Software (C2950-I6K2L2Q4-M), Version 12.1(22)EA14, RELEASE SOFTWARE (fc1).

The IOS release version matching the required format is 12.1(22)EA14.

Filter for Cisco Hot Standby Router Protocol traffic: hsrp (or group 121: hsrp2.group == 121).

Select an HSRP packet belonging to group 121 (e.g., Packet 15).

Expand Cisco Hot Standby Router Protocol ➔ Group State TLV.

Inspect the Virtual IP Address field: 192.168.121.1.

Technical Context: Under IPv6 SLAAC (Stateless Address Autoconfiguration), connecting hosts broadcast ICMPv6 Router Solicitations to ff02::2 (All-Routers multicast) requesting network prefixes.

In ICMPv6, Type 133 designates Router Solicitations (while Type 134 designates Router Advertisements).

Filter directly for solicitations: icmpv6.type == 133.

Wireshark isolates exactly 3 packets: Packet 1187, Packet 1220, and Packet 1267. Check Wireshark status bar: Packets: 3890 · Displayed: 3 (0.1%).

Return to the CDP packet for CCNP-LAB-S2 (Packet 133).

Expand the Management Addresses TLV (or Addresses section).

The configured device management IP is listed as 192.168.121.20.

Filter for Simple Network Management Protocol traffic: snmp.

Locate the first query sequence: Packet 1911 (get-request) and Packet 1912 (get-response).

In Packet 1912, expand variable-bindings.

The SNMP response resolves OID 1.3.6.1.2.1.31.1.1.1.1.2 (IF-MIB ifName for index 2) with the string "Fa0/1" (FastEthernet 0/1).

Network engineers often automate Cisco router backups using archive over TFTP.

Filter for TFTP traffic: tftp.

In Packet 3766, the router sends a TFTP Write Request for file CCNP-LAB-R2-Mar--3-20-02-38.701-7.

Right-click Packet 3766 ➔ Follow ➔ UDP Stream (or export the object via File ➔ Export Objects ➔ TFTP...).

Read the timestamp comments stamped at the very top of the configuration:

! Last configuration change at 20:55:45 UTC Fri Mar 3 2017 by weberjoh

! NVRAM config last updated at 21:02:36 UTC Fri Mar 3 2017 by weberjoh

Formatting as yyyy-mm-dd hh:mm gives 2017-03-03 21:02.

In enterprise network operations, RADIUS provides centralized AAA authentication for administrative switch and router logins.

Search within the plaintext Cisco router configuration dumped in Q28 for the keyword radius.

The configuration reveals:

radius server blubb

address ipv6 2001:DB8::1812 auth-port 1812 acct-port 1813

The configured RADIUS server IPv6 address is 2001:DB8::1812.

Prerequisite — TLS Decryption: Open https.pcapng. Go to Edit ➔ Preferences... ➔ Protocols ➔ TLS. Under (Pre)-Master-Secret log filename, browse and select secret_sauce.txt from the lab archive. Wireshark instantly decrypts all TLS streams!

The Missing Response Wireshark Trap: Filtering by http.host == "web01.fruitinc.xyz" only displays request frames (675 and 707) because responses do not have a Host: header!

Filter instead by destination server IP: ip.addr == 192.168.2.20 && http (or follow the HTTP stream on Packet 675).

Inspect the server response in Packet 678 (HTTP/1.1 200 OK). Under the HTTP headers, locate the custom response header: flag: y2*Lg4cHe@Ps.

Slack serves media assets through files.slack.com. In-feed channel previews download thumbnail assets from /files-tmb/.

Filter for Slack file requests: http.host == "files.slack.com".

Inspect Packet 6642:

GET /files-tmb/TTL7QHDUJ-F011PDVK8TD-115062e5c0/get_a_new_phone_today__720.jpg HTTP/1.1

Notice the pattern with the double underscore before 720: get_a_new_phone_today__720.jpg.

Traffic to the pfSense firewall at 192.168.2.1 utilizes HTTP/2.

Filter for HTTP/2 traffic communicating with the gateway: ip.addr == 192.168.2.1 && http2.

Locate Packet 936 (HTTP/2 HEADERS frame for POST /) followed by Packet 937 (HTTP/2 DATA frame).

Expand HTML Form URL Encoded: application/x-www-form-urlencoded:

usernamefld: admin

passwordfld: Ac5R4D9iyqD5bSh

Formatted as username:password gives admin:Ac5R4D9iyqD5bSh.

Online Certificate Status Protocol (OCSP) verifies whether an SSL/TLS certificate has been revoked.

Filter for OCSP packets: ocsp (or match the serial: ocsp.serialNumber == 07:75:2c:eb:e5:22:2f:cf:5c:7d:20:38:98:4c:51:98).

Inspect the OCSP response in Packet 160.

Expand Online Certificate Status Protocol ➔ responseBytes ➔ BasicOCSPResponse ➔ tbsResponseData ➔ responses.

Under serial number 0x07752cebe5222fcf5c7d2038984c5198, inspect the status field: certStatus: good (0).

Filter for decrypted HTTP form submissions containing plaintext passwords: urlencoded-form.key == "password".

Examine Packet 4758 (authentication request submitted to fruitincworkspace.slack.com).

In the URL-encoded POST payload:

email: Jim.Tomato@fruitinc.xyz

password: v^DDLM98GbM#

Employee Jim Tomato transmitted his account credentials over an insecure connection, exposing his password.

In Q32, the administrator authenticated into the pfSense firewall at 192.168.2.1.

In Packet 1076, the admin accesses GET /services_ntpd.php (NTP daemon management).

In Packets 1107 & 1108, the admin submits a configuration form: POST /services_ntpd.php.

Inspect the multipart form payload in Packet 1108 under name="interface[]":

Raw data is displayed in hex: 6c616e. Converting hex to ASCII: 6c (l), 61 (a), 6e (n) ➔ lan.

The configured daemon service is ntp on interface lan, formatted as lan:ntp.