CyberDefenders WireDive Write-up

The challenge in the Cyberdefender platform:

[embed]| Blue team challenge. CyberDefenders is a blue team training platform for SOC analysts, threat hunters, security blue teams and DFIR…cyberdefenders.org

This write-up is based on Cyberdefender WireDive challenge

Q1 — File: dhcp.pcapng — What IP address is requested by the client?

There is an IP asking to exit to talk to another external IP

Q2- File: dhcp.pcapng — What is the transaction ID for the DHCP release?

searching by DHCP

Q3-File: dhcp.pcapng — What is the MAC address of the client?

By knowing the client’s IP address, I obtained his MAC

Q4- File dns.pcapng — What is the response for the lookup for flag.fruitinc.xyz?

There are DNS conversations for asking about a specific domain

Q5- File: dns.pcapng — Which root server responds to the google.com query? Hostname.

Q6- File smb.pcapng — What is the path of the file that is opened?

By searching the data sent via the SMB protocol, I found the answer

Q7- File smb.pcapng — What is the hex status code when the user SAMBA\jtomato logs in?

The question specified the code that appeared when trying to log in and the result was a failed login attempt

Q8- File smb.pcapng — What is the tree that is being browsed?

filtering by SMB

Q9- File smb.pcapng — What is the flag in the file?

First, I displayed the contents of the file whose name I mentioned in the first questions Then I searched for the word flag until I found the answer

Q10- File shell.pcapng — What port is the shell listening on?

By tracking the movement of requests, I found that the shell is listening to instructions on a clear port

Q11- File shell.pcapng — What is the port for the second shell?

By tracking the movement of requests, I found that the shell is listening to instructions on the second port

Q12- File shell.pcapng — What version of netcat is installed?

Q13- File shell.pcapng — What file is added to the second shell

Q14- File shell.pcapng — What password is used to elevate the shell?

The answer is in the same picture as before

Q15- File shell.pcapng — What is the OS version of the target system?

Q16- File shell.pcapng — How many users are on the target system?

I needed to count the number of visible users

Q17- File network.pcapng — What is the IPv6 NTP server IP?

Filtering by NTP

Q18- File network.pcapng — What is the first IP address that is requested by the DHCP client?

Filtering by DHCP

Q19- File network.pcapng — What is the first authoritative name server returned for the domain that is being queried?

Filtering by DNS

Q20- File network.pcapng — What is the number of the first VLAN to have a topology change occur?

Q21- File network.pcapng — What is the port for CDP for CCNP-LAB-S2?

Filtering by CDP

Q22- File network.pcapng — What is the MAC address for the root bridge for VLAN 60?

Filtering by vlan.id == 60

Q23- File network.pcapng — What is the IOS version running on CCNP-LAB-S2?

Filtering by CDP

and go to CCNP-LAB-S2 then focus on the software version

Q24- File network.pcapng — What is the virtual IP address used for hsrp group 121?

Filtering by hsrp2.group == 121

Q25- File network.pcapng — How many router solicitations were sent?

When I couldn’t figure out how to filter it, so I did some research and find solution

Filtering by icmpv6.type==133

and you will see the requests

Q26- File network.pcapng — What is the management address of CCNP-LAB-S2?

Filtering by CDP

and go to CCNP-LAB-S2 then focus on the Management Addresses

Q27- File network.pcapng — What is the interface being reported on in the first snmp query?

Filtering by SNMP

Q28- File network.pcapng — When was the NVRAM config last updated?

It is the place where the configuration made for the router is stored, and there we will find everything we need from the configuration done for the router we are working on.

In search use NVRAM word

Display UDP stream

Q29- File network.pcapng — What is the ip of the radius server?

Based on the result I reached in the previous question, I searched in UDP Stream until I found the answer

Q30- File https.pcapng — What has been added to web interaction with web01.fruitinc.xyz?

The first thing I need is to decrypt the traffic to make it clear to me, and the encryption key is available to me in a secret.txt file.

Edit > Preferences > Protocols > TLS

close Wireshark and open it again

seacrh by http.host == “web01.fruitinc.xyz”

and from Follow > HTTP Stream

Q31- File https.pcapng — What is the name of the photo that is viewed in slack?

Search by http.host contains “slack”

and from Follow > HTTP Stream

Q32- File https.pcapng — What is the username and password to login to 192.168.2.1? Format: ‘username:password’ without quotes.

Search by http.host contains (urlencoded-form)

and from Follow > HTTP/2 Stream to the first traffic display

Q33- File https.pcapng — What is the certStatus for the certificate with a serial number of 07752cebe5222fcf5c7d2038984c5198?

Search by http.host contains (ocsp.certStatus)

Q35- File https.pcapng — A service is assigned to an interface. What is the interface, and what is the service? Format: interface_name:service_name

If you have any comments on write-up, do not hesitate to contact me on LinkedIn:https://www.linkedin.com/in/mohab-salah/