a2.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Task A2 - Identifying the attacker - (Computer Forensics, Packet Analysis)Points: 40\n",
    "\n",
    "## Problem Statement\n",
    "\n",
    "Using the timestamp and IP address information from the VPN log, the FBI was able to identify a virtual server that the attacker used for staging their attack. They were able to obtain a warrant to search the server, but key files used in the attack were deleted.\n",
    "\n",
    "Luckily, the company uses an intrusion detection system which stores packet logs. They were able to find an SSL session going to the staging server, and believe it may have been the attacker transferring over their tools.\n",
    "\n",
    "The FBI hopes that these tools may provide a clue to the attacker's identity\n",
    "\n",
    "\n",
    "Downloads:\n",
    "\n",
    "- Files captured from root's home directory on the staging server ([`root.tar.bz2`](data/a2/root/))\n",
    "- PCAP file believed to be of the attacker downloading their tools ([`session.pcap`](data/a2/session.pcap))\n",
    "\n",
    "## What to do\n",
    "\n",
    "What was the username of the account the attacker used when they built their tools?"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## My solution\n",
    "\n",
    "### Dependencies\n",
    "\n",
    "- [Wireshark](https://www.wireshark.org/)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "First, analyze the type of the given file, `session.pcap`."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "./data/a2/session.pcap: pcap capture file, microsecond ts (little-endian) - version 2.4 (Ethernet, capture length 65535)\n"
     ]
    }
   ],
   "source": [
    "%%bash\n",
    "file ./data/a2/session.pcap"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "So, the file is a `pcap` file as the extension shows."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Next, open `pcap` using `Wireshark`.\n",
    "\n",
    "After opening, use [`.cert.pem`](./data/a2/root/.cert.pem) file to decrypt it.\n",
    "Go to `Preferences` -> `RSA keys` -> `Add new keyfile`, add `.cert.pem` as a key, and restart `Wireshark`.\n",
    "\n",
    "You can find a weird string, `DullRareMoody` in `Client Hello` ,which is an answer.\n",
    "\n",
    "![wireshark](img/wireshark.png)\n",
    "\n",
    "You've got the flag.\n",
    "\n",
    "![a2](img/badgea2.png)"
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3 (ipykernel)",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.10.5"
  },
  "vscode": {
   "interpreter": {
    "hash": "b7866fe74932d61b081c4ec2597adfb5d737ce2ec54e37047e1f636f4795859c"
   }
  }
 },
 "nbformat": 4,
 "nbformat_minor": 2
}