---
# System prepended metadata

title: PacketMaze Blue Team Challenge

---

# PacketMaze Blue Team Challenge

:::success
https://cyberdefenders.org/blueteam-ctf-challenges/68#nav-questions
:::


:::info
Instructions:

Uncompress the challenge (pass: cyberdefenders.org)
Load suricatarunner.exe and suricataupdater.exe in BrimSecurity.
Uncompress suricata.zip and move suircata.rules to ".\var\lib\suricata\rules" inside suricatarunner directory.
As a soc analyst working for a security service provider, you have been tasked with analyzing a packet capture for a customer's employee whose network activity has been monitored for a while -possible insider.

Tools:

BrimSecurity
suricatarunner
suricata.rules
NetworkMiner
WireShark
MAC lookup
:::



#### 1. What is the FTP password?
```
AfricaCTF2021
```
wireshark 用 ftp 進行 filter 後再follow tcp就可以發現ftp pass

![截圖 2023-11-30 下午8.47.52](https://hackmd.io/_uploads/rJ_KNbIBa.jpg)


#### 2. What is the IPv6 address of the DNS server used by 192.168.1.26?
```
fe80::c80b:adff:feaa:1db7
```

利用wireshark查詢可以得知192.168.1.26使用得 DNS server 的 ip 是 192.168.1.10
![截圖 2023-11-30 下午8.50.09](https://hackmd.io/_uploads/r1ZfHbUSp.jpg)

192.168.1.10的MAC ADDR 是ca:0b:ad:ad:20:ba
![截圖 2023-11-30 下午8.55.44](https://hackmd.io/_uploads/BJgPI-8S6.jpg)

再用MAC ADDR去找IPv6
![截圖 2023-11-30 下午8.59.01](https://hackmd.io/_uploads/ByNQPW8Sa.jpg)




#### 3. What domain is the user looking up in packet 15174?
```
www.7-zip.org
```
![截圖 2023-11-30 下午9.02.31](https://hackmd.io/_uploads/rkIeO-Ur6.jpg)


#### 4. How many UDP packets were sent from 192.168.1.26 to 24.39.217.246?
```
10
```

![截圖 2023-11-30 下午9.05.00](https://hackmd.io/_uploads/H1sK_WLSp.jpg)



#### 5. What is the MAC address of the system being investigated in the PCAP?”
```
c8:09:a8:57:47:93
```

檢視封包紀錄除了可以發現192.168.1.26在對172.67.162.206進行port scan，因此先針對192.168.1.26進行調查，它的MAC ADDR是c8:09:a8:57:47:93



#### 6. What was the camera model name used to take picture 20210429_152157.jpg ?
```
```
用string搜尋20210429_152157.jpg，可以發現有用ftp在傳輸這個檔案
![截圖 2023-11-30 下午9.18.18](https://hackmd.io/_uploads/r1ssoZUH6.jpg)

file --> export object ftp-data找到這個檔案後匯出
![截圖 2023-11-30 下午9.18.31](https://hackmd.io/_uploads/BkBniZUrT.jpg)

檢視檔案資訊得到相機資訊LM-Q725K
![截圖 2023-11-30 下午9.20.49](https://hackmd.io/_uploads/HyXH3bIH6.jpg)


#### 7. What is the server certificate public key that was used in TLS session: da4a0000342e4b73459d7360b4bea971cc303ac18d29b99067e46d16cc07f4ff?
```
04edcc123af7b13e90ce101a31c2f996f471a7c8f48a1b81d765085f548059a550f3f4f62ca1f0e8f74d727053074a37bceb2cbdc7ce2a8994dcd76dd6834eefc5438c3b6da929321f3a1366bd14c877cc83e5d0731b7f80a6b80916efd4a23a4d
```
用string搜尋da4a0000342e4b73459d7360b4bea971cc303ac18d29b99067e46d16cc07f4ff可以看到這一個session出現在封包26913

![截圖 2023-11-30 下午9.24.45](https://hackmd.io/_uploads/r1RX6WUS6.jpg)

檢視封包內容public key
![截圖 2023-11-30 下午9.27.25](https://hackmd.io/_uploads/BJ6Ta-UBT.jpg)




#### 8. What is the first TLS 1.3 client random that was used to establish a connection with protonmail.com?
```
24e92513b97a0348f733d16996929a79be21b0b1400cd7e2862a732ce7775b70
```

先查詢protonmail.com的ip，可以看到有dns查詢是185.70.41.35
![截圖 2023-11-30 下午9.34.29](https://hackmd.io/_uploads/Sk4uyM8Bp.jpg)

用tls 和 185.70.41.35 來 filter，找到第一筆tls中使用的random
![截圖 2023-11-30 下午9.36.35](https://hackmd.io/_uploads/rkMxez8ST.jpg)



#### 9. What country is the MAC address of the FTP server registered in? (two words, one space in between)
```
United States
```

FTP server 的ip是192.168.1.20，MAC ADDR 是 08:00:27:a6:1f:86

![截圖 2023-11-30 下午9.39.12](https://hackmd.io/_uploads/S11cgzLH6.jpg)

用MAC ADDR去查詢之後發現是註冊在US
![截圖 2023-11-30 下午9.52.38](https://hackmd.io/_uploads/ryE3mGIS6.jpg)


#### 10. What time was a non-standard folder created on the FTP server on the 20th of April? (hh:mm)
```
17:53
```

ftp 建立目錄的指令是MKD，但是搜尋之後發現沒有相關的封包，而且pcap封包資料的時間都是在4/30

![截圖 2023-11-30 下午10.15.10](https://hackmd.io/_uploads/HJ6gFfLH6.jpg)

ftp查詢目錄的指令是LIST，利用LIST搜尋發現有4筆資料。follow tcp 下去查

![截圖 2023-11-30 下午10.17.13](https://hackmd.io/_uploads/Hy_dtMIr6.jpg)
FTP command會透過FTP protocol port 21傳送，其資料的傳送則是會透過ftp-data protocol進行(server port 20 --> client high port)。封包524有LIST指令查詢，在封包530 FTP-DATA response查詢結果中可以看到一個不是預設該有的目錄ftp，他的建立時間是4/20 17:53

![截圖 2023-11-30 下午10.22.11](https://hackmd.io/_uploads/rJVi9MUBp.jpg)



參考資料：
https://zh.wikipedia.org/zh-tw/FTP%E5%91%BD%E4%BB%A4%E5%88%97%E8%A1%A8

http://old.linux.vbird.org/linux_server/0400wuftp.php

#### 11. What domain was the user connected to in packet 27300?
```
dfir.science
```


封包27300可以看到是和ip 172.67.162.206進行連線

![截圖 2023-11-30 下午10.25.42](https://hackmd.io/_uploads/S1SdiMLra.jpg)

dns filter 再用string搜尋ip 172.67.162.206，可以找到它的domain是dfir.science

![截圖 2023-11-30 下午10.27.57](https://hackmd.io/_uploads/rk3g3GUSa.jpg)
