HITCON Cyber Range 2024

Investigate Action

Break in

Reside

Recon 1

LPE

Keylogger(X)

Enumeration

Mail Server

Recon 2

Dump Credential

Cracker

Move to next stop

Who are u?

Tunneling(X)

from scapy.all import *

pcap=rdpcap('tunneling.pcap')

#print(pcap[0].show(dump=True))

data=b''
for p in pcap[2:-1]:
    if p[IP].src=='10.173.0.38':
        print(p[Raw].load.strip(b'\x00')[:-1]) 
        data+=p[Raw].load.strip(b'\x00')[:-1]

with open('gpo.zip','wb') as f:
    f.write(data)

zip -FF gpo.zip --out fix.zip

Recovery(X)

To the hill

Collection

Data Exfiltration

Credential Access(X)

Email Dump(X)

Sweeper(X)

Bloom