1. DEFCON 2011 Network Forensics
Author: hip@insight-labs.org
1. DEFCON 2011 Network Forensics Puzzle: A Deal Is Made
http://forensicscontest.com/contest09/spoilers/2011-Defcon-Contest-Round1/defco
n2011contest-round1.html
strings Evidence01.pcap | grep -i company
透过 grep 收寻 company 关键词
Answer: Factory-Made-Winning-Pharmaceuticals
2. DEFCON 2011 Network Forensics Puzzle: Inception
http://forensicscontest.com/contest09/spoilers/2011-Defcon-Contest-Round2/defco
n2011contest-round2.html
寄信可以猜 Subject
tcpflow -r Evidence02.pcap
(-r: read packets from tcpdump output file
)
grep -a Subject *
-a, --text equivalent to --binary-
files=text
foremost 文件还原工具 http://adityo.blog.binusian.org/?p=231
http://www.irongeek.com/i.php?page=backtrack-3-man/foremost
http://www.youtube.com/watch?v=TmWLsufNiUQ
cat /etc/foremost.conf

2. foremost -c /etc/foremost.conf -i 172.030.001.100.51805-205.188.192.001.00080
file 00000030.pcap
列出封包内所有 host
tcpdump -nn -r 00000030.pcap -A -s0 port 80 | grep Host | sort | uniq

3. tcpflow -r 00000030.pcap host 204.11.246.48
grep GET *
查看 respone
head 204.011.246.048.00080-172.030.001.100.60176

4. -c /usr/local/etc/foremost.conf -i 204.011.246.048.00080-172.030.001.100.60176 -T
/
gunzip -d 00000000.gz
firefox 00000000
Answer: October 6-7, 2011

5. NetworkMiner 快速解
3. DEFCON 2011 Network Forensics Puzzle: Ipad or Remedial Training?
http://forensicscontest.com/contest09/spoilers/2011-Defcon-Contest-Round3/defco
n2011contest-round3.html
NetworkMiner
可以直接看到 File
找不到 voip 所以无法继续下一步分析

6. 改用 xplico , xplico GUI 不 work
usage: xplico [-v] [-c <config_file>] [-h] [-g] [-l] [-i <prot>] -m <capute_module>
-v version
-c config file
-h this help
-i info of protocol 'prot'
-g display graph-tree of protocols
-l print all log in the screen
-m capture type module
NOTE: parameters MUST respect this order!
./xplico -m pcap -f /root/Desktop/Evidence03.pcap

7. ip 74.125.127.126 是 google 的 所以可以猜到是用 googlechat voip call
所以可以用 videosnarf 来解看看
videosnarf
http://ucsniff.sourceforge.net/videosnarf.html
root@bt:/usr/local/bin# videosnarf -h
Starting videosnarf 0.63
Usage: videosnarf [-i input pcap file] [-f filter expression]
-i <input pcap file> (Mandatory) input pcap file
-o <output file> (Optional) output base name file
-f <filter expression> (Optional) pcap filter expression
-k <g726 sample size> (Optional) G726 sameple size

8. Note: sample size could be either 2, 3, 4, 5 bits for 16,24,32 and 40 kbits/s. The
default Kbit/s will be 32
Note: If there are 802.1Q headers in the RTP packet capture, please don't set the
filter expression
Example Usage:
videosnarf -i inputfile.pcap
videosnarf -i inputfile.pcap -f "udp dst port 25001"
Answer: rom127#

9. 4. DEFCON 2011 Network Forensics Puzzle: The Heist
Scrolling down to the 16th line inside the XLS file, you get the answer: Jason Wilson
5. DEFCON 2011 Network Forensics Puzzle: The Heist Part 2
http://forensicscontest.com/contest09/spoilers/2011-Defcon-Contest-Round5/defco
n2011contest-round5.html
useonce@
Opening the file, you can find the password : 8.4 oz- Red Bull
Linux 解
tcpdump -s0 -r Evidence05.pcap -w SMB.cap port 445

10. tshark -r SMB.cap |grep "Create AndX Request"
用 grep 找透过 SMB 建立档案
提取檔案
因为要提取的是 7z 檔 所以要先加入一段 7z 的 format 到 tcpxtract.conf
echo "p7z(100000000, x37x7axbcxafx27x1c);" > /etc/tcpxtract.conf
mv 00000000.p7z 00000000.7z
接下来就是解压缩! Done