Forum Discussion
schmitty
Bronze III
Bronze IIISuperSonic: Ep.6 – TEMPLE
I have Problems with the last two questions: In which file did the attacker find the credentials for the second account they accessed? I extracted the 14 files with SMB/Wireshark but i am not able ...
yeah, these files are...
Anyway use filter to get only SMB traffic and then search through pcap using Edit -> Find Packet
You can use that to find strings within packets and if you know SMB header structure you should be able to spot logon information. From there you can follow up the traffic to see what's being done by each user and find out which sessions are bogus.
netcat
Silver III
Silver IIIDo this:
- Identify the compromised SMB accounts. -> 50% of the last question, and almost 50% of the other question, by digging deeper in the packets (The installed WireShark does not export the file). And with the file, you have the account, too.
