Forum Discussion
schmitty
Bronze III
Bronze IIISuperSonic: Ep.6 – TEMPLE
I have Problems with the last two questions: In which file did the attacker find the credentials for the second account they accessed? I extracted the 14 files with SMB/Wireshark but i am not able ...
yeah, these files are...
Anyway use filter to get only SMB traffic and then search through pcap using Edit -> Find Packet
You can use that to find strings within packets and if you know SMB header structure you should be able to spot logon information. From there you can follow up the traffic to see what's being done by each user and find out which sessions are bogus.
schmittyBronze III
Bronze IIIOk, solved. I was shure i found one Account in the Directorylisting-File at the end,
Now i filtered only SMB-traffic and read it... Found the file, an there were 4 other account arround.
How do i find, that b. is not the 2nd account? (i brute forced the solution)
