4这里说执行了一个文件 The attacker made a fatal mistake, and in doing so, gave control of his computer to… someone. he shouldn’t have run that malicious program.
The attacker started by performing a port scan of the victim computer. Identify the open TCP ports discovered on the victim’s machine? Enter the flag as the open ports, separated by commas, no spaces, in numerical order. Disregard port numbers > 10000. Example: OFPPT-CTF{80,110,111,143,443,2049} Use the PCAP file from ‘pcap analysis’ challenge.
A port scan is usually done with the TCP handshake, which ends with SYN, ACK if the port is opened. >The filter tcp.flags.ack == 1 and tcp.flags.syn == 1 was used to filter out the completed >handshakes and it was found that ports 21, 135, 139, 445, and 3389 were opened.
加上ip就更清晰了tcp.flags.ack == 1 and tcp.flags.syn == 1 and ip.addr == 192.168.100.103
OFPPT-CTF{21,135,139,445,3389}
pcap analysis6
The attacker might have just bit off more than he can chew! he encountered a competitor that is counter-attacking his system! The competitor executed a command to attain persistence on the attacker’s computer. This command will allow the adversary to regain a connection to the computer even after reboot. What is the packet number where this command was executed? For example: OFPPT-CTF{93721}. Use the PCAP file from ‘pcap analysis’ challenge.
前面我们知道加了计划任务，也就是直接搜sudo 就可以了，该包的号为160468
OFPPT-CTF{160468}
Windows memory dump
A Windows computer has been infected. The attacker managed to exploit a portion of a database backup that contains sensitive employee and customer private information. All memory dump challenges use the same file. Inspect the memory dump and tell us the Windows Major Operating System Version, bit version, and the image date/time (UTC, no spaces or special characters). Submit the flag as OFPPT-CTF{OS_BIT_YYYYMMDDhhmmss}. Example: OFPPT-CTF{WindowsXP_32_20220120095959} File: 1.5 GB Decompressed: 5 GB
┌──(root💀bohemian)-[/tools/volatility] └─# python2 vol.py -f ../ctf/ofppt/physmemraw imageinfo Volatility Foundation Volatility Framework 2.6.1 INFO : volatility.debug : Determining profile based on KDBG search... Suggested Profile(s) : Win10x64_19041 AS Layer1 : SkipDuplicatesAMD64PagedMemory (Kernel AS) AS Layer2 : FileAddressSpace (/tools/ctf/ofppt/physmemraw) PAE type : No PAE DTB : 0x1aa000L KDBG : 0xf8005e600b20L Number of Processors : 4 Image Type (Service Pack) : 0 KPCR for CPU 0 : 0xfffff8005ba60000L KPCR for CPU 1 : 0xffff82804f9c0000L KPCR for CPU 2 : 0xffff82804f5e8000L KPCR for CPU 3 : 0xffff82804f7ca000L KUSER_SHARED_DATA : 0xfffff78000000000L Image date and time : 2021-09-07 14:57:44 UTC+0000 Image local date and time : 2021-09-07 07:57:44 -0700
Using the memory dump file from Window memory dump challenge, find out the name of the malicious process. Submit the flag as OFPPT-CTF{process-name_pid} (include the file extension). Example: OFPPT-CTF{svchost.exe_1234}
