# TShark Challenge II: Directory

## Introduction

This room presents you with a challenge to investigate some traffic data as a part of the SOC team. Let's start working with TShark to analyse the captured traffic. We recommend completing the [TShark: The Basics](https://tryhackme.com/room/tsharkthebasics) and [TShark: CLI Wireshark Features](https://tryhackme.com/room/tsharkcliwiresharkfeatures) rooms first, which will teach you how to use the tool in depth.&#x20;

Start the VM by pressing the green Start Machine button in this task. The machine will start in split view, so you don't need SSH or RDP. In case the machine does not appear, you can click the blue Show Split View button located at the top of this room.

NOTE: Exercise files contain real examples. DO NOT interact with them outside of the given VM. Direct interaction with samples and their contents (files, domains, and IP addresses) outside the given VM can pose security threats to your machine.&#x20;

## Case: Directory Curiosity!

An alert has been triggered: "A user came across a poor file index, and their curiosity led to problems".

The case was assigned to you. Inspect the provided directory-curiosity.pcap located in `~/Desktop/exercise-files` and retrieve the artefacts to confirm that this alert is a true positive.

Your tools: TShark, [VirusTotal](https://www.virustotal.com/).

### Q & A

1\) What is the name of the malicious/suspicious domain?

```
tshark -r directory-curiosity.pcap -Y "dns.qry.type == 1"
```

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FDM6O8GKfrOa6a5Dnyod5%2FScreenshot(49).png?alt=media&#x26;token=e90c0f22-7179-4f9f-bc3d-a880cbd44f16" alt=""><figcaption></figcaption></figure>

Answer:  jx2-bavuong\[.]com

2\) What is the total number of HTTP requests sent to the malicious domain?



```
tshark -r directory-curiosity.pcap -Y 'http.request.full_uri contains "jx2-bavuong.com"' -T fields -e http.request.full_uri | wc -l
```

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FN7m4oA1n9nbD6RzDJOSg%2FScreenshot(52).png?alt=media&#x26;token=30aea4c2-f058-4594-97b4-68bfb97554db" alt=""><figcaption></figcaption></figure>

Answer:  14

3\) What is the IP address associated with the malicious domain?

```
tshark -r directory-curiosity.pcap -Y 'dns.qry.name =="jx2-bavuong.com" ' -T fields -e dns.qry.name -e dns.a
```

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FlRvraFtBaJAJaGGa5kaF%2FScreenshot(53).png?alt=media&#x26;token=6afb0274-970d-421a-81ff-aa5c2f4a612b" alt=""><figcaption></figcaption></figure>

Answer:  141\[.]164\[.]41\[.]174

4\) What is the server info of the suspicious domain?

```
tshark -r directory-curiosity.pcap -Y 'http contains "jx2-bavuong.com"' -T fields -e http.server | sort | uniq
```

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FXLIGfTPIyvlgYdUBH4XT%2FScreenshot(54).png?alt=media&#x26;token=0ee9013c-c704-4869-b12e-0bf32ce33223" alt=""><figcaption></figcaption></figure>

Answer:  Apache/2.2.11 (Win32) DAV/2 mod\_ssl/2.2.11 OpenSSL/0.9.8i PHP/5.2.9

5\) Follow the "first TCP stream" in "ASCII". What is the number of listed files?

```
tshark -r directory-curiosity.pcap  -z follow,tcp,ascii,0 -q
```

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FbtsaoDPSVaPQvEm7kHnu%2FScreenshot(55).png?alt=media&#x26;token=52d89789-8d27-43ce-ac02-b9fd4be45a11" alt=""><figcaption></figcaption></figure>

Answer:  3

6\) What is the filename of the first file?

Answer:  123.php

7\) What is the name of the downloaded executable file?

```
tshark -r directory-curiosity.pcap -Y 'http.request.full_uri contains "jx2-bavuong.com"' -T fields -e http.request.full_uri
```

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FdcJoRt2JK57QRv9z513F%2FScreenshot(56).png?alt=media&#x26;token=8374c139-a1a7-4c1d-853f-5fdcf01d8168" alt=""><figcaption></figcaption></figure>

Answer:  vlauto\[.]exe

8\) What is the SHA256 value of the malicious file?

```
tshark -r directory-curiosity.pcap --export-objects http,./extracted-files
```

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FXNxEnY3xWfoCBUFTmvhi%2FScreenshot(57).png?alt=media&#x26;token=cd12f210-96d6-43d4-a3e4-1bc63a3e9157" alt=""><figcaption></figcaption></figure>

Answer:  b4851333efaf399889456f78eac0fd532e9d8791b23a86a19402c1164aed20de

9\) Search the SHA256 value of the file on VirtusTotal. What is the "PEiD packer" value?

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FfDUBe3eZWIEGbAQk2H9E%2FScreenshot(58).png?alt=media&#x26;token=faacdb63-a4eb-4e71-956b-0dbb5b5f39bf" alt=""><figcaption></figcaption></figure>

Answer:  .NET executable

10\) What does the "Lastline Sandbox" flag this as?

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2F5eEYvh6KcgLsVEmaqGkK%2FScreenshot%20(1).png?alt=media&#x26;token=92565209-3018-43c9-8a41-0186e0cd7d72" alt=""><figcaption></figcaption></figure>

Answer:  MALWARE TROJAN
