{
    "version" : "https://jsonfeed.org/version/1.1",
    "title" : "Incidental InfoSec Blog",
    "description": "Security research, CTF write-ups, and blue team notes from Incidental InfoSec.",
    "home_page_url" : "https://incidentalinfosec.com/",
    "feed_url" : "https://incidentalinfosec.com/index.feed",
    "icon" : "https://incidentalinfosec.com/apple-touch-icon.png",
    "favicon" : "https://incidentalinfosec.com/favicon.ico",
    "author" : {
        "name" : "devs",
        "url": "https://github.com/t-devs",
        "avatar": "https://incidentalinfosec.com/images/avatar.svg"
    },
    "items" : [
    {
        "title" : "Splunking DLP data with a side of active response",
        "date_published" : "2022-01-19T00:00:00Z",
        "date_modified" : "2022-01-19T00:00:00Z",
        "id" : "https://incidentalinfosec.com/posts/splunking-dlp-data-with-a-side-of-response/",
        "url" : "https://incidentalinfosec.com/posts/splunking-dlp-data-with-a-side-of-response/",
        "summary": "Recently, I was attending a corporate event via conference call and I noticed a distinct phrase being mentioned over and over by the event speakers. \u0026ldquo;Please refrain from taking screenshots of these slides as they are not meant for public disclosure.\u0026rdquo; Sound familiar to anyone? How many people are actually going to abide by this suggestion?\nFor in-person events, this warning may be enough to ward off the rogue mobile phone picture taker\u0026hellip;but let\u0026rsquo;s face it\u0026hellip;when people are at home, in their office, not thinking that they are being \u0026ldquo;watched\u0026rdquo;, they definitely are going to take that screen capture (and potentially send it elsewhere). Don\u0026rsquo;t believe me?\n",
        "content_html" : "\u003cp\u003eRecently, I was attending a corporate event via conference call and I noticed a distinct phrase being mentioned over and over by the event speakers. \u0026ldquo;Please refrain from taking screenshots of these slides as they are not meant for public disclosure.\u0026rdquo; Sound familiar to anyone? How many people are actually going to abide by this suggestion?\u003c/p\u003e\n\u003cp\u003eFor in-person events, this warning may be enough to ward off the rogue mobile phone picture taker\u0026hellip;but let\u0026rsquo;s face it\u0026hellip;when people are at home, in their office, not thinking that they are being \u0026ldquo;watched\u0026rdquo;, they definitely are going to take that screen capture (and potentially send it elsewhere). Don\u0026rsquo;t believe me?\u003c/p\u003e\n\u003cp\u003eThe following sections outline how I tested this theory and built out a very rough active response workflow for preventing data loss scenarios of this type.\u003c/p\u003e\n\u003ch2 id=\"system-level-log-monitoring\" class=\"headerLink\"\u003e\r\n    \u003ca href=\"#system-level-log-monitoring\" class=\"header-mark\"\u003e\u003c/a\u003eSystem Level Log Monitoring\u003c/h2\u003e\u003cp\u003eI should mention before going further that although the latest wiz-bangy EDR tool isn\u0026rsquo;t needed for this setup, there needs to be some method, tool, or mechanism of grabbing system level file creation events from the to-be monitored devices (preferably quickly).\u003c/p\u003e\n\u003cp\u003eFor those unfamiliar, there are some great free and lower-priced tools out there that can be deployed for this purpose. Some of these tools include \u003ca href=\"https://docs.velociraptor.app/\" target=\"_blank\" rel=\"noopener noreferrer\"\u003eVelociraptor\u003c/a\u003e and everyone\u0026rsquo;s favorite, \u003ca href=\"https://www.trustedsec.com/tools/trustedsec-sysmon-community-guide/\" target=\"_blank\" rel=\"noopener noreferrer\"\u003eSysmon\u003c/a\u003e. Additionally, for macOS systems, the product \u003ca href=\"https://www.jamf.com/products/jamf-protect/\" target=\"_blank\" rel=\"noopener noreferrer\"\u003eJamf Protect\u003c/a\u003e works very well for remotely collecting Apple Unified Log events.\u003c/p\u003e\n\u003cp\u003eMost organizations these days are sending various categories of event logs to a SIEM (i.e. Splunk) and endpoint data should be no different. Features such as \u003ca href=\"https://docs.splunk.com/Documentation/Splunk/8.2.4/Data/UsetheHTTPEventCollector\" target=\"_blank\" rel=\"noopener noreferrer\"\u003eSplunk HEC\u003c/a\u003e and Universal Forwarders make it easy to pull in this information from the hosts themselves or out of endpoint product consoles.\u003c/p\u003e\n\u003cp\u003eSo what do we look for in the event logs? In the example scenario of a meeting participant taking an \u0026ldquo;unauthorized\u0026rdquo; screen capture of sensitive content, it\u0026rsquo;s pretty easy. Any file creation events that occur from the devices default screen capture application (i.e. SnippingTool, com.apple.screencapture, etc.) are likely to be files of interest.\u003c/p\u003e\n\u003cp\u003eJamf Protect even comes with an \u003ca href=\"https://docs.jamf.com/jamf-protect/documentation/Security.html\" target=\"_blank\" rel=\"noopener noreferrer\"\u003eout-of-box analytic\u003c/a\u003e for screenshots being taken on a system.\u003c/p\u003e\n\u003cp\u003eBut what about individuals that are using non-native, third-party screen capture tools? Performing an inventory of software applications that are installed on systems is a good start. After this, gathering information around the process flow for these applications is a good next step. Finally, adjust Sysmon, Velociraptor, other endpoint agent queries as needed once the general process patterns are identified to capture the screenshot file creation events.\u003c/p\u003e\n\u003cp\u003eNow that the event has been logged, a SHA256 hash should be included within the event. We can utilize Splunk\u0026rsquo;s search scheduling to regularly populate a lookup file with any and all file hashes that are observed from the screenshot events. An example of this query could be:\u003c/p\u003e\n\u003cdiv class=\"code-block highlight is-open show-line-numbers  tw:group tw:my-2\"\u003e\r\n  \u003cdiv class=\"\r\n    \r\n    tw:flex \r\n    tw:flex-row\r\n    tw:flex-1 \r\n    tw:justify-between \r\n    tw:w-full tw:bg-bgColor-secondary\r\n    \"\u003e      \r\n    \u003cbutton \r\n      class=\"\r\n        code-block-button\r\n        tw:mx-2 \r\n        tw:flex\r\n        tw:flex-row\r\n        tw:flex-1\"\r\n      aria-hidden=\"true\"\u003e\r\n          \u003cspan class=\"tw:group-[.is-open]:rotate-90 tw:transition-[transform] tw:duration-500 tw:ease-in-out tw:print:hidden! tw:w-min tw:h-min tw:my-1 tw:mx-1\"\u003e\u003csvg class=\"icon\"\n    xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 320 512\"\u003e\u003c!-- Font Awesome Free 5.15.4 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) --\u003e\u003cpath d=\"M285.476 272.971L91.132 467.314c-9.373 9.373-24.569 9.373-33.941 0l-22.667-22.667c-9.357-9.357-9.375-24.522-.04-33.901L188.505 256 34.484 101.255c-9.335-9.379-9.317-24.544.04-33.901l22.667-22.667c9.373-9.373 24.569-9.373 33.941 0L285.475 239.03c9.373 9.372 9.373 24.568.001 33.941z\"/\u003e\u003c/svg\u003e\u003c/span\u003e\r\n          \u003cspan class=\"tw:select-none tw:my-1! tw:block\"\u003etext\u003c/span\u003e\r\n      \u003c/button\u003e\r\n\r\n   \u003cdiv class=\"tw:flex\"\u003e\r\n      \u003cbutton \r\n        class=\"\r\n          line-number-button\r\n          tw:mx-2 \r\n          tw:hidden \r\n          tw:group-[.is-open]:block \r\n          tw:group-[.show-line-numbers]:text-fgColor-link \r\n          tw:print:hidden!\" \r\n        title=\"Toggle line numbers\"\u003e\u003csvg class=\"icon\"\n    xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 512 512\"\u003e\u003c!-- Font Awesome Free 5.15.4 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) --\u003e\u003cpath d=\"M61.77 401l17.5-20.15a19.92 19.92 0 0 0 5.07-14.19v-3.31C84.34 356 80.5 352 73 352H16a8 8 0 0 0-8 8v16a8 8 0 0 0 8 8h22.83a157.41 157.41 0 0 0-11 12.31l-5.61 7c-4 5.07-5.25 10.13-2.8 14.88l1.05 1.93c3 5.76 6.29 7.88 12.25 7.88h4.73c10.33 0 15.94 2.44 15.94 9.09 0 4.72-4.2 8.22-14.36 8.22a41.54 41.54 0 0 1-15.47-3.12c-6.49-3.88-11.74-3.5-15.6 3.12l-5.59 9.31c-3.72 6.13-3.19 11.72 2.63 15.94 7.71 4.69 20.38 9.44 37 9.44 34.16 0 48.5-22.75 48.5-44.12-.03-14.38-9.12-29.76-28.73-34.88zM496 224H176a16 16 0 0 0-16 16v32a16 16 0 0 0 16 16h320a16 16 0 0 0 16-16v-32a16 16 0 0 0-16-16zm0-160H176a16 16 0 0 0-16 16v32a16 16 0 0 0 16 16h320a16 16 0 0 0 16-16V80a16 16 0 0 0-16-16zm0 320H176a16 16 0 0 0-16 16v32a16 16 0 0 0 16 16h320a16 16 0 0 0 16-16v-32a16 16 0 0 0-16-16zM16 160h64a8 8 0 0 0 8-8v-16a8 8 0 0 0-8-8H64V40a8 8 0 0 0-8-8H32a8 8 0 0 0-7.14 4.42l-8 16A8 8 0 0 0 24 64h8v64H16a8 8 0 0 0-8 8v16a8 8 0 0 0 8 8zm-3.91 160H80a8 8 0 0 0 8-8v-16a8 8 0 0 0-8-8H41.32c3.29-10.29 48.34-18.68 48.34-56.44 0-29.06-25-39.56-44.47-39.56-21.36 0-33.8 10-40.46 18.75-4.37 5.59-3 10.84 2.8 15.37l8.58 6.88c5.61 4.56 11 2.47 16.12-2.44a13.44 13.44 0 0 1 9.46-3.84c3.33 0 9.28 1.56 9.28 8.75C51 248.19 0 257.31 0 304.59v4C0 316 5.08 320 12.09 320z\"/\u003e\u003c/svg\u003e\u003c/button\u003e\r\n\r\n      \u003cbutton \r\n        class=\"\r\n          wrap-code-button\r\n          tw:select-none \r\n          tw:mx-2 \r\n          tw:hidden \r\n          tw:group-[.is-open]:block \r\n          tw:group-[.is-wrap]:text-fgColor-link \r\n          tw:print:hidden!\" \r\n        title=\"Toggle code wrap\"\u003e\u003csvg class=\"icon\"\n    xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 448 512\"\u003e\u003c!-- Font Awesome Free 5.15.4 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) --\u003e\u003cpath d=\"M16 132h416c8.837 0 16-7.163 16-16V76c0-8.837-7.163-16-16-16H16C7.163 60 0 67.163 0 76v40c0 8.837 7.163 16 16 16zm0 160h416c8.837 0 16-7.163 16-16v-40c0-8.837-7.163-16-16-16H16c-8.837 0-16 7.163-16 16v40c0 8.837 7.163 16 16 16zm0 160h416c8.837 0 16-7.163 16-16v-40c0-8.837-7.163-16-16-16H16c-8.837 0-16 7.163-16 16v40c0 8.837 7.163 16 16 16z\"/\u003e\u003c/svg\u003e\u003c/button\u003e\r\n      \r\n      \u003cbutton \r\n        class=\"\r\n          copy-code-button\r\n          tw:select-none\r\n          tw:mx-2 \r\n          tw:hidden\r\n          tw:group-[.is-open]:block\r\n          tw:hover:text-fgColor-link \r\n          tw:print:hidden!\"\r\n        title=\"Copy code\"\u003e\r\n          \u003cspan class=\"copy-icon tw:block\"\u003e\u003csvg class=\"icon\"\n    xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 448 512\"\u003e\u003c!-- Font Awesome Free 5.15.4 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) --\u003e\u003cpath d=\"M433.941 65.941l-51.882-51.882A48 48 0 0 0 348.118 0H176c-26.51 0-48 21.49-48 48v48H48c-26.51 0-48 21.49-48 48v320c0 26.51 21.49 48 48 48h224c26.51 0 48-21.49 48-48v-48h80c26.51 0 48-21.49 48-48V99.882a48 48 0 0 0-14.059-33.941zM266 464H54a6 6 0 0 1-6-6V150a6 6 0 0 1 6-6h74v224c0 26.51 21.49 48 48 48h96v42a6 6 0 0 1-6 6zm128-96H182a6 6 0 0 1-6-6V54a6 6 0 0 1 6-6h106v88c0 13.255 10.745 24 24 24h88v202a6 6 0 0 1-6 6zm6-256h-64V48h9.632c1.591 0 3.117.632 4.243 1.757l48.368 48.368a6 6 0 0 1 1.757 4.243V112z\"/\u003e\u003c/svg\u003e\u003c/span\u003e\r\n          \u003cspan class=\"check-icon tw:hidden\"\u003e\u003csvg class=\"icon\"\n    xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 512 512\"\u003e\u003c!-- Font Awesome Free 5.15.4 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) --\u003e\u003cpath d=\"M173.898 439.404l-166.4-166.4c-9.997-9.997-9.997-26.206 0-36.204l36.203-36.204c9.997-9.998 26.207-9.998 36.204 0L192 312.69 432.095 72.596c9.997-9.997 26.207-9.997 36.204 0l36.203 36.204c9.997 9.997 9.997 26.206 0 36.204l-294.4 294.401c-9.998 9.997-26.207 9.997-36.204-.001z\"/\u003e\u003c/svg\u003e\u003c/span\u003e\r\n      \u003c/button\u003e\r\n        \r\n      \u003cbutton \r\n        class=\"\r\n          tw:select-none \r\n          tw:mx-2 \r\n          tw:block \r\n          tw:group-[.is-open]:hidden \r\n          tw:print:hidden!\" \r\n        disabled\r\n        aria-hidden=\"true\"\u003e\u003csvg class=\"icon\"\n    xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 512 512\"\u003e\u003c!-- Font Awesome Free 5.15.4 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) --\u003e\u003cpath d=\"M328 256c0 39.8-32.2 72-72 72s-72-32.2-72-72 32.2-72 72-72 72 32.2 72 72zm104-72c-39.8 0-72 32.2-72 72s32.2 72 72 72 72-32.2 72-72-32.2-72-72-72zm-352 0c-39.8 0-72 32.2-72 72s32.2 72 72 72 72-32.2 72-72-32.2-72-72-72z\"/\u003e\u003c/svg\u003e\u003c/button\u003e\r\n    \u003c/div\u003e\r\n  \u003c/div\u003e\r\n  \u003cpre style=\"counter-reset: codeblock;\" class=\"tw:block tw:m-0 tw:p-0\"\u003e\u003ccode \r\n    id=\"codeblock-id-3\" \r\n    class=\"\r\n      chroma \r\n      tw:block! \r\n      tw:p-0\r\n      tw:m-0\r\n      tw:transition-[max-height] \r\n      tw:duration-500 \r\n      tw:ease-in-out \r\n      tw:group-[.is-closed]:max-h-0! \r\n      tw:group-[.is-wrap]:text-wrap\r\n      tw:overflow-y-hidden\r\n      tw:overflow-x-auto\r\n      tw:scrollbar-thin\r\n      \"\u003e\u003cspan class=\"line\"\u003e\u003cspan class=\"cl\"\u003eindex=endpoint event_name=\u0026#34;Screenshot Taken\u0026#34;\n\u003c/span\u003e\u003c/span\u003e\u003cspan class=\"line\"\u003e\u003cspan class=\"cl\"\u003e| dedup sha256hash\n\u003c/span\u003e\u003c/span\u003e\u003cspan class=\"line\"\u003e\u003cspan class=\"cl\"\u003e| table sha256hash\n\u003c/span\u003e\u003c/span\u003e\u003cspan class=\"line\"\u003e\u003cspan class=\"cl\"\u003e| outputlookup append=t screenshot_hashes.csv\u003c/span\u003e\u003c/span\u003e\u003c/code\u003e\u003c/pre\u003e\r\n\u003c/div\u003e\r\n\u003cp\u003eBut now what?\u003c/p\u003e\n\u003ch2 id=\"active-response-actions\" class=\"headerLink\"\u003e\r\n    \u003ca href=\"#active-response-actions\" class=\"header-mark\"\u003e\u003c/a\u003eActive Response Actions\u003c/h2\u003e\u003cp\u003eSplunk alert actions are great ways of integrating Splunk with other systems and Security, Orchestration, Automation, and Response (SOAR) platforms. With regards to the screenshot use case, one configuration that could be put in place is that, on a regular interval, Splunk can send the file hashes included in the previously created lookup file to a SOAR platform. The SOAR platform can interface with the organization\u0026rsquo;s DLP product, email platform, etc. to block the specified file hashes from being transferred to external locations. Email continues to be one of the most common mechanisms for data exfiltration by insider threat actors.\u003c/p\u003e\n\u003cfigure\u003e\u003cimg src=\"/images/dlp_data_flow.webp\" width=\"700\"\u003e\n\u003c/figure\u003e\n\n\u003cp\u003eI\u0026rsquo;m no expert when it comes to data loss prevention (DLP) and there are definitely far better (and expensive product) methods for performing what I outlined today. Like with other areas of blue-teaming, having a defense in depth strategy with multiple ways of detecting and remediating risks is important. Hopefully this post has outlined a creative and inexpensive method for assisting with a data loss prevention use case.\u003c/p\u003e\n\u003chr\u003e\n\u003cp\u003e\u003ca href=\"https://www.flaticon.com/free-icons/user\" target=\"_blank\" rel=\"noopener noreferrer\"\u003eUser icons\u003c/a\u003e created by Freepik - Flaticon.\u003cbr\u003e\n\u003ca href=\"https://www.flaticon.com/free-icons/screenshot\" target=\"_blank\" rel=\"noopener noreferrer\"\u003eScreenshot icons\u003c/a\u003e created by Freepik - Flaticon.\u003cbr\u003e\n\u003ca href=\"https://www.flaticon.com/free-icons/development\" target=\"_blank\" rel=\"noopener noreferrer\"\u003eDevelopment icons\u003c/a\u003e created by Freepik - Flaticon.\u003c/p\u003e\n",
        "language": "en"
    },
    {
        "title" : "WORMCON CTF - 2021",
        "date_published" : "2021-08-30T00:00:00Z",
        "date_modified" : "2021-08-30T00:00:00Z",
        "id" : "https://incidentalinfosec.com/posts/wormcon-ctf-2021/",
        "url" : "https://incidentalinfosec.com/posts/wormcon-ctf-2021/",
        "summary": "WORMCON CTF occurred this weekend and I had a fun time digging through a handful of Forensics and Networking challenges.\nNetwork At Risk (Part 2)This challenge provided a PCAP file that contained quite a bit of FTP traffic. As I\u0026rsquo;m sure most know, FTP does not encrypt data while in transit. This provided me with a good starting point to try and gather some information.\nFigure 1: Protocol hierarchy Sure enough, one of the first things I noticed in the FTP requests is a username and password. I\u0026rsquo;ll hold onto this information for later.\n",
        "content_html" : "\u003cp\u003eWORMCON CTF occurred this weekend and I had a fun time digging through a handful of Forensics and Networking challenges.\u003c/p\u003e\n\u003ch2 id=\"network-at-risk-part-2\" class=\"headerLink\"\u003e\r\n    \u003ca href=\"#network-at-risk-part-2\" class=\"header-mark\"\u003e\u003c/a\u003eNetwork At Risk (Part 2)\u003c/h2\u003e\u003cp\u003eThis challenge provided a PCAP file that contained quite a bit of FTP traffic. As I\u0026rsquo;m sure most know, FTP does not encrypt data while in transit. This provided me with a good starting point to try and gather some information.\u003c/p\u003e\n\u003cfigure\u003e\u003cimg src=\"/images/network2_1.webp\" width=\"800\"\u003e\u003cfigcaption\u003e\n\t\t\t\u003ch4\u003eFigure 1: Protocol hierarchy\u003c/h4\u003e\n\t\t\u003c/figcaption\u003e\n\u003c/figure\u003e\n\n\u003cp\u003eSure enough, one of the first things I noticed in the FTP requests is a username and password. I\u0026rsquo;ll hold onto this information for later.\u003c/p\u003e\n\u003cfigure\u003e\u003cimg src=\"/images/network2_2.webp\" width=\"800\"\u003e\u003cfigcaption\u003e\n\t\t\t\u003ch4\u003eFigure 2: FTP login\u003c/h4\u003e\n\t\t\u003c/figcaption\u003e\n\u003c/figure\u003e\n\n\u003cp\u003eNext I decided to look for any interesting files that would\u0026rsquo;ve been transferred in this session. I saw a \u003ccode\u003eB4ckF1r3.zip\u003c/code\u003e file a bit later on in the PCAP. Maybe we can export this file from the PCAP to see what\u0026rsquo;s inside?\u003c/p\u003e\n\u003cfigure\u003e\u003cimg src=\"/images/network2_3.webp\" width=\"800\"\u003e\u003cfigcaption\u003e\n\t\t\t\u003ch4\u003eFigure 3: Interesting file\u003c/h4\u003e\n\t\t\u003c/figcaption\u003e\n\u003c/figure\u003e\n\n\u003cp\u003eWireshark makes it easy enough to export HTTP objects from a capture, but what about data from other protocols? I\u0026rsquo;ll need to dive into file carving for this. A quick Google search shows that .zip files begin with a hex file header of \u003ccode\u003e50 4B 03 04\u003c/code\u003e. I searched for this in the PCAP to find when the zip file would\u0026rsquo;ve been transferred. A quick \u0026ldquo;Follow TCP Stream\u0026rdquo; of packet \u003ccode\u003e7788\u003c/code\u003e will bring up a window where raw packet data can be exported.\u003c/p\u003e\n\u003cfigure\u003e\u003cimg src=\"/images/network2_4.webp\" width=\"800\"\u003e\u003cfigcaption\u003e\n\t\t\t\u003ch4\u003eFigure 4: Zip file search\u003c/h4\u003e\n\t\t\u003c/figcaption\u003e\n\u003c/figure\u003e\n\n\u003cfigure\u003e\u003cimg src=\"/images/network2_5.webp\" width=\"800\"\u003e\u003cfigcaption\u003e\n\t\t\t\u003ch4\u003eFigure 5: Zip file export\u003c/h4\u003e\n\t\t\u003c/figcaption\u003e\n\u003c/figure\u003e\n\n\u003cp\u003eAt this point, it\u0026rsquo;s fairly trivial save the raw \u003ccode\u003eB4ckF1r3.zip\u003c/code\u003e file and attempt to unzip the archive. The archive looks to require a password in order to un-compress. The password \u003ccode\u003epl3as3S4v3Th3w0rmC0n\u003c/code\u003e that was observed earlier unzips things successfully and a shell script contains the flag.\u003c/p\u003e\n\u003cfigure\u003e\u003cimg src=\"/images/network2_6.webp\" width=\"400\"\u003e\u003cfigcaption\u003e\n\t\t\t\u003ch4\u003eFigure 6: Flag shell script\u003c/h4\u003e\n\t\t\u003c/figcaption\u003e\n\u003c/figure\u003e\n\n\u003chr\u003e\n\u003ch2 id=\"network-at-risk-part-3\" class=\"headerLink\"\u003e\r\n    \u003ca href=\"#network-at-risk-part-3\" class=\"header-mark\"\u003e\u003c/a\u003eNetwork At Risk (Part 3)\u003c/h2\u003e\u003cp\u003eI continued down the PCAP analysis road and attempted to tackle Part 3 of the Network at Risk challenges. At first glance for this one, I noticed that ~90% of the packets in this PCAP related to Real-time Transport Protocol (RTP). A little research shows that RTP is typically used for VoIP. This gave me the hint that I likely needed to recover an audio file with the flag.\u003c/p\u003e\n\u003cfigure\u003e\u003cimg src=\"/images/network3_1.webp\" width=\"800\"\u003e\u003cfigcaption\u003e\n\t\t\t\u003ch4\u003eFigure 7: Protocol hierarchy\u003c/h4\u003e\n\t\t\u003c/figcaption\u003e\n\u003c/figure\u003e\n\n\u003cp\u003eAdditionally, I noticed with this capture that there were a handful of DNS requests. These packets actually gave me a hint on which tool could be used to solve the challenge. Xplico, specifically the PCAP2WAV tool, allows for network capture files to be decoded into WAV audio files.\u003c/p\u003e\n\u003cfigure\u003e\u003cimg src=\"/images/network3_2.webp\"\u003e\u003cfigcaption\u003e\n\t\t\t\u003ch4\u003eFigure 8: DNS requests\u003c/h4\u003e\n\t\t\u003c/figcaption\u003e\n\u003c/figure\u003e\n\n\u003cp\u003eI checked out \u003ca href=\"https://pcap2wav.xplico.org\" target=\"_blank\" rel=\"noopener noreferrer\"\u003ehttps://pcap2wav.xplico.org\u003c/a\u003e and uploaded the network capture. This spat out two WAV files that I could listen to where the phrase \u0026ldquo;welcome to the world of voip\u0026rdquo; was repeated several times. This ended up being the flag, \u003ccode\u003ewormcon{welcome_to_the_world_of_voip}\u003c/code\u003e.\u003c/p\u003e\n\u003cfigure\u003e\u003cimg src=\"/images/network3_3.webp\" width=\"900\"\u003e\u003cfigcaption\u003e\n\t\t\t\u003ch4\u003eFigure 9: Xplico PCAP2WAV\u003c/h4\u003e\n\t\t\u003c/figcaption\u003e\n\u003c/figure\u003e\n\n\u003chr\u003e\n\u003ch2 id=\"network-at-risk-part-4\" class=\"headerLink\"\u003e\r\n    \u003ca href=\"#network-at-risk-part-4\" class=\"header-mark\"\u003e\u003c/a\u003eNetwork At Risk (Part 4)\u003c/h2\u003e\u003cp\u003eLast but not least, I dove into Part 4 of this challenge series. With this network capture, I observed a bunch of 802.11 packets. This suggested that wireless networks would likely be involved.\u003c/p\u003e\n\u003cfigure\u003e\u003cimg src=\"/images/network4_1.webp\" width=\"800\"\u003e\u003cfigcaption\u003e\n\t\t\t\u003ch4\u003eFigure 10: Protocol hierarchy\u003c/h4\u003e\n\t\t\u003c/figcaption\u003e\n\u003c/figure\u003e\n\n\u003cp\u003eI took particular attention to the 802.1x authentication packets and learned from these that WPA was likely being used. WPA (TKIP) is an inherently insecure protocol for wireless networks and allows attackers to be able to brute force the network password if specific packets are captured / sniffed. Lucky for us, these packets are contained in this PCAP.\u003c/p\u003e\n\u003cfigure\u003e\u003cimg src=\"/images/network4_2.webp\" width=\"800\"\u003e\u003cfigcaption\u003e\n\t\t\t\u003ch4\u003eFigure 11: WPA handshake\u003c/h4\u003e\n\t\t\u003c/figcaption\u003e\n\u003c/figure\u003e\n\n\u003cp\u003eAircrack-ng is the tool of choice for this challenge. With the WPA authentication handshake packets in hand, my goal was to try and offline crack what the pre-shared WPA key for the \u003ccode\u003eDeathStar\u003c/code\u003e wireless network would\u0026rsquo;ve been. I fed the entire PCAP into Aircrack-ng and loaded the wordlist, \u003ccode\u003erockyou.txt\u003c/code\u003e, that comes with Kali Linux. Before long, I had the WPA password as well as enough information for this challenges flag, \u003ccode\u003ewormcon{P@$$w0rd_82:25:fa:ee:ed:91}\u003c/code\u003e.\u003c/p\u003e\n\u003cfigure\u003e\u003cimg src=\"/images/network4_3.webp\" width=\"600\"\u003e\u003cfigcaption\u003e\n \t\t\t\u003ch4\u003eFigure 12: Aircrack-ng PSK brute-force\u003c/h4\u003e\n \t\t\u003c/figcaption\u003e\n \u003c/figure\u003e\n\n\u003chr\u003e\n\u003ch2 id=\"wormonetics---part-1\" class=\"headerLink\"\u003e\r\n    \u003ca href=\"#wormonetics---part-1\" class=\"header-mark\"\u003e\u003c/a\u003ewormonetics - Part 1\u003c/h2\u003e\u003cp\u003eIt\u0026rsquo;s been a while since I\u0026rsquo;ve seen a forensics challenge involve a full system disk image like this one had. At work, I\u0026rsquo;ve been diving quite a bit into forensics and saw this as an opportunity to fire up Autopsy to try and solve this one.\u003c/p\u003e\n\u003cp\u003eGiven the disk image, the goal of this first challenge was to try and find the email address of a threat actor that one of the fictitious company\u0026rsquo;s employees was interacting with. Additionally, part of the flag also required us finding what our insider\u0026rsquo;s first name was. I installed Autopsy and got to digging.\u003c/p\u003e\n\u003cfigure\u003e\u003cimg src=\"/images/wormonetics1_1.webp\" width=\"800\"\u003e\u003cfigcaption\u003e\n\t\t\t\u003ch4\u003eFigure 13: Autopsy image\u003c/h4\u003e\n\t\t\u003c/figcaption\u003e\n\u003c/figure\u003e\n\n\u003cp\u003eAutopsy makes it easy to sift through system artifacts and parse out items of interest. Specifically, there is a section within \u003ccode\u003eData Artifacts\u003c/code\u003e called \u003ccode\u003eE-mail Messages\u003c/code\u003e. This is where I found a peculiar email message that our intern, \u003ccode\u003eharry\u003c/code\u003e had sent to \u003ccode\u003ehackwithdark@outlook.com\u003c/code\u003e on 08/06/2021. We can place these two pieces of information into flag format and claim our points, \u003ccode\u003ewormcon{harry_hackwithdark@outlook.com}\u003c/code\u003e.\u003c/p\u003e\n\u003cfigure\u003e\u003cimg src=\"/images/wormonetics1_2.webp\" width=\"900\"\u003e\u003cfigcaption\u003e\n\t\t\t\u003ch4\u003eFigure 14: Hacker email\u003c/h4\u003e\n\t\t\u003c/figcaption\u003e\n\u003c/figure\u003e\n\n\u003chr\u003e\n\u003ch2 id=\"wormonetics---notes\" class=\"headerLink\"\u003e\r\n    \u003ca href=\"#wormonetics---notes\" class=\"header-mark\"\u003e\u003c/a\u003ewormonetics - Notes\u003c/h2\u003e\u003cp\u003eI unfortunately didn\u0026rsquo;t have the time to get through the rest of the wormonetics challenges before WORMCON CTF ended but I did see an additional file of interest that I imagine would\u0026rsquo;ve been helpful in finding additional flags. If I get some time in the near future I will try and see about solving Part 2 and 3!\u003c/p\u003e\n\u003cp\u003eWithin the \u003ccode\u003eE-mail Messages\u003c/code\u003e section of Autopsy I noticed a \u003ccode\u003eGet Your Offer.eml\u003c/code\u003e message that had an oddly named attachment.\u003c/p\u003e\n\u003cfigure\u003e\u003cimg src=\"/images/wormonetics3_1.webp\" width=\"500\"\u003e\n\u003c/figure\u003e\n\n\u003cfigure\u003e\u003cimg src=\"/images/wormonetics3_2.webp\" width=\"600\"\u003e\u003cfigcaption\u003e\n\t\t\t\u003ch4\u003eFigure 15: Suspicious email\u003c/h4\u003e\n\t\t\u003c/figcaption\u003e\n\u003c/figure\u003e\n\n\u003cp\u003eIf we check the hash for this archive file in VirusTotal, a number of vendors denote the archive, along with the XLS spreadsheet inside as malicious.\u003c/p\u003e\n\u003cp\u003e\u003ca href=\"https://www.virustotal.com/gui/file/5df39c1987aa27b76921ba626aa22dca22978d576ed06e34a81ea00eb0dc8ff2/detection\" target=\"_blank\" rel=\"noopener noreferrer\"\u003ehttps://www.virustotal.com/gui/file/5df39c1987aa27b76921ba626aa22dca22978d576ed06e34a81ea00eb0dc8ff2/detection\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003eIt\u0026rsquo;s likely that the XLS file contains VBA macros which can be reversed. Malicious Microsoft Office files typically serve as droppers / downloaders for other types of malware. I suspected that Part 2 or 3 of this challenge series involved digging through the VBA code.\u003c/p\u003e\n\u003cp\u003eMy go-to tool for extracting malicious Office VBA macros is \u003ca href=\"https://github.com/DidierStevens/DidierStevensSuite/blob/master/oledump.py\" target=\"_blank\" rel=\"noopener noreferrer\"\u003eoledump\u003c/a\u003e by Didier Stevens. I took a quick peak at the \u003ccode\u003eannual_report.xls\u003c/code\u003e file and extracted the macros.\u003c/p\u003e\n\u003cfigure\u003e\u003cimg src=\"/images/wormonetics3_3.webp\" width=\"500\"\u003e\u003cfigcaption\u003e\n\t\t\t\u003ch4\u003eFigure 16: VBA Macros\u003c/h4\u003e\n\t\t\u003c/figcaption\u003e\n\u003c/figure\u003e\n\n\u003cp\u003eA common technique that I\u0026rsquo;ve observed malware authors use with malicious macros is to encode various command execution strings as blobs of data in VBA code. The array being instantiated in the 2nd VBA macro of the XLS file caught my eye and I suspect contains further information for uncovering the flag for this challenge.\u003c/p\u003e\n\u003cfigure\u003e\u003cimg src=\"/images/wormonetics3_4.webp\"\u003e\u003cfigcaption\u003e\n\t\t\t\u003ch4\u003eFigure 17: Suspicious array\u003c/h4\u003e\n\t\t\u003c/figcaption\u003e\n\u003c/figure\u003e\n\n",
        "language": "en"
    }
    {
        "title" : "CorCTF - 2021",
        "date_published" : "2021-08-24T00:00:00Z",
        "date_modified" : "2021-08-24T00:00:00Z",
        "id" : "https://incidentalinfosec.com/posts/corctf-2021/",
        "url" : "https://incidentalinfosec.com/posts/corctf-2021/",
        "summary": "Lately, I\u0026rsquo;ve been keeping my eye out for interesting CTF\u0026rsquo;s to compete in. This past weekend, the corCTF team hosted their own event and boy was it a tough one. Being primarily a forensics guy, I was definitely out of my comfort zone with many of the challenges being binary exploitation, reversing, and cryptography. I clung onto anything that looked familiar and in the end was able to crack a web challenge for a few points. Here\u0026rsquo;s to getting stronger with reversing + coding for the next go around!\n",
        "content_html" : "\u003cp\u003eLately, I\u0026rsquo;ve been keeping my eye out for interesting CTF\u0026rsquo;s to compete in. This past weekend, the \u003ca href=\"https://ctftime.org/event/1364\" target=\"_blank\" rel=\"noopener noreferrer\"\u003ecorCTF team\u003c/a\u003e hosted their own event and boy was it a tough one. Being primarily a forensics guy, I was definitely out of my comfort zone with many of the challenges being binary exploitation, reversing, and cryptography. I clung onto anything that looked familiar and in the end was able to crack a web challenge for a few points. Here\u0026rsquo;s to getting stronger with reversing + coding for the next go around!\u003c/p\u003e\n\u003ch2 id=\"devme\" class=\"headerLink\"\u003e\r\n    \u003ca href=\"#devme\" class=\"header-mark\"\u003e\u003c/a\u003edevme\u003c/h2\u003e\u003cp\u003eIn this challenge we were provided a pretty straightforward web page with a few buttons and a submission form. You can probably guess where my focus turned right out of the gate. Let\u0026rsquo;s check out how user input gets handled.\u003c/p\u003e\n\u003cfigure\u003e\u003cimg src=\"/images/devme_web1.webp\" width=\"600\"\u003e\n\u003c/figure\u003e\n\n\u003cfigure\u003e\u003cimg src=\"/images/devme_web2.webp\" width=\"600\"\u003e\u003cfigcaption\u003e\n\t\t\t\u003ch4\u003eFigure 1: Website preview\u003c/h4\u003e\n\t\t\u003c/figcaption\u003e\n\u003c/figure\u003e\n\n\u003cp\u003eI fired up BurpSuite to see what happens when a test email address is submitted. Our content ends up getting POST\u0026rsquo;d to a \u003ccode\u003e/graphl\u003c/code\u003e endpoint and we receive some type of hashed username as the response.\u003c/p\u003e\n\u003cfigure\u003e\u003cimg src=\"/images/devme_1.webp\" width=\"1000\"\u003e\u003cfigcaption\u003e\n\t\t\t\u003ch4\u003eFigure 2: Digging in with BurpSuite\u003c/h4\u003e\n\t\t\u003c/figcaption\u003e\n\u003c/figure\u003e\n\n\u003cp\u003eSeeing GraphQL in this challenge peeked my interest and I decided to spend some time learning about common attack scenarios with the technology. I stumbled across a pretty good video from Bugcrowd (below) that highlights a number of ways in which you can develop an attack methodology.\u003c/p\u003e\n\u003cdiv style=\"position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden;\"\u003e\n\t\t\t\u003ciframe allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share; fullscreen\" loading=\"eager\" referrerpolicy=\"strict-origin-when-cross-origin\" src=\"https://www.youtube-nocookie.com/embed/NPDp7GHmMa0?autoplay=0\u0026amp;controls=1\u0026amp;end=0\u0026amp;loop=0\u0026amp;mute=0\u0026amp;start=0\" style=\"position: absolute; top: 0; left: 0; width: 100%; height: 100%; border:0;\" title=\"YouTube video\"\u003e\u003c/iframe\u003e\n\t\t\u003c/div\u003e\n\n\u003cp\u003eOne way of performing reconnaissance with GraphQL is to see if introspection queries are allowed. Introspection queries essentially allow us to learn and gather information about what types of information the GraphQL endpoint accepts. It\u0026rsquo;s generally not a good idea to enable introspection queries for a web app unless you specifically need to offer API services to clients. Let\u0026rsquo;s see if our web application allows us to use them!\u003c/p\u003e\n\u003cp\u003eIn order to easily manipulate GraphQL queries, I used the Chrome extension \u003ca href=\"https://chrome.google.com/webstore/detail/altair-graphql-client/flnheeellpciglgpaodhkhmapeljopja?hl=en\" target=\"_blank\" rel=\"noopener noreferrer\"\u003eAltair GraphQL Client\u003c/a\u003e.\u003c/p\u003e\n\u003cfigure\u003e\u003cimg src=\"/images/devme_3.webp\"\u003e\u003cfigcaption\u003e\n\t\t\t\u003ch4\u003eFigure 3: GraphQL schema query\u003c/h4\u003e\n\t\t\u003c/figcaption\u003e\n\u003c/figure\u003e\n\n\u003cp\u003eBy using a generic introspection query, we see that there are a number of various schema types that we can potentially interact with. The \u003ccode\u003eUser\u003c/code\u003e and \u003ccode\u003eQuery\u003c/code\u003e types looked interesting, I sought to dig further into them. The following screenshots show me fumbling through and gathering additional data.\u003c/p\u003e\n\u003cfigure\u003e\u003cimg src=\"/images/devme_4.webp\" width=\"850\"\u003e\n\u003c/figure\u003e\n\n\u003cfigure\u003e\u003cimg src=\"/images/devme_5.webp\" width=\"850\"\u003e\u003cfigcaption\u003e\n\t\t\t\u003ch4\u003eFigures 3 \u0026#43; 4: User and Query types\u003c/h4\u003e\n\t\t\u003c/figcaption\u003e\n\u003c/figure\u003e\n\n\u003cp\u003eInteresting, we see that the \u003ccode\u003eQuery\u003c/code\u003e type has something that potentially involves the flag. If we query the \u003ccode\u003eflag\u003c/code\u003e field directly, what happens?\u003c/p\u003e\n\u003cfigure\u003e\u003cimg src=\"/images/devme_7.webp\" width=\"850\"\u003e\u003cfigcaption\u003e\n\t\t\t\u003ch4\u003eFigure 5: flag query\u003c/h4\u003e\n\t\t\u003c/figcaption\u003e\n\u003c/figure\u003e\n\n\u003cp\u003eIt looks like the \u003ccode\u003eflag\u003c/code\u003e field requires a token in order to return any information. Next, based on the previous schema queries and our original BurpSuite response, I figured that a \u003ccode\u003euser\u003c/code\u003e likely has a \u003ccode\u003eusername\u003c/code\u003e and \u003ccode\u003etoken\u003c/code\u003e. I attempted to query this (essentially dumping the database). Great success!\u003c/p\u003e\n\u003cfigure\u003e\u003cimg src=\"/images/devme_6.webp\" width=\"850\"\u003e\u003cfigcaption\u003e\n\t\t\t\u003ch4\u003eFigure 6: User info dump\u003c/h4\u003e\n\t\t\u003c/figcaption\u003e\n\u003c/figure\u003e\n\n\u003cp\u003eWe now have a dump of the user database and can use the \u003ccode\u003eadmin\u003c/code\u003e token to query the \u003ccode\u003eflag\u003c/code\u003e field for the flag!\u003c/p\u003e\n\u003cfigure\u003e\u003cimg src=\"/images/devme_8.webp\" width=\"850\"\u003e\n\u003c/figure\u003e\n\n",
        "language": "en"
    },
    {
        "title" : "GuidePoint Security CTF - August 2021",
        "date_published" : "2021-08-20T00:00:00Z",
        "date_modified" : "2021-08-20T00:00:00Z",
        "id" : "https://incidentalinfosec.com/posts/guidepoint-security-ctf-august-2021/",
        "url" : "https://incidentalinfosec.com/posts/guidepoint-security-ctf-august-2021/",
        "summary": "It\u0026rsquo;s been a while since I had a chance to sit down and tackle a CTF. Lucky for me, GuidePoint Security recently ran their August iteration and it gave me a chance to brush off some cobwebs! I wasn\u0026rsquo;t able to solve all the challenges (damn you Python!) but had a pretty good idea on how to approach most of \u0026rsquo;em. Below are some write-ups on ones that I had fun trying to solve.\n",
        "content_html" : "\u003cp\u003eIt\u0026rsquo;s been a while since I had a chance to sit down and tackle a CTF. Lucky for me, GuidePoint Security recently ran their \u003ca href=\"https://www.guidepointsecurity.com/resources/guidepoint-security-capture-the-flag-august-10/\" target=\"_blank\" rel=\"noopener noreferrer\"\u003eAugust iteration\u003c/a\u003e and it gave me a chance to brush off some cobwebs! I wasn\u0026rsquo;t able to solve all the challenges (damn you Python!) but had a pretty good idea on how to approach most of \u0026rsquo;em. Below are some write-ups on ones that I had fun trying to solve.\u003c/p\u003e\n\u003ch2 id=\"twisting-sea\" class=\"headerLink\"\u003e\r\n    \u003ca href=\"#twisting-sea\" class=\"header-mark\"\u003e\u003c/a\u003eTwisting seA\u003c/h2\u003e\u003cp\u003eFor this Crypto challenge we were given a block of what appeared to be hex code.\u003c/p\u003e\n\u003cdiv class=\"code-block highlight is-open show-line-numbers  tw:group tw:my-2\"\u003e\r\n  \u003cdiv class=\"\r\n    \r\n    tw:flex \r\n    tw:flex-row\r\n    tw:flex-1 \r\n    tw:justify-between \r\n    tw:w-full tw:bg-bgColor-secondary\r\n    \"\u003e      \r\n    \u003cbutton \r\n      class=\"\r\n        code-block-button\r\n        tw:mx-2 \r\n        tw:flex\r\n        tw:flex-row\r\n        tw:flex-1\"\r\n      aria-hidden=\"true\"\u003e\r\n          \u003cspan class=\"tw:group-[.is-open]:rotate-90 tw:transition-[transform] tw:duration-500 tw:ease-in-out tw:print:hidden! tw:w-min tw:h-min tw:my-1 tw:mx-1\"\u003e\u003csvg class=\"icon\"\n    xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 320 512\"\u003e\u003c!-- Font Awesome Free 5.15.4 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) --\u003e\u003cpath d=\"M285.476 272.971L91.132 467.314c-9.373 9.373-24.569 9.373-33.941 0l-22.667-22.667c-9.357-9.357-9.375-24.522-.04-33.901L188.505 256 34.484 101.255c-9.335-9.379-9.317-24.544.04-33.901l22.667-22.667c9.373-9.373 24.569-9.373 33.941 0L285.475 239.03c9.373 9.372 9.373 24.568.001 33.941z\"/\u003e\u003c/svg\u003e\u003c/span\u003e\r\n          \u003cspan class=\"tw:select-none tw:my-1! tw:block\"\u003etext\u003c/span\u003e\r\n      \u003c/button\u003e\r\n\r\n   \u003cdiv class=\"tw:flex\"\u003e\r\n      \u003cbutton \r\n        class=\"\r\n          line-number-button\r\n          tw:mx-2 \r\n          tw:hidden \r\n          tw:group-[.is-open]:block \r\n          tw:group-[.show-line-numbers]:text-fgColor-link \r\n          tw:print:hidden!\" \r\n        title=\"Toggle line numbers\"\u003e\u003csvg class=\"icon\"\n    xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 512 512\"\u003e\u003c!-- Font Awesome Free 5.15.4 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) --\u003e\u003cpath d=\"M61.77 401l17.5-20.15a19.92 19.92 0 0 0 5.07-14.19v-3.31C84.34 356 80.5 352 73 352H16a8 8 0 0 0-8 8v16a8 8 0 0 0 8 8h22.83a157.41 157.41 0 0 0-11 12.31l-5.61 7c-4 5.07-5.25 10.13-2.8 14.88l1.05 1.93c3 5.76 6.29 7.88 12.25 7.88h4.73c10.33 0 15.94 2.44 15.94 9.09 0 4.72-4.2 8.22-14.36 8.22a41.54 41.54 0 0 1-15.47-3.12c-6.49-3.88-11.74-3.5-15.6 3.12l-5.59 9.31c-3.72 6.13-3.19 11.72 2.63 15.94 7.71 4.69 20.38 9.44 37 9.44 34.16 0 48.5-22.75 48.5-44.12-.03-14.38-9.12-29.76-28.73-34.88zM496 224H176a16 16 0 0 0-16 16v32a16 16 0 0 0 16 16h320a16 16 0 0 0 16-16v-32a16 16 0 0 0-16-16zm0-160H176a16 16 0 0 0-16 16v32a16 16 0 0 0 16 16h320a16 16 0 0 0 16-16V80a16 16 0 0 0-16-16zm0 320H176a16 16 0 0 0-16 16v32a16 16 0 0 0 16 16h320a16 16 0 0 0 16-16v-32a16 16 0 0 0-16-16zM16 160h64a8 8 0 0 0 8-8v-16a8 8 0 0 0-8-8H64V40a8 8 0 0 0-8-8H32a8 8 0 0 0-7.14 4.42l-8 16A8 8 0 0 0 24 64h8v64H16a8 8 0 0 0-8 8v16a8 8 0 0 0 8 8zm-3.91 160H80a8 8 0 0 0 8-8v-16a8 8 0 0 0-8-8H41.32c3.29-10.29 48.34-18.68 48.34-56.44 0-29.06-25-39.56-44.47-39.56-21.36 0-33.8 10-40.46 18.75-4.37 5.59-3 10.84 2.8 15.37l8.58 6.88c5.61 4.56 11 2.47 16.12-2.44a13.44 13.44 0 0 1 9.46-3.84c3.33 0 9.28 1.56 9.28 8.75C51 248.19 0 257.31 0 304.59v4C0 316 5.08 320 12.09 320z\"/\u003e\u003c/svg\u003e\u003c/button\u003e\r\n\r\n      \u003cbutton \r\n        class=\"\r\n          wrap-code-button\r\n          tw:select-none \r\n          tw:mx-2 \r\n          tw:hidden \r\n          tw:group-[.is-open]:block \r\n          tw:group-[.is-wrap]:text-fgColor-link \r\n          tw:print:hidden!\" \r\n        title=\"Toggle code wrap\"\u003e\u003csvg class=\"icon\"\n    xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 448 512\"\u003e\u003c!-- Font Awesome Free 5.15.4 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) --\u003e\u003cpath d=\"M16 132h416c8.837 0 16-7.163 16-16V76c0-8.837-7.163-16-16-16H16C7.163 60 0 67.163 0 76v40c0 8.837 7.163 16 16 16zm0 160h416c8.837 0 16-7.163 16-16v-40c0-8.837-7.163-16-16-16H16c-8.837 0-16 7.163-16 16v40c0 8.837 7.163 16 16 16zm0 160h416c8.837 0 16-7.163 16-16v-40c0-8.837-7.163-16-16-16H16c-8.837 0-16 7.163-16 16v40c0 8.837 7.163 16 16 16z\"/\u003e\u003c/svg\u003e\u003c/button\u003e\r\n      \r\n      \u003cbutton \r\n        class=\"\r\n          copy-code-button\r\n          tw:select-none\r\n          tw:mx-2 \r\n          tw:hidden\r\n          tw:group-[.is-open]:block\r\n          tw:hover:text-fgColor-link \r\n          tw:print:hidden!\"\r\n        title=\"Copy code\"\u003e\r\n          \u003cspan class=\"copy-icon tw:block\"\u003e\u003csvg class=\"icon\"\n    xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 448 512\"\u003e\u003c!-- Font Awesome Free 5.15.4 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) --\u003e\u003cpath d=\"M433.941 65.941l-51.882-51.882A48 48 0 0 0 348.118 0H176c-26.51 0-48 21.49-48 48v48H48c-26.51 0-48 21.49-48 48v320c0 26.51 21.49 48 48 48h224c26.51 0 48-21.49 48-48v-48h80c26.51 0 48-21.49 48-48V99.882a48 48 0 0 0-14.059-33.941zM266 464H54a6 6 0 0 1-6-6V150a6 6 0 0 1 6-6h74v224c0 26.51 21.49 48 48 48h96v42a6 6 0 0 1-6 6zm128-96H182a6 6 0 0 1-6-6V54a6 6 0 0 1 6-6h106v88c0 13.255 10.745 24 24 24h88v202a6 6 0 0 1-6 6zm6-256h-64V48h9.632c1.591 0 3.117.632 4.243 1.757l48.368 48.368a6 6 0 0 1 1.757 4.243V112z\"/\u003e\u003c/svg\u003e\u003c/span\u003e\r\n          \u003cspan class=\"check-icon tw:hidden\"\u003e\u003csvg class=\"icon\"\n    xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 512 512\"\u003e\u003c!-- Font Awesome Free 5.15.4 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) --\u003e\u003cpath d=\"M173.898 439.404l-166.4-166.4c-9.997-9.997-9.997-26.206 0-36.204l36.203-36.204c9.997-9.998 26.207-9.998 36.204 0L192 312.69 432.095 72.596c9.997-9.997 26.207-9.997 36.204 0l36.203 36.204c9.997 9.997 9.997 26.206 0 36.204l-294.4 294.401c-9.998 9.997-26.207 9.997-36.204-.001z\"/\u003e\u003c/svg\u003e\u003c/span\u003e\r\n      \u003c/button\u003e\r\n        \r\n      \u003cbutton \r\n        class=\"\r\n          tw:select-none \r\n          tw:mx-2 \r\n          tw:block \r\n          tw:group-[.is-open]:hidden \r\n          tw:print:hidden!\" \r\n        disabled\r\n        aria-hidden=\"true\"\u003e\u003csvg class=\"icon\"\n    xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 512 512\"\u003e\u003c!-- Font Awesome Free 5.15.4 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) --\u003e\u003cpath d=\"M328 256c0 39.8-32.2 72-72 72s-72-32.2-72-72 32.2-72 72-72 72 32.2 72 72zm104-72c-39.8 0-72 32.2-72 72s32.2 72 72 72 72-32.2 72-72-32.2-72-72-72zm-352 0c-39.8 0-72 32.2-72 72s32.2 72 72 72 72-32.2 72-72-32.2-72-72-72z\"/\u003e\u003c/svg\u003e\u003c/button\u003e\r\n    \u003c/div\u003e\r\n  \u003c/div\u003e\r\n  \u003cpre style=\"counter-reset: codeblock;\" class=\"tw:block tw:m-0 tw:p-0\"\u003e\u003ccode \r\n    id=\"codeblock-id-1\" \r\n    class=\"\r\n      chroma \r\n      tw:block! \r\n      tw:p-0\r\n      tw:m-0\r\n      tw:transition-[max-height] \r\n      tw:duration-500 \r\n      tw:ease-in-out \r\n      tw:group-[.is-closed]:max-h-0! \r\n      tw:group-[.is-wrap]:text-wrap\r\n      tw:overflow-y-hidden\r\n      tw:overflow-x-auto\r\n      tw:scrollbar-thin\r\n      \"\u003e\u003cspan class=\"line\"\u003e\u003cspan class=\"cl\"\u003e4d6a41354d57466b4d7a5a6b4d7a5978597a67345a44566a4d7a49774d6d557a4e6d51354e7a56684d4455304e5455314e3249304e54426b4e575a6b59575a684d575\n\u003c/span\u003e\u003c/span\u003e\u003cspan class=\"line\"\u003e\u003cspan class=\"cl\"\u003e1324d6a41334f575978596a59324f444e684d6d5131593256684e6a646c5a6a41345a544d79595464684d5455345a54566a5a47517a4f4451344e544e6b4947733959\n\u003c/span\u003e\u003c/span\u003e\u003cspan class=\"line\"\u003e\u003cspan class=\"cl\"\u003e325a6b597a41785a546b305a6d51334d6a67784f5445314f54677a4d474e6c4f4455335a6d4d784f5441676154307859546c6b5a5759354f4456684d7a4d794e7a593\n\u003c/span\u003e\u003c/span\u003e\u003cspan class=\"line\"\u003e\u003cspan class=\"cl\"\u003e24d544a694e5449784e6d49325932597a5a44466c4f413d3d\u003c/span\u003e\u003c/span\u003e\u003c/code\u003e\u003c/pre\u003e\r\n\u003c/div\u003e\r\n\u003cp\u003eLike in many other challenges, starting with \u003ca href=\"https://gchq.github.io/CyberChef/\" target=\"_blank\" rel=\"noopener noreferrer\"\u003eCyberChef\u003c/a\u003e can be a good first route when dealing with data formatting. Sure enough, if we transform the text \u0026ldquo;From Hex\u0026rdquo; we get a Base64 string that we can decode with CyberChef as well. This leaves us with the following.\u003c/p\u003e\n\u003cfigure\u003e\u003cimg src=\"/images/twistingseA_1.webp\" width=\"800\"\u003e\u003cfigcaption\u003e\n\t\t\t\u003ch4\u003eFigure 1: CyberChef Hex decode\u003c/h4\u003e\n\t\t\u003c/figcaption\u003e\n\u003c/figure\u003e\n\n\u003cp\u003eHmm, we see a \u003ccode\u003ek\u003c/code\u003e and an \u003ccode\u003ei\u003c/code\u003e variable. Being that this is a crypto challenge, maybe this is a key and an initialization vector? A quick search on Google for encryption algorithms that use keys and initialization vectors brings up block ciphers. One of the most common encryption methods out there, AES, is a block cipher. What\u0026rsquo;s more is that the name of this challenge actually has AES in it (just backwards). Let\u0026rsquo;s see if CyberChef can help us out again with its decryption recipe.\u003c/p\u003e\n\u003cfigure\u003e\u003cimg src=\"/images/twistingseA_2.webp\" width=\"700\"\u003e\u003cfigcaption\u003e\n\t\t\t\u003ch4\u003eFigure 2: CyberChef AES decrypt\u003c/h4\u003e\n\t\t\u003c/figcaption\u003e\n\u003c/figure\u003e\n\n\u003cp\u003eWell, we provided all the correct information in the recipe but the output string we receive isn\u0026rsquo;t in the flag format. It looks close, but no cigar. What if we change the data format on the \u003ccode\u003ek\u003c/code\u003e or \u003ccode\u003ei\u003c/code\u003e variables?\u003c/p\u003e\n\u003cfigure\u003e\u003cimg src=\"/images/twistingseA_3.webp\" width=\"700\"\u003e\u003cfigcaption\u003e\n\t\t\t\u003ch4\u003eFigure 3: CyberChef AES decrypt\u003c/h4\u003e\n\t\t\u003c/figcaption\u003e\n\u003c/figure\u003e\n\n\u003cp\u003eBingo! The initialization vector was in regular UTF8 encoding and not in hex. We can submit this flag and claim our points!\u003c/p\u003e\n\u003chr\u003e\n\u003ch2 id=\"sharkfail\" class=\"headerLink\"\u003e\r\n    \u003ca href=\"#sharkfail\" class=\"header-mark\"\u003e\u003c/a\u003eSharkfail\u003c/h2\u003e\u003cp\u003eIn this challenge, we\u0026rsquo;re provided a PCAP file named sharkfail.pcapng. I smell a forensics problem!\u003c/p\u003e\n\u003cp\u003eAs we load up Wireshark to start taking a peak at things, we\u0026rsquo;re prompted with an error message about a potentially corrupt capture file. Interesting\u0026hellip;let\u0026rsquo;s keep digging.\u003c/p\u003e\n\u003cfigure\u003e\u003cimg src=\"/images/sharkfail_1.webp\" width=\"400\"\u003e\u003cfigcaption\u003e\n\t\t\t\u003ch4\u003eFigure 4: Corrupted PCAP\u003c/h4\u003e\n\t\t\u003c/figcaption\u003e\n\u003c/figure\u003e\n\n\u003cp\u003eOne thing I like to do with PCAP challenges is to look at the protocol distributions within the capture. This can be done through Statistics -\u0026gt; Protocol Hierarchy. We see that most the communication in this capture takes place over USB. Nice, we likely have some data transfer occurring.\u003c/p\u003e\n\u003cfigure\u003e\u003cimg src=\"/images/sharkfail_2.webp\" width=\"700\"\u003e\u003cfigcaption\u003e\n\t\t\t\u003ch4\u003eFigure 5: Protocol Hierarchy\u003c/h4\u003e\n\t\t\u003c/figcaption\u003e\n\u003c/figure\u003e\n\n\u003cp\u003eIf we do a bit of Googling on which fields / areas in Wireshark to look for with USB forensics, we stumble upon the field \u003ccode\u003eusb.capdata\u003c/code\u003e. If we apply this as a filter in Wireshark, we can observe a ton of \u0026ldquo;URB_BULK in\u0026rdquo; events that have occurred. There\u0026rsquo;s a good chance our flag is probably somewhere in these data transfer events.\u003c/p\u003e\n\u003cfigure\u003e\u003cimg src=\"/images/sharkfail_3.webp\" width=\"1000\"\u003e\u003cfigcaption\u003e\n\t\t\t\u003ch4\u003eFigure 6: Wireshark usb.capdata\u003c/h4\u003e\n\t\t\u003c/figcaption\u003e\n\u003c/figure\u003e\n\n\u003cp\u003eAt this point, I said to myself, \u0026ldquo;How can we get this data out of Wireshark to decode and perform further analysis?\u0026rdquo;. Unfortunately, after much trial and error, I learned that Wireshark doesn\u0026rsquo;t appear to support the exporting of USB data objects (or at least I couldn\u0026rsquo;t find a way\u0026hellip;). Well shucks\u0026hellip;.where to next? How about Wireshark\u0026rsquo;s GUI-less brother \u003ccode\u003etshark\u003c/code\u003e?\u003c/p\u003e\n\u003cp\u003eSimilar to Wireshark, filters can be applied when searching through capture traffic. We can take the output of \u003ccode\u003eusb.capdata\u003c/code\u003e events and attempt to replicate what Wireshark was showing us earlier. The tool \u003ccode\u003exxd\u003c/code\u003e is our friend here.\u003c/p\u003e\n\u003cdiv class=\"code-block highlight is-open show-line-numbers  tw:group tw:my-2\"\u003e\r\n  \u003cdiv class=\"\r\n    \r\n    tw:flex \r\n    tw:flex-row\r\n    tw:flex-1 \r\n    tw:justify-between \r\n    tw:w-full tw:bg-bgColor-secondary\r\n    \"\u003e      \r\n    \u003cbutton \r\n      class=\"\r\n        code-block-button\r\n        tw:mx-2 \r\n        tw:flex\r\n        tw:flex-row\r\n        tw:flex-1\"\r\n      aria-hidden=\"true\"\u003e\r\n          \u003cspan class=\"tw:group-[.is-open]:rotate-90 tw:transition-[transform] tw:duration-500 tw:ease-in-out tw:print:hidden! tw:w-min tw:h-min tw:my-1 tw:mx-1\"\u003e\u003csvg class=\"icon\"\n    xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 320 512\"\u003e\u003c!-- Font Awesome Free 5.15.4 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) --\u003e\u003cpath d=\"M285.476 272.971L91.132 467.314c-9.373 9.373-24.569 9.373-33.941 0l-22.667-22.667c-9.357-9.357-9.375-24.522-.04-33.901L188.505 256 34.484 101.255c-9.335-9.379-9.317-24.544.04-33.901l22.667-22.667c9.373-9.373 24.569-9.373 33.941 0L285.475 239.03c9.373 9.372 9.373 24.568.001 33.941z\"/\u003e\u003c/svg\u003e\u003c/span\u003e\r\n          \u003cspan class=\"tw:select-none tw:my-1! tw:block\"\u003ebash\u003c/span\u003e\r\n      \u003c/button\u003e\r\n\r\n   \u003cdiv class=\"tw:flex\"\u003e\r\n      \u003cbutton \r\n        class=\"\r\n          line-number-button\r\n          tw:mx-2 \r\n          tw:hidden \r\n          tw:group-[.is-open]:block \r\n          tw:group-[.show-line-numbers]:text-fgColor-link \r\n          tw:print:hidden!\" \r\n        title=\"Toggle line numbers\"\u003e\u003csvg class=\"icon\"\n    xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 512 512\"\u003e\u003c!-- Font Awesome Free 5.15.4 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) --\u003e\u003cpath d=\"M61.77 401l17.5-20.15a19.92 19.92 0 0 0 5.07-14.19v-3.31C84.34 356 80.5 352 73 352H16a8 8 0 0 0-8 8v16a8 8 0 0 0 8 8h22.83a157.41 157.41 0 0 0-11 12.31l-5.61 7c-4 5.07-5.25 10.13-2.8 14.88l1.05 1.93c3 5.76 6.29 7.88 12.25 7.88h4.73c10.33 0 15.94 2.44 15.94 9.09 0 4.72-4.2 8.22-14.36 8.22a41.54 41.54 0 0 1-15.47-3.12c-6.49-3.88-11.74-3.5-15.6 3.12l-5.59 9.31c-3.72 6.13-3.19 11.72 2.63 15.94 7.71 4.69 20.38 9.44 37 9.44 34.16 0 48.5-22.75 48.5-44.12-.03-14.38-9.12-29.76-28.73-34.88zM496 224H176a16 16 0 0 0-16 16v32a16 16 0 0 0 16 16h320a16 16 0 0 0 16-16v-32a16 16 0 0 0-16-16zm0-160H176a16 16 0 0 0-16 16v32a16 16 0 0 0 16 16h320a16 16 0 0 0 16-16V80a16 16 0 0 0-16-16zm0 320H176a16 16 0 0 0-16 16v32a16 16 0 0 0 16 16h320a16 16 0 0 0 16-16v-32a16 16 0 0 0-16-16zM16 160h64a8 8 0 0 0 8-8v-16a8 8 0 0 0-8-8H64V40a8 8 0 0 0-8-8H32a8 8 0 0 0-7.14 4.42l-8 16A8 8 0 0 0 24 64h8v64H16a8 8 0 0 0-8 8v16a8 8 0 0 0 8 8zm-3.91 160H80a8 8 0 0 0 8-8v-16a8 8 0 0 0-8-8H41.32c3.29-10.29 48.34-18.68 48.34-56.44 0-29.06-25-39.56-44.47-39.56-21.36 0-33.8 10-40.46 18.75-4.37 5.59-3 10.84 2.8 15.37l8.58 6.88c5.61 4.56 11 2.47 16.12-2.44a13.44 13.44 0 0 1 9.46-3.84c3.33 0 9.28 1.56 9.28 8.75C51 248.19 0 257.31 0 304.59v4C0 316 5.08 320 12.09 320z\"/\u003e\u003c/svg\u003e\u003c/button\u003e\r\n\r\n      \u003cbutton \r\n        class=\"\r\n          wrap-code-button\r\n          tw:select-none \r\n          tw:mx-2 \r\n          tw:hidden \r\n          tw:group-[.is-open]:block \r\n          tw:group-[.is-wrap]:text-fgColor-link \r\n          tw:print:hidden!\" \r\n        title=\"Toggle code wrap\"\u003e\u003csvg class=\"icon\"\n    xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 448 512\"\u003e\u003c!-- Font Awesome Free 5.15.4 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) --\u003e\u003cpath d=\"M16 132h416c8.837 0 16-7.163 16-16V76c0-8.837-7.163-16-16-16H16C7.163 60 0 67.163 0 76v40c0 8.837 7.163 16 16 16zm0 160h416c8.837 0 16-7.163 16-16v-40c0-8.837-7.163-16-16-16H16c-8.837 0-16 7.163-16 16v40c0 8.837 7.163 16 16 16zm0 160h416c8.837 0 16-7.163 16-16v-40c0-8.837-7.163-16-16-16H16c-8.837 0-16 7.163-16 16v40c0 8.837 7.163 16 16 16z\"/\u003e\u003c/svg\u003e\u003c/button\u003e\r\n      \r\n      \u003cbutton \r\n        class=\"\r\n          copy-code-button\r\n          tw:select-none\r\n          tw:mx-2 \r\n          tw:hidden\r\n          tw:group-[.is-open]:block\r\n          tw:hover:text-fgColor-link \r\n          tw:print:hidden!\"\r\n        title=\"Copy code\"\u003e\r\n          \u003cspan class=\"copy-icon tw:block\"\u003e\u003csvg class=\"icon\"\n    xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 448 512\"\u003e\u003c!-- Font Awesome Free 5.15.4 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) --\u003e\u003cpath d=\"M433.941 65.941l-51.882-51.882A48 48 0 0 0 348.118 0H176c-26.51 0-48 21.49-48 48v48H48c-26.51 0-48 21.49-48 48v320c0 26.51 21.49 48 48 48h224c26.51 0 48-21.49 48-48v-48h80c26.51 0 48-21.49 48-48V99.882a48 48 0 0 0-14.059-33.941zM266 464H54a6 6 0 0 1-6-6V150a6 6 0 0 1 6-6h74v224c0 26.51 21.49 48 48 48h96v42a6 6 0 0 1-6 6zm128-96H182a6 6 0 0 1-6-6V54a6 6 0 0 1 6-6h106v88c0 13.255 10.745 24 24 24h88v202a6 6 0 0 1-6 6zm6-256h-64V48h9.632c1.591 0 3.117.632 4.243 1.757l48.368 48.368a6 6 0 0 1 1.757 4.243V112z\"/\u003e\u003c/svg\u003e\u003c/span\u003e\r\n          \u003cspan class=\"check-icon tw:hidden\"\u003e\u003csvg class=\"icon\"\n    xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 512 512\"\u003e\u003c!-- Font Awesome Free 5.15.4 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) --\u003e\u003cpath d=\"M173.898 439.404l-166.4-166.4c-9.997-9.997-9.997-26.206 0-36.204l36.203-36.204c9.997-9.998 26.207-9.998 36.204 0L192 312.69 432.095 72.596c9.997-9.997 26.207-9.997 36.204 0l36.203 36.204c9.997 9.997 9.997 26.206 0 36.204l-294.4 294.401c-9.998 9.997-26.207 9.997-36.204-.001z\"/\u003e\u003c/svg\u003e\u003c/span\u003e\r\n      \u003c/button\u003e\r\n        \r\n      \u003cbutton \r\n        class=\"\r\n          tw:select-none \r\n          tw:mx-2 \r\n          tw:block \r\n          tw:group-[.is-open]:hidden \r\n          tw:print:hidden!\" \r\n        disabled\r\n        aria-hidden=\"true\"\u003e\u003csvg class=\"icon\"\n    xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 512 512\"\u003e\u003c!-- Font Awesome Free 5.15.4 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) --\u003e\u003cpath d=\"M328 256c0 39.8-32.2 72-72 72s-72-32.2-72-72 32.2-72 72-72 72 32.2 72 72zm104-72c-39.8 0-72 32.2-72 72s32.2 72 72 72 72-32.2 72-72-32.2-72-72-72zm-352 0c-39.8 0-72 32.2-72 72s32.2 72 72 72 72-32.2 72-72-32.2-72-72-72z\"/\u003e\u003c/svg\u003e\u003c/button\u003e\r\n    \u003c/div\u003e\r\n  \u003c/div\u003e\r\n  \u003cpre style=\"counter-reset: codeblock;\" class=\"tw:block tw:m-0 tw:p-0\"\u003e\u003ccode \r\n    id=\"codeblock-id-2\" \r\n    class=\"\r\n      chroma \r\n      tw:block! \r\n      tw:p-0\r\n      tw:m-0\r\n      tw:transition-[max-height] \r\n      tw:duration-500 \r\n      tw:ease-in-out \r\n      tw:group-[.is-closed]:max-h-0! \r\n      tw:group-[.is-wrap]:text-wrap\r\n      tw:overflow-y-hidden\r\n      tw:overflow-x-auto\r\n      tw:scrollbar-thin\r\n      \"\u003e\u003cspan class=\"line\"\u003e\u003cspan class=\"cl\"\u003etshark -r sharkfail.pcapng -T fields -e usb.capdata -Y usb.capdata \u003cspan class=\"p\"\u003e|\u003c/span\u003e xxd -r -p \u003cspan class=\"p\"\u003e|\u003c/span\u003e xxd \u0026gt; decoded.raw\u003c/span\u003e\u003c/span\u003e\u003c/code\u003e\u003c/pre\u003e\r\n\u003c/div\u003e\r\n\u003cp\u003eThis gives a raw hex dump file, \u003ccode\u003edecoded.raw\u003c/code\u003e, that we can dig into further. What we start to notice here is that there are a handful of human-readable characters showing throughout the hex dump.\u003c/p\u003e\n\u003cfigure\u003e\u003cimg src=\"/images/sharkfail_4.webp\" width=\"550\"\u003e\u003cfigcaption\u003e\n\t\t\t\u003ch4\u003eFigure 7: usb.capdata hex dump\u003c/h4\u003e\n\t\t\u003c/figcaption\u003e\n\u003c/figure\u003e\n\n\u003cp\u003eThis is where things got tricky for me. No matter what I tried, I could not seem to figure out anything relating to a flag within this data. During other CTF\u0026rsquo;s, once I\u0026rsquo;ve gotten to the point of dealing with a hex dump from a capture, it\u0026rsquo;s typically time to start file carving. Finding corrupted or mismatched file headers in the hex dump, attempting to rebuild files from scratch, or looking further at patterns in the hex data itself would be smart directions to turn\u0026hellip;but I\u0026rsquo;m not smart.\u003c/p\u003e\n\u003cp\u003eIt was getting late and I was feeling defeated\u0026hellip;I decided to throw everything but the kitchen sink at the hex file as well as the original PCAP. That\u0026rsquo;s when it happened\u0026hellip;\u003c/p\u003e\n\u003cfigure\u003e\u003cimg src=\"/images/sharkfail_5.webp\" width=\"600\"\u003e\u003cfigcaption\u003e\n\t\t\t\u003ch4\u003eFigure 8: Strings of PCAP\u003c/h4\u003e\n\t\t\u003c/figcaption\u003e\n\u003c/figure\u003e\n\n\u003cp\u003eWhen in doubt, \u003ccode\u003estrings\u003c/code\u003e it out! This group of characters at the top appeared unique within the file and looked like it was in a familiar data format. Sure enough if we decode the characters from base 64, we have our flag.\u003c/p\u003e\n\u003cfigure\u003e\u003cimg src=\"/images/sharkfail_6.webp\" width=\"1000\"\u003e\u003cfigcaption\u003e\n\t\t\t\u003ch4\u003eFigure 9: Base64 Decode\u003c/h4\u003e\n\t\t\u003c/figcaption\u003e\n\u003c/figure\u003e\n\n\u003cp\u003eI definitely don\u0026rsquo;t think I solved this challenge as it was intended and I imagine the .pcapng file being corrupted likely had something to do with things but hey, I\u0026rsquo;ll take what I can get!\u003c/p\u003e\n\u003chr\u003e\n\u003cp\u003eShout out to \u003ca href=\"https://twitter.com/offsec_ginger\" target=\"_blank\" rel=\"noopener noreferrer\"\u003eAlex Williams\u003c/a\u003e and \u003ca href=\"https://www.guidepointsecurity.com\" target=\"_blank\" rel=\"noopener noreferrer\"\u003eGuidePoint Security\u003c/a\u003e for putting on a great event. I\u0026rsquo;m looking forward to the next one!\u003c/p\u003e\n",
        "language": "en"
    },
    {
        "title" : "SOC work. A walk through the trenches. [Part 1]",
        "date_published" : "2021-08-08T00:00:00Z",
        "date_modified" : "2021-08-08T00:00:00Z",
        "id" : "https://incidentalinfosec.com/posts/soc-work-a-walk-through-the-trenches-part-1/",
        "url" : "https://incidentalinfosec.com/posts/soc-work-a-walk-through-the-trenches-part-1/",
        "summary": "It\u0026rsquo;s no secret that working in a Security Operations Center (SOC) can be a demanding, thankless, and tough job (with it only getting tougher). This is especially true for folks just getting started in the industry who are building the foundational skills required for career progression. Working long hours, weekends, holidays\u0026hellip;this is the side of cyber they don\u0026rsquo;t tell you about\u0026hellip; If you\u0026rsquo;re not prepared for it, you might start asking yourself \u0026ldquo;What the hell did I just get myself into?\u0026rdquo;. I know I did\u0026hellip;\n",
        "content_html" : "\u003cp\u003eIt\u0026rsquo;s no secret that working in a Security Operations Center (SOC) can be a demanding, thankless, and tough job (with it only getting tougher). This is especially true for folks just getting started in the industry who are building the foundational skills required for career progression. Working long hours, weekends, holidays\u0026hellip;this is the side of cyber they don\u0026rsquo;t tell you about\u0026hellip; If you\u0026rsquo;re not prepared for it, you might start asking yourself \u0026ldquo;What the hell did I just get myself into?\u0026rdquo;. I know I did\u0026hellip;\u003c/p\u003e\n\u003cp\u003eOver the last several years, I\u0026rsquo;ve somehow managed to convince my peers enough that I know what I\u0026rsquo;m doing. This has granted me the opportunity to hold a handful of positions either operating in or working closely with SOC teams. I hope through these blog posts I can shed some light on the lessons that I\u0026rsquo;ve learned working on the front lines. If nothing else, if I can encourage any beat-up, stressed-out, and just plain tired folks in the industry to keep up the good fight, then this series will have been a success.\u003c/p\u003e\n\u003ch2 id=\"in-the-beginning\" class=\"headerLink\"\u003e\r\n    \u003ca href=\"#in-the-beginning\" class=\"header-mark\"\u003e\u003c/a\u003eIn the beginning\u003c/h2\u003e\u003cp\u003eStarting in 2015, I began my voyage trying to break into the InfoSec field as naive college student eager to find my first gig. I had somehow managed to snag an internship earlier in the year working at a cybersecurity start-up that specialized in consulting. You know\u0026hellip;what could be better than having the new intern bang on keyboards inside million dollar customer networks?\u003c/p\u003e\n\u003cfigure\u003e\u003cimg src=\"/images/no_idea_dog.webp\" width=\"400\"\u003e\n\u003c/figure\u003e\n\n\u003cp\u003eOkay, okay\u0026hellip;it wasn\u0026rsquo;t that glamorous. Honestly, the typical day for me could be summarized as:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eGoogling. Lots and lots of Googling. (This hasn\u0026rsquo;t changed)\u003c/li\u003e\n\u003cli\u003eReading and learning a ton about security vendors, products, you name it from blogs.\u003c/li\u003e\n\u003cli\u003eSpending 30 minutes trying to wrangle an unwieldy corporate VMware environment.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eI guess I did something right because shortly after I managed to get hired on as an entry-level SOC analyst within the same company. I was feeling pumped! All my hard work and hundreds of hours spent learning security finally felt worth it. I saved no time diving head first into the role and learning all that I could about Splunk and incident response. I was like a kid in a candy store with all the new tools and technologies I was being exposed to. There was just one problem\u0026hellip; Our small start-up SOC had become inundated with a ton of security alerts to review.\u003c/p\u003e\n\u003cfigure\u003e\u003cimg src=\"/images/fp_overload.webp\" width=\"300\"\u003e\n\u003c/figure\u003e\n\n\u003ch2 id=\"rough-waters\" class=\"headerLink\"\u003e\r\n    \u003ca href=\"#rough-waters\" class=\"header-mark\"\u003e\u003c/a\u003eRough waters\u003c/h2\u003e\u003cp\u003eIf there\u0026rsquo;s one thing that can kill a SOC team\u0026rsquo;s motivation and drive to learn, it\u0026rsquo;s event overload and triaging the same noisy alerts day in, day out. Sounds like the definition of insanity, doesn\u0026rsquo;t it? This quickly becomes a slippery slope with the unfortunate part being that it\u0026rsquo;s not a unique problem affecting a few organizations here and there\u0026hellip;it impacts a large majority of companies.\u003c/p\u003e\n\u003cp\u003eSo what happens if false positive alert fatigue is not solved early? In my experience, nothing good.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eCareer growth and progression is stunted.\u003c/li\u003e\n\u003cli\u003eAdditional stress is added onto an already stressful position (more on this in the next post).\u003c/li\u003e\n\u003cli\u003eAn increased probability that actual security incidents won\u0026rsquo;t be properly detected.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eAlert management itself effectively becomes a game within the game for SOC teams. But there has to be a way of solving this right? Right? Well, this can be a tough cookie to crack. In my opinion, a number of things need to happen to move things in the right direction.\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003eHave a desire to be lazy\u003c/strong\u003e - The adage of \u0026ldquo;if you have to do something more than once, script it out\u0026rdquo; couldn\u0026rsquo;t be more true in information security and IT in general. It\u0026rsquo;s obviously easier said than done for some cases, however, putting the time in up front goes a long way. Something as small as \u003ca href=\"https://github.com/yeti-platform/yeti\" target=\"_blank\" rel=\"noopener noreferrer\"\u003eautomating IOC enrichment look-ups\u003c/a\u003e with third party tools (VirusTotal, Shodan, etc.) or creating \u003ca href=\"https://docs.aws.amazon.com/whitepapers/latest/aws-security-incident-response-guide/infrastructure-domain-incidents.html\" target=\"_blank\" rel=\"noopener noreferrer\"\u003eAWS Lambda functions\u003c/a\u003e that react to certain events end up saving a ton of time!\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003eActionable, risk-based alerting\u003c/strong\u003e - Only trigger alerts for the SOC that require further action. Many compliance frameworks (cough PCI cough) still to this day require enabling alerts for tasks and behaviors that, for some organizations, happen hundreds of times per day. Elevated Windows security group modifications anyone? This is where \u003ca href=\"https://conf.splunk.com/files/2019/slides/SEC1538.pdf\" target=\"_blank\" rel=\"noopener noreferrer\"\u003erisk-based alerting\u003c/a\u003e can help. In its most basic sense, risk-based alerting could be as simple as only triggering specific alerts for domain admins or high-risk users that are continuously failing simulated phishing tests. In a more complex configuration, risk-based alerting can involve noisy alerts still being configured, however, instead of notifying the SOC, a \u0026ldquo;risk\u0026rdquo; score counter is automatically adjusted for the asset or identity involved. Defenders are then able to monitor for users and systems with increasing risk scores in the environment over time.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003ePrioritize learning and development over alert SLAs\u003c/strong\u003e - This one personally hits home with what I experienced and observed early on in my career. In far too many scenarios (especially in managed security service organizations) I\u0026rsquo;ve observed that alert counts and SLAs become the main focus of the business instead of facilitating learning and development. Why is this? Simple, you can easily quantify alerts and time. It\u0026rsquo;s important for defenders (especially newcomers in the field) to learn the ins and outs of various operating systems. They need to learn the various obfuscation techniques that attackers use to bypass security controls. They need to learn to script and code so that challenging problems can be solved faster. This won\u0026rsquo;t happen when alert ticket queue SLAs control job performance.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ol\u003e\n\u003cp\u003eAs I look back at my first and second years working in the industry on a small SOC team, I am truly grateful for the experience that it offered me. I learned what it meant to work on a team and to utilize the strengths of others to tackle tough challenges. It was one hell of a ride during the early times for sure.\u003c/p\u003e\n\u003cp\u003eStay tuned for Part 2 of this blog series where I\u0026rsquo;ll be diving into the next few years of my cyber adventure and how I began my battle with the beast that is known as job burnout.\u003c/p\u003e\n",
        "language": "en"
    },
    ]
}