CyberPlace CTF Challenges & Labs

Uncovering Plaintext Credentials in TCP Streams - A PCAP contains unencrypted authentication. Reconstruct the user credentials from the raw Telnet stream snippet: Plaintext USER admin\r\n 331 Password required for admin.\r\n PASS SDNjM3V0ZSE=\r\n 230 User logged in.\r\n

Consider the following 3 packets (layer 2 and 3), and state which IP/MAC pair specifies the router and local hosts in LAN 192.168.x.x, and which device may be recording?
(1) f8:1a:67:c2:7d:54 -> ff:ff:ff:ff:ff:ff, ARP who has 192.168.1.1, tell 192.168.1.102
(2) 48:d2:24:ef:db:6d -> f8:1a:67:c2:7d:54, ARP is at 192.168.1.1
(3) f8:1a:67:c2:7d:54 -> 48:d2:24:ef:db:6d , IP: 192.168.1.102 -> 162.159.242.165

TCP Forensic Analysis - Analyze the Wireshark packet breakdown below. Identify the forensic anomaly, explain how data is being exfiltrated, and state the specific protocol parameter being abused. [[1 10.0.0.12 198.51.100.44 TCP 74 [ACK] Seq=101 Ack=1 Win=0 Len=16 Payload=53544f4c454e5f44415441],[2 198.51.100.44 10.0.0.12 TCP 60 [TCP ZeroWindowProbeAck] Seq=1 Ack=117 Win=65535 Len=0],[3 10.0.0.12 198.51.100.44 TCP 74 [ACK] Seq=117 Ack=1 Win=0 Len=16 Payload=313233343536373839303132]]