type
status
date
slug
summary
tags
category
icon
password
Catagory
Materials
Retired
Due date
Oct 23, 2025 10:20 AM
Status
Belong in
Progress
Khalid has just logged onto a host that he and his team use as a testing host for many different purposes. It’s off their corporate network but has access to lots of resources on the network. The host is used as a dumping ground for a lot of people at the company, but it’s very useful, so no one has raised any issues. Little does Khalid know; the machine has been compromised and company information that should not have been on there has now been stolen – it’s up to you to figure out what has happened and what data has been taken.
224.0.0.251 外部Dns server
192.168.157.2 內部dns server
使用office 365
Task 1
At a glance, what protocol seems to be suspect in this attack?
DNS
Task 2
There seems to be a lot of traffic between our host and another, what is the IP address of the suspect host?
Ans：192.168.157.145
Task 3
What is the first command the attacker sends to the client?
Ans：whoami
Task 4
What is the version of the DNS tunneling tool the attacker is using?
Ans：0.07
Task 5
The attackers attempts to rename the tool they accidentally left on the clients host. What do they name it to?
Ans：win_installer.exe
Task 6
The attacker attempts to enumerate the users cloud storage. How many files do they locate in their cloud storage directory?
Ans：0
Task 7
What is the full location of the PII file that was stolen?
Ans：C:\users\test\documents\client data optimisation\user details.csv
Task 8
Exactly how many customer PII records were stolen?
Ans：721
Reference
- DNS Tunneling
- wireshark display filter cheetsheet
- 作者:ji3g4gp
- 網址:https://gpblog.vercel.app//article/HTB-Sharklocks-Litter
- 著作權聲明:本文使用 CC BY-NC-SA 4.0 著作權許可，使用請標注出處。
相關文章