# TShark Challenge II: Directory

## Introduction

This room presents you with a challenge to investigate some traffic data as a part of the SOC team. Let's start working with TShark to analyse the captured traffic. We recommend completing the [TShark: The Basics](https://tryhackme.com/room/tsharkthebasics) [and TShark: CLI W](https://tryhackme.com/room/tsharkthebasics)[ireshark Features](https://tryhackme.com/room/tsharkcliwiresharkfeatures) [rooms first, which will teach](https://tryhackme.com/room/tsharkcliwiresharkfeatures) you how to use the tool in depth. 

## Case: Directory Curiosity!

**An alert has been triggered:** "A user came across a poor file index, and their curiosity led to problems".

The case was assigned to you. Inspect the provided **directory-curiosity.pcap** located in `~/Desktop/exercise-files` and retrieve the artefacts to confirm that this alert is a true positive.

**Your tools:** TShark, [VirusTotal](https://www.virustotal.com/).  

### Answer the questions below

Investigate the DNS queries.  
Investigate the domains by using VirusTotal.  
According to VirusTotal, there is a domain marked as malicious/suspicious.

What is the name of the malicious/suspicious domain?

1. Enter your answer in a **defanged** format. `jx2-bavuong[.]com`
    
    ```bash
    tshark -r ~/Desktop/exercise-files/directory-curiosity.pcap -Y "http.host" -T fields -e http.host | sort -u
    239.255.255.250:1900
    jx2-bavuong.com
    ocsp.digicert.com
    www.bing.com
    ```
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1770381870648/617d347d-078b-4a67-bca4-1132c5af20e8.png align="center")
    
2. What is the total number of HTTP requests sent to the malicious domain? `14`
    
    ```bash
    tshark -r directory-curiosity.pcap -Y "http.host == jx2-bavuong.com" | wc -l
    14
    ```
    
3. What is the IP address associated with the malicious domain?
    
    Enter your answer in a **defanged** format. `141[.]164[.]41[.]174`
    
    ```bash
    tshark -r directory-curiosity.pcap -Y "dns.qry.name == jx2-bavuong.com" -T fields -e dns.a
    
    141.164.41.174
    ```
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1770381812810/be433f0b-bbe0-4f2b-b21e-7507e5f52a4d.png align="center")
    
4. What is the server info of the suspicious domain? `Apache/2.2.11 (Win32) DAV/2 mod_ssl/2.2.11 OpenSSL/0.9.8i PHP/5.2.9`
    
    ```bash
    tshark -r directory-curiosity.pcap -Y "http.server" -T fields -e http.server
    Apache/2.2.11 (Win32) DAV/2 mod_ssl/2.2.11 OpenSSL/0.9.8i PHP/5.2.9
    Apache/2.2.11 (Win32) DAV/2 mod_ssl/2.2.11 OpenSSL/0.9.8i PHP/5.2.9
    Apache/2.2.11 (Win32) DAV/2 mod_ssl/2.2.11 OpenSSL/0.9.8i PHP/5.2.9
    Kestrel
    Apache/2.2.11 (Win32) DAV/2 mod_ssl/2.2.11 OpenSSL/0.9.8i PHP/5.2.9
    Apache/2.2.11 (Win32) DAV/2 mod_ssl/2.2.11 OpenSSL/0.9.8i PHP/5.2.9
    Apache/2.2.11 (Win32) DAV/2 mod_ssl/2.2.11 OpenSSL/0.9.8i PHP/5.2.9
    Apache/2.2.11 (Win32) DAV/2 mod_ssl/2.2.11 OpenSSL/0.9.8i PHP/5.2.9
    Apache/2.2.11 (Win32) DAV/2 mod_ssl/2.2.11 OpenSSL/0.9.8i PHP/5.2.9
    Apache/2.2.11 (Win32) DAV/2 mod_ssl/2.2.11 OpenSSL/0.9.8i PHP/5.2.9
    Apache/2.2.11 (Win32) DAV/2 mod_ssl/2.2.11 OpenSSL/0.9.8i PHP/5.2.9
    Apache/2.2.11 (Win32) DAV/2 mod_ssl/2.2.11 OpenSSL/0.9.8i PHP/5.2.9
    Apache/2.2.11 (Win32) DAV/2 mod_ssl/2.2.11 OpenSSL/0.9.8i PHP/5.2.9
    Apache/2.2.11 (Win32) DAV/2 mod_ssl/2.2.11 OpenSSL/0.9.8i PHP/5.2.9
    ECS (pab/6F8D)
    ECS (pab/6FA8)
    ECS (pab/6FA8)
    ECS (pab/6FA8)
    ECS (pab/6F8D)
    Apache/2.2.11 (Win32) DAV/2 mod_ssl/2.2.11 OpenSSL/0.9.8i PHP/5.2.9
    ```
    
5. Follow the "first TCP stream" in "ASCII".  
    Investigate the output carefully.
    
      
    What is the number of listed files? `3`
    
    ```bash
    tshark -r directory-curiosity.pcap -q -z follow,tcp,ascii,0
    
    ===================================================================
    Follow: tcp,ascii
    Filter: tcp.stream eq 0
    Node 0: 192.168.100.116:49170
    Node 1: 141.164.41.174:80
    251
    GET / HTTP/1.1
    Accept: text/html, application/xhtml+xml, */*
    Accept-Language: en-US
    User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
    Accept-Encoding: gzip, deflate
    Host: jx2-bavuong.com
    DNT: 1
    Connection: Keep-Alive
    
    
    	1078
    HTTP/1.1 200 OK
    Date: Sun, 13 Dec 2020 00:51:46 GMT
    Server: Apache/2.2.11 (Win32) DAV/2 mod_ssl/2.2.11 OpenSSL/0.9.8i PHP/5.2.9
    Content-Length: 829
    Keep-Alive: timeout=5, max=100
    Connection: Keep-Alive
    Content-Type: text/html;charset=UTF-8
    
    <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
    <html>
     <head>
      <title>Index of /</title>
     </head>
     <body>
    <h1>Index of /</h1>
    <pre><img src="/icons/blank.gif" alt="Icon "> <a href="?C=N;O=D">Name</a>                    <a href="?C=M;O=A">Last modified</a>      <a href="?C=S;O=A">Size</a>  <a href="?C=D;O=A">Description</a><hr><img src="/icons/text.gif" alt="[TXT]"> <a href="123.php">123.php</a>                 12-Jul-2020 08:43    1   
    <img src="/icons/binary.gif" alt="[   ]"> <a href="vlauto.exe">vlauto.exe</a>              06-May-2020 23:32   40K  
    <img src="/icons/text.gif" alt="[TXT]"> <a href="vlauto.php">vlauto.php</a>              10-Jul-2020 23:25   93   
    <hr></pre>
    <address>Apache/2.2.11 (Win32) DAV/2 mod_ssl/2.2.11 OpenSSL/0.9.8i PHP/5.2.9 Server at jx2-bavuong.com Port 80</address>
    </body></html>
    
    313
    GET /icons/blank.gif HTTP/1.1
    Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
    Referer: http://jx2-bavuong.com/
    Accept-Language: en-US
    User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
    Accept-Encoding: gzip, deflate
    Host: jx2-bavuong.com
    DNT: 1
    Connection: Keep-Alive
    
    
    	490
    HTTP/1.1 200 OK
    Date: Sun, 13 Dec 2020 00:51:46 GMT
    Server: Apache/2.2.11 (Win32) DAV/2 mod_ssl/2.2.11 OpenSSL/0.9.8i PHP/5.2.9
    Last-Modified: Sat, 20 Nov 2004 13:16:24 GMT
    ETag: "20000000053c6-94-3e9506e1a3a00"
    Accept-Ranges: bytes
    Content-Length: 148
    Keep-Alive: timeout=5, max=99
    Connection: Keep-Alive
    Content-Type: image/gif
    
    GIF89a...................!.NThis art is in the public domain. Kevin Hughes, kevinh@eit.com, September 1995.!.......,............................I..;
    ===================================================================
    ```
    
6. What is the filename of the first file?
    
    Enter your answer in a **defanged** format. `123[.]php`
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1770381611743/74b33c7a-9d4f-4e86-ada0-72a54fda9d9a.png align="center")
    
7. Export all HTTP traffic objects.  
    What is the name of the downloaded executable file?
    
    Enter your answer in a **defanged** format. `vlauto[.]exe`
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1770381297555/1ef31b09-9027-4921-8e71-dc305cadb7c2.png align="center")
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1770381354666/86107b19-2c32-4d88-8909-931c12632722.png align="center")
    
8. What is the SHA256 value of the malicious file? `b4851333efaf399889456f78eac0fd532e9d8791b23a86a19402c1164aed20de`
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1770381275812/4fcaf51b-f880-4a60-962a-a8cbc0def81e.png align="center")
    
9. Search the SHA256 value of the file on VirtusTotal.
    
    What is the "PEiD packer" value? `.NET executable`
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1770381262854/b38df156-cea9-4fde-8d38-d1efbbf1bd89.png align="center")
    
10. Search the SHA256 value of the file on VirtusTotal.
    
    What does the "Lastline Sandbox" flag this as? `MALWARE TROJAN`
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1770381247985/77150add-6482-424f-877c-744824777997.png align="center")