Forensics

Challenge

A packet capture of a connection to a Metasploitable host. The traffic was unencrypted, so the whole interactive session was sitting in the clear.

Approach

Following the TCP stream replayed the attacker’s shell verbatim, a root session running commands. The flag was read off the desktop near the end:

id
uid=0(root) gid=0(root) groups=0(root)
...
cat /home/labuser/Desktop/flag.txt
UMASS{n07_ag41n_d4mn_y0u_m3t4spl017}

Flag

UMASS{n07_ag41n_d4mn_y0u_m3t4spl017}