Looking for a file

edit

Awesome thanks, I'll try that. There isn't a public link to the pcap file, I could upload it to google drive and share it that way.

https://drive.google.com/open?id=10jG...

That did help filter out the ambiguity. But I'm still not seeing the file, also, the CTF is over now so I'll provide a bit more info. The goal of that particular question was to find the file, and calculate the md5 hash (which is the flag).

Nice one... Is the answer e0fb946c...258c22a1 (not posting the whole MD5 to not spoil the challenge)?

That's probably it, I have no way to verify now. I must be missing some information though, I can tell that there was a lot of data transferred, and I've applied the filters, but clearly the file is obfuscated somehow because it's not listed anywhere as "file.exe" or whatever. Why is it that I'm not seeing a straightforward file transfer?

That's because it was not a straightforward file transfer.

In the trace you can find a shell session to the windows machine. And in that session, some commands were used to build up the file. So, find the conversation, look at what is being done, google for the command that was used to build up the file and then use some form of scripting yourself to create the file, based on all of the above. Have Fun!

Okay, will do, thanks!

Okay, so I'm pretty sure I found the file. badboy.exe However, I don't really understand what's going on with that file transfer, and also, I got a different MD5

Are you looking at tcp.stream==1001? If you do a follow tcp stream on it, you can see what is going on. It might help to show only the bytes from the client, so instead of "Entire conversation" you can select "192.168.1.50:4444 -> 192.168.1.100:2546".

Look at which commands are entered and for each command find out what it does.

(I hope you don't mind that I try to let you find it out yourself with hints from me, I think you will learn the most that way, if you just want a little walk-through, I can do that too of course. Your choice :-))

That's exactly the stream I've been viewing. I see that it's a file transfer technique (post exploitation?) but I can't figure out how it works. I'm not really sure what information I'm missing. Normally I prefer to just get pointers and figure it out for myself, but I've spent days on this problem so maybe a short walk-through would be more helpful in this case. (If you don't mind).