Analysing a PCAP in a CTF with Wireshark and tshark

A packet capture (.pcap or .pcapng) shows up in two situations: as a forensics challenge in a CTF, or as a file you find inside a machine (on a share, in a user's folder or downloaded through an IDOR, as on Cap). Either way you are almost always after the same thing: credentials that travelled unencrypted or a file that was transferred.

1. The big picture before opening packets

Do not start scrolling. First, what is in the capture:

capinfos capture.pcap                                   # duration, packet count
tshark -r capture.pcap -qz io,phs                       # protocol hierarchy
tshark -r capture.pcap -qz conv,tcp                     # TCP conversations, by bytes
tshark -r capture.pcap -qz http,tree                    # HTTP requests

In Wireshark the same lives under Statistics → Protocol Hierarchy and Statistics → Conversations. Sort conversations by bytes: the biggest is usually a file transfer, and those on odd ports are the interesting ones.

2. Clear-text credentials

Shortcut for all of them at once: Tools → Credentials in Wireshark, or in the terminal:

tshark -r capture.pcap -Y 'ftp.request.command in {"USER" "PASS"}' -T fields -e ftp.request.arg
pip install pcredz && Pcredz -f capture.pcap

3. Crackable hashes

Even when the protocol does not send the password, it sometimes sends something crackable:

• NTLMv2 (SMB, HTTP with NTLM): NTLMRawUnHide or Pcredz extract it in hashcat format (-m 5600).
• Kerberos AS-REQ with pre-authentication: the encrypted timestamp cracks with hashcat -m 19900 (etype 18) or -m 7500 (etype 23). That is the way on Office and Certificate.
• WPA/WPA2: a four-way handshake is converted with hcxpcapngtool -o hash.hc22000 capture.pcap and cracked with -m 22000.

All of them crack as described in the hash cracking guide.

4. Extracting files

File → Export Objects in Wireshark pulls out whatever went over HTTP, SMB, FTP-DATA, TFTP or IMF (email). In the terminal:

tshark -r capture.pcap --export-objects http,./out
tshark -r capture.pcap --export-objects smb,./out

If it does not recognise it, follow the TCP stream, switch the view to Raw and save it; then file and binwalk -e tell you what it is. For FTP, the data travels on a separate connection (FTP-DATA): look for it right after the RETR command.

5. Encrypted traffic

• TLS: if you find a session key log (SSLKEYLOGFILE, a .log with CLIENT_RANDOM lines) or the server's RSA private key, load it in Preferences → Protocols → TLS. With TLS 1.3 or forward-secret ciphers, only the session key log works.
• WiFi: with the network password, add a wpa-pwd entry with password:SSID in Preferences → Protocols → IEEE 802.11 → Decryption keys. That is how the traffic is decrypted on AirTouch.
• Kerberos: with the service account's keytab, Wireshark decrypts the tickets (Preferences → Protocols → KRB5).

6. If nothing obvious shows up

• DNS: very long names or base64/hex labels usually mean exfiltration (dns.qry.name).
• ICMP: data in the data field of pings, another classic CTF exfiltration channel.
• USB: keyboard captures (usb.capdata); each packet is a keystroke and there are scripts that turn them back into text.
• Timing and lengths: sometimes the message is in the packet sizes or the gaps between them.

On a machine, if there is no capture but you are allowed to sniff (tcpdump with capabilities or as root), leave tcpdump -i any -w /tmp/c.pcap running for a few minutes: scheduled tasks that authenticate to another service leave credentials in plain sight (Carrier, LightWeight).