Can someone help me with my CTF assignment IDS?

I tried everything I know.

Cyber Forum•11/5/23, 8:11 PM

Post created!

This post has been indexed in our web forum and will be seen by search engines so other users can find it outside Discord

Your user profile is private by default and won't be visible to users outside Discord, if you want to be visible in the web forum you can add the "Public Forum Profile" role in <id:customize>

You can mark a message as the answer for your post with

Right click -> Apps -> Mark Solution

Right click -> Apps -> Mark Solution

(if you don't see the option, try refreshing Discord with Ctrl + R)

efficient-indigoOP•11/5/23, 8:11 PM

ids004.pcapng202.95KB

DirtyJ•11/5/23, 8:12 PM

Can you give us some more info on what you've tried so far?

efficient-indigoOP•11/5/23, 8:13 PM

Tried export objects

efficient-indigoOP•11/5/23, 8:13 PM

efficient-indigoOP•11/5/23, 8:14 PM

Tried PSEXESVC and didnt work

efficient-indigoOP•11/5/23, 8:14 PM

MD5

efficient-indigoOP•11/5/23, 8:15 PM

Tried following the TCP stream

efficient-indigoOP•11/5/23, 8:15 PM

But only found this

efficient-indigoOP•11/5/23, 8:15 PM

efficient-indigoOP•11/5/23, 8:20 PM

efficient-indigoOP•11/5/23, 8:21 PM

I just dont know where to look anymore

DirtyJ•11/5/23, 8:23 PM

I'm seeing references to sysinternals and smb.exesmb.exe, I'm poking around to see if I can get a clue

efficient-indigoOP•11/5/23, 8:26 PM

Appreciate it

Vvechain enjoyer Appreciate it

DirtyJ•11/5/23, 8:59 PM

Couldn't find anything during my lunch break (at work atm lol) but once I'm off I'll take a closer look. I know @weet has been doing a CTF all weekend so if he's free I think he'd enjoy the puzzle as well