l337 S4uc3 blue team ctf

PCAP: Alright, now we need you to determine a starting point for the timeline that will be useful in mapping out the incident. Please determine the arrival time of frame 1 in the "GrrCON.pcapng" evidence file.

PCAP: What version number of PHP is the development.wse.local server running?

PCAP: What version number of Apache is the development.wse.local web server using?

IR: What is the common name of the malware reported by the IDS alert provided?

PCAP: Please identify the Gateway IP address of the LAN because the infrastructure team reported a potential problem with the IDS server that could have corrupted the PCAP

IR: According to the IDS alert, the Zeus bot attempted to ping an external website to verify connectivity. What was the IP address of the website pinged?

PCAP: It’s critical to the infrastructure team to identify the Zeus Bot CNC server IP address so they can block communication in the firewall as soon as possible. Please provide the IP address?

PCAP: The infrastructure team also requests that you identify the filename of the “.bin” configuration file that the Zeus bot downloaded right after the infection. Please provide the file name?

PCAP: No other users accessed the development.wse.local WordPress site during the timeline of the incident and the reports indicate that an account successfully logged in from the external interface. Please provide the password they used to log in to the WordPress page around 6:59 PM EST?

PCAP: After reporting that the WordPress page was indeed accessed from an external connection, your boss comes to you in a rage over the potential loss of confidential top-secret documents. He calms down enough to admit that the design's page has a separate access code outside to ensure the security of their information. Before storming off he provided the password to the designs page “1qBeJ2Az” and told you to find a timestamp of the access time or you will be fired. Please
provide the time of the accessed Designs page?

PCAP: What is the source port number in the shellcode exploit? Dest Port was 31708 IDS Signature GPL
SHELLCODE x86 inc ebx NOOP

PCAP: What was the Linux kernel version returned from the meterpreter sysinfo command run by the attacker?

PCAP: What is the value of the token passed in frame 3897?

PCAP: What was the tool that was used to download a compressed file from the webserver?

PCAP: What is the download file name the user launched the Zeus bot?

Memory: What is the full file path of the system shell spawned through the attacker's meterpreter session?

Memory: What is the Parent Process ID of the two 'sh' sessions?

Memory: What is the latency_record_count for PID 1274?

Memory: For the PID 1274, what is the first mapped file path?

Memory:What is the md5hash of the receive.1105.3 file out of the per-process packet queue?