Download Challenge

This challenge takes you into the world of voice communications on the internet. VoIP is becoming the de-facto standard for voice communication. As this technology becomes more common, malicious parties have more opportunities and stronger motives to control these systems to conduct nefarious activities. This challenge was designed to examine and explore some of the attributes of the SIP and RTP protocols. 

 

Challenge Files:

  • "log.txt" was generated from an unadvertised, passive honeypot located on the internet such that any traffic destined to it must be nefarious. Unknown parties scanned the honeypot with a range of tools, and this activity is represented in the log file.
    • The IP address of the honeypot has been changed to "honey.pot.IP.removed". In terms of geolocation, pick your favorite city.
    • The MD5 hash in the authorization digest is replaced with "MD5_hash_removedXXXXXXXXXXXXXXXX"
    • Some octets of external IP addresses have been replaced with an "X"
    •  Several trailing digits of phone numbers have been replaced with an "X"
    •  Assume the timestamps in the log files are UTC.
  • "Voip-trace.pcap" was created by honeynet members for this forensic challenge to allow participants to employ network analysis skills in the VOIP context. 
# Question Weight Solved
1 What is the transport protocol being used? 50 36
2 The attacker used a bunch of scanning tools that belong to the same suite. Provide the name of the suite. 100 28
3 What is the User-Agent of the victim system? 100 25
4 Which tool was only used against the following extensions: 100,101,102,103, and 111? 150 20
5 Which extension on the honeypot does NOT require authentication? 150 21
6 How many extensions were scanned in total? 150 18
7 There is a trace for a real SIP client. What is the corresponding user-agent? 150 20
8 Multiple real-world phone numbers were dialed. Provide the first 11 digits of the number dialed from extension 101? 150 19
9 What are the default credentials used in the attempted basic authentication? (format is username:password) 150 24
10 Other than SIP, what are the other two UDP protocols present in the trace? 200 24
11 Which codec does the RTP stream use? 200 24
12 How long is the sampling time (in milliseconds)? 200 15
13 What was the password for the account with username 555? 200 19
14 Which RTP packet header field can be used to reorder out of sync RTP packets in the correct sequence? 250 19
15 The trace includes a secret hidden message. Can you hear it? 300 20