“ANN'S AURORA” - SANS Computer Forensics

More documents

Recommendations

Info

SOLVING THE CRIME •Now we have the half-duplex reassembled stream payload •Let's use foremost to carve out the data Q: In packet 17, the malicious server sent a file to the client. What was the MD5 sum? A: b062cb8344cd3e296d8868fbef289c7c <strong>Forensics</strong>Contest.com Contest #6: “Ann’s Aurora” © 2010 Lake Missoula Group, LLC
SOLVING THE CRIME • There is some odd stuff going on in here though. Let’s look at the port 4445 traffic... • How often does the TCP initial sequence number (ISN) change? <strong>Forensics</strong>Contest.com Contest #6: “Ann’s Aurora” © 2010 Lake Missoula Group, LLC
Page 1 and 2: SANS FORENSIC CHALLENGE: “ANN’S
Page 3 and 4: CONTEST #6: “ANN’S AURORA” :
Page 5 and 6: THE CONTEST • You are the investi
Page 7 and 8: SOLVING THE CRIME Q: What was the f
Page 9 and 10: SOLVING THE CRIME Vick's computer m
Page 11 and 12: SOLVING THE CRIME Q: When was the T
Page 13: SOLVING THE CRIME In packet 17, the
Page 17 and 18: SOLVING THE CRIME • There is some
Page 19 and 20: SOLVING THE CRIME Subsequently, the
Page 21 and 22: SOLVING THE CRIME Q: When was the T
Page 23 and 24: BEHIND THE CURTAIN: EXPLOIT DESCRIP
Page 25 and 26: THE ATTACK (2) • The attacker los
Page 27 and 28: ISSUES WITH THE ATTACK • Victim i
Page 29 and 30: WINNER & FINALISTS • Winner! - We
Page 31 and 32: WESLEY MCGREW: PCAPLINE Example r
Page 33 and 34: • Drill down WESLEY MCGREW: • V
Page 35 and 36: ERIK HJELMVIK: NETWORK MINER .92
Page 37 and 38: ERIK HJELMVIK: NETWORK MINER .92
Page 39 and 40: LEENDERT PIETER VAN DRIMMELEN: PEXT
Page 41 and 42: ERIC KOLLMANN: CONTEST6.PL • Get
Page 43 and 44: CONGRATULATIONS, AND THANKS! • On

“ANN'S AURORA” - SANS Computer Forensics

Create successful ePaper yourself

Delete template?

Save as template?