[MMA 2015] [Forensics – stream…] Write UpDescription
We were given a file “stream“.
Resolution
We opened it with a hex editor and saw:
Windows XP Service Pack 3, build 26004Dumpcap 1.12.7 (v1.12.7-0-g7fc8978 from master-1.12)
Dumpcap is a software used to record network traffic, let’s see it !
We opened it with Wireshark (to make it more convenient you can rename the file with a .pcap extension).
In the packet #548 there’s a response from a Microsoft Media Server giving a media file.
To dump the media file :
File / Export objets / HTTP
Select the only one line and save the file (as “dump” for exemple).
Now upload this new file to a webserver.
Open VLC:
File / Media / Open network flux.
mms://URLtoYourWebserver/dump
Wait a few seconds and enjoy 🙂
Flag is MMA{windows_xp_is_too_old_to_create_problem!!}
When i renamed stream-data.hex to stream-data.pcap , the wireshark failed to open the file.
Hello Diaa
Strange, I tried what I wrote in the WU, and it’s working fine:
– Download the .zip archive from the link above.
– Extract the “stream” file.
– Open it with Wireshark.
yup, works fine, i did’t know what happen with me, but now everything is fine now, Thanks WTF for your attention and really i liked your simplicity in all your blogs.
You’re welcome!
We try at most to popularize how to solve the challenges.
It’s good to know that the goal seems reached!
Thank you 🙂