[flow analysis] Buu_ [an Xun cup 2019]attack

1. Open the traffic packet , Search in packet byte stream flag, Find a zip package , Use foremost Separate , Opening discovery requires a password .

2. Recall that there is such content in the traffic package ： Guess the password belongs to the administrator （ Later, it was found that ）

3. Export object ->HTTP I found a dmp file , Generally, it is the suffix of the database backup file , Because he is bigger than the others , So let's take a look

4. Now think of mimikatz The function of ： Plaintext passwords can be captured from memory during intranet penetration .

// Increase authority 

privilege::debug

// load dmp file 

sekurlsa::minidump lsass.dmp

// Read the login password 

sekurlsa::logonpasswords full

5. First of all, will mimikatz Set to trusted , Bypass the firewall , Right click again to use the administrator login to find the password .

Open the compressed package with this password to obtain flag