This should have been a simple matter of using the password from the first email, but no. rar file,Īnd sure enough, it produced a password-protected.

There’s a much faster way, using a tool called uudeview to extract Base64 content from. It’s possible to find the other fragments, export those as text files, slowly piece them together and decode it. The next email contained a fragment of backup.rar, which is Base64-encoded. If we wanted to find more emails, we use the latter option with ‘postmaster’ as the parameter. What is this backup, I wondered? By the way, Ctrl+F brings up the search window, which works for packet headers, hex values or strings. We want to export only the selected packet:Īfter removing all the crap from the resulting text file, we get an email that was sent from 192.168.0.150 to 192.168.0.100: The text is perfectly readable in Wireshark, but the relevant packets must be exported to a text file in order to do anything with it. Sifting through the dump for a payload that contains readable text, I found an email. pcap contained mostly faked packets to hide something else. That wasn’t the case here, and the more I watched the growing list of services running off just one VM, the more it became evident the. In the real world, a Wireshark capture would clearly identify which hosts are mail servers, Domain Controllers or whatever, and show their operating system and software versions. * 192.168.0.150 – Another VM making a load of requests through outgoing port 34988, so it had to be a proxy server. * 192.168.0.100 – Appears to be a virtual machine running on VMware, and providing a large number of services, including IMAP, MySQL, POP3, HTTPS, domain services, Kerberos, Sun RPC and SMUX. There are three IP addresses worth looking at: My personal method is to start by constructing a picture of the network, which is time consuming but sets the scene for whatever analysis. I was hoping to demonstrate some of that here, using a (publicly available). For anyone interested in network security and pen testing stuff, Wireshark is the tool to get, as it reveals pretty much everything about a network, the hosts and active services present, traffic volumes, payloads and sometimes login details as well.

Extract file from pcap wireshark