Data hosted with ♥ by Pastebin.com - Download Raw - See Original
  1. #!/usr/bin/python
  2.  
  3. import os
  4.  
  5. def prima():
  6.     #a=os.system('tshark -r evidence.pcap -R "ip.src == 192.168.1.158" -T fields -e ip.dst | sort | uniq -c')
  7.     #b=os.system('tshark -r evidence.pcap -R "ip.addr == 192.168.1.158 && ip.addr == 64.12.24.50" -d tcp.port==443,aim')
  8.     print "\n1. What is the name of Ann's IM buddy?"
  9.     c=os.system('tshark -r evidence.pcap -R "ip.addr == 192.168.1.158 && ip.addr == 64.12.24.50" -d tcp.port==443,aim -T fields -e "aim.buddyname" | sort | uniq -c')
  10.  
  11. def seconda():
  12.     #a=os.system('tshark -r evidence.pcap -R "ip.addr == 192.168.1.158 && ip.addr == 64.12.24.50" -d tcp.port==443,aim -T fields -e frame.number -e "ip.src" -e "aim.messageblock.message"')
  13.     print '\n2. What was the first comment in the captured IM conversation?'
  14.     b=os.system('tshark -r evidence.pcap -R "frame.number==25" -d tcp.port==443,aim -T fields -e "aim.messageblock.message"')
  15.    
  16. def terza():
  17.     print '\n3. What is the name of the file Ann transferred?'
  18.     #a=os.system('tshark -r evidence.pcap -R "ip.addr == 192.168.1.158 && ip.addr == 64.12.24.50" -d tcp.port==443,aim -V | grep -i send')
  19.     #b=os.system('tshark -r evidence.pcap -R "ip.addr == 192.168.1.158 && ip.addr == 64.12.24.50 && (tcp contains 09:46:13:43)" -d tcp.port==443,aim -T fields -e frame.number')
  20.     #c=os.system('tshark -r evidence.pcap -R "frame.number==92" -d tcp.port==443,aim -V')
  21.     #d=os.system('tshark -r evidence.pcap -R "ip.addr == 192.168.1.158 && tcp.port == 5190 && tcp.len>80" -d tcp.port==443,aim')
  22.     e=os.system('tshark -r evidence.pcap -R "frame.number==112" -d tcp.port==443,aim -V')
  23.    
  24. def quarta():
  25.     print '\n4. What is the magic number of the file you want to extract (first four bytes)?'
  26.     #a=d=os.system('tshark -r evidence.pcap -R "ip.addr == 192.168.1.158 && tcp.port == 5190" -d tcp.port==443,aim -T fields -e frame.number -e data.data')
  27.     b=os.system('tshark -r evidence.pcap -R "frame.number==119" -d tcp.port==443,aim -V')
  28.  
  29. def quinta():
  30.     print '\n5. What was the MD5sum of the file?'
  31.     a=os.system('tshark -r evidence.pcap -R "ip.addr == 192.168.1.158 && tcp.port == 5190" -d tcp.port==443,aim -w new.pcap')
  32.     b=os.system('tcpflow -r new.pcap')
  33.     c=os.system('dd if=192.168.001.158.05190-192.168.001.159.01272 of=new skip=256 bs=1')
  34.     d=os.system('md5sum new')
  35.  
  36. def sesta():
  37.     print '\n6. What is the secret recipe?'
  38.     a=os.system('unzip new')
  39.     b=os.system('cat word/document.xml')
  40.    
  41.    
  42. prima()
  43. seconda()
  44. terza()
  45. quarta()
  46. quinta()
  47. sesta()