# Decrypting the Breach: PCAP and Memory Forensics

The tryhackme challenge (Block) provides us with a PCAP([**Packet Capture**)](https://www.google.com/search?q=Packet+Capture&client=firefox-b-d&hs=dzBp&sca_esv=71b86378781733a7&sxsrf=ANbL-n53H6BuvWRGW24fsnC_XxV6surdPg%3A1768815200807&ei=YPptad_uMJSO4-EPm7Cy2AM&oq=pcap+full&gs_lp=Egxnd3Mtd2l6LXNlcnAiCXBjYXAgZnVsbCoCCAAyChAAGIAEGBQYhwIyCxAAGIAEGJECGIoFMgUQABiABDIFEAAYgAQyBhAAGBYYHjIGEAAYFhgeMgYQABgWGB4yBhAAGBYYHjIGEAAYFhgeMgYQABgWGB5IuBFQhQFYpQtwAXgBkAEAmAHJB6ABohKqAQsyLTIuMS4wLjEuMbgBA8gBAPgBAZgCBqAC2xLCAgoQABiwAxjWBBhHwgINEAAYgAQYsAMYQxiKBcICChAAGIAEGEMYigXCAgcQABiABBgKwgIJEAAYgAQYChgLmAMAiAYBkAYKkgcNMS4wLjIuMS4xLjAuMaAH4xuyBwsyLTIuMS4xLjAuMbgH0BLCBwUyLTQuMsgHK4AIAA&sclient=gws-wiz-serp&mstk=AUtExfANU8CV7y05qFd80b8SKWARQApPHo9IN3KqnRLsjS3jSd59RyA3kaUwdB29Vg2sxihVcVNRkM4OLRD5OdjgY9hdO9jisSY_9ZcGSJGmsvLjMwcGO8iQ9xR2KHPwq5wY0LBeSdpN4HpRw-MO_M8Bi4_t4VMe37_vNCCsudGnn7V7UYIPpPSZlrBAQR3qiy2KACEenorEJ_8emLC87BDTCuVmxZKoqWG2LesKqqVIJSKpXAQgx1SNWH_NBUjkONLK74qqlxqKGdZrhTcC2WYNjhZ7&csui=3&ved=2ahUKEwizptaTppeSAxWwxzgGHbtPHdIQgK4QegQIARAE) file and a dump file LSASS(Local Security Authority Subsystem Service). We have to decrypt the encrypted SMB(Server Message Block) files to find solutions for the given questions.

## **Q1. What is the username of the first person who accessed our server?**

To find the username of the first person we open the traffic.pcapng file in wireshark. There we can identify the two users **mrealman** and **eshellstrop.**

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1768738060628/7d2e60d4-4653-445a-9483-293a026185f2.png align="center")

## **Q2. What is the password of the user in question 1?**

To find solution of this question first we need to understand how authentication process works in NTLMv2.

LM- and NT-hashes are ways Windows stores passwords. NT is confusingly also known as NTLM. Can be cracked to gain password, or used to pass-the-hash. The NTLM protocol uses the NTHash in a challenge/response between a server and a client. The v1 of the protocol uses both the NT and LM hash, depending on configuration and what is available. And the v2 is the new and improved version of the NTLM protocol, which makes it a bit harder to crack.\[[source](https://medium.com/@petergombos/lm-ntlm-net-ntlmv2-oh-my-a9b235c58ed4)\]

**Now, to crack NTLMv2 we need to extract exact format from the packet.**

Filter by ntlmssp and find the NTLMSSP\_AUTH packet. after selecting it, copy out the domain name and user name to a text document. Drill down into the NTLM Response section to find NTProofStr and NTLMv2 response. Copy both of these out to the text document as a hex string. Since NTLMv2Response begins with the ntlmProofStr, so delete the ntlmProofStr from the NTLMv2Response. Enter ntlmssp.ntlmserverchallenge into the search filter this will highlight the NTLM server challenge copy its value into the text document as a hex string. Now arrange all the values in the given format and name the text document as cracked.txt.

Format - username::domain:ServerChallenge:NTproofstring:modifiedntlmv2response

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1768742506732/63cdce6a-4246-4acd-9307-c1de6a3bc403.jpeg align="center")

Now, download password list and save it.(rockyou.txt)

In terminal run, hashcat -m 5600 -D 1 cracked.txt rockyou.txt and it will give you the user’s password!**(Blockbuster1)**

I have used [hashcat](https://www.google.com/url?sa=t&source=web&rct=j&opi=89978449&url=https://www.kali.org/tools/hashcat/&ved=2ahUKEwj24K3WmZiSAxWXslYBHY9TMUkQFnoECB8QAQ&usg=AOvVaw1nZ8_DfF6fmVm1R5L2v8Gh) tool for password cracking.

## **Q3. What is the flag that the first user got access to?**

We have the password of the first user, with the help of it we can decrypt the smb traffic.

Inside Wireshark, Click on **Edit** → **Preferences** → **Protocols** In protocols drop down section search for **NTLMSSP** and enter the password. SMB traffic for mrealman got decrypted.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1768745362897/b95f2307-7a25-44f9-a834-f7c342b5c1b9.jpeg align="center")

Open **File** → **Export** **objects** → **SMB…** export the clients156.csv file and run command cat %5cclients156.csv

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1768745921382/156d1bb7-7def-4d93-befe-1160b8d51718.png align="center")

**First flag - THM{SmB\_DeCrypTing\_…**

## **Q4. What is the username of the second person who accessed our server?**

The second user is eshellstrop.

## **Q5. What is the hash of the user in question 4?**

To find the hash of the user eshellstrop we can use the command - pypykatz lsa minidump lsass.DMP | grep eshellstrop -A 10 -C 10 which extracts the surrounding and related details of the user eshellstrop.

Here, I used [pypykatz](https://rgbwiki.com/Red%20Cell/09.%20Credential%20Dumping/Using%20Custom%20Tools/pypykatz/) which is a Python library and toolset designed for interacting with the Windows Security Authority Subsystem Service (LSASS), which can be used for extracting various authentication credentials and secrets, including plaintext passwords and password hashes.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1768751575110/89612c4f-e7de-40af-bfd8-1bb39185883f.png align="center")

This gives us the hash of the user. **NT - 3f29138a04aadc19214e9c04028bf381**

## **Q6. What is the flag that the second user got access to?**

Lastly we need to decrypt the traffic for the second user and [this article](https://medium.com/maverislabs/decrypting-smb3-traffic-with-just-a-pcap-absolutely-maybe-712ed23ff6a2) helped. It mentions that we can use key exchange key to decrypt the Encrypted session key and get the Random session key and use that to decrypt the SMB3 traffic.

To calculate Random session key we need -

* username
    
* domain
    
* NTProofStr
    
* NT hash
    
* Encrypted session key
    
    Write the Python script in the text document(ab.py) to calculate random session key
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1768753822772/6a373dec-f5db-4947-aaf1-826ca35b1d33.jpeg align="center")

Run command - python3 [ab.py](http://ab.py) -u eshellstrop -d WORKGROUP -n 3f29138a04aadc19214e9c04028bf381 -k c24f5102a22d286336aac2dfa4dc2e04

Random session key - facfbdf010d00aa2574c7c41201099e8

Now Session Id: 0x0000100000000045 needs to be converted into little endian from [this site](https://www.save-editor.com/tools/wse_hex.html)

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1768754637372/aead009a-ea1e-4dcb-959c-54651ed4ffc8.png align="center")

We have random session key and session ID.

**Edit** → **Preferences** → **Protocols** **in** **dropdown** → **SMB2** → **Edit…**

Put Random session key and session ID, the SMB traffic will get decrypted.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1768755156241/fc3e72a8-ca1e-4738-b98b-c621e9d194b3.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1768755269469/e6641312-01b7-45c9-a027-95af370c21c3.png align="center")

Previously, we exported the first file just like that export the second one.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1768755667634/bfdda9ce-43f8-4dcb-ac76-16c1b8d1c5d1.png align="center")

and in terminal run the command - cat %5cclients978.csv

![](https://cdn.discordapp.com/attachments/1461322664680620105/1462885216195444807/IMG_20260120_002607.png?ex=696fd186&is=696e8006&hm=7392f4c8420dacde2c6750f6ae020b1d37199056eb0e4a236d4d51cb7fac14f0& align="left")

we will get the second flag - THM{No\_PasSoRd….

And the challenge is done!

## **CONCLUSION**

We completed this real world security challenge with combining network forensics and memory analysis. This challenge required multiple sources to find evidences. Wireshark, to analyse PCAP. Examined memory dump with pypykatz tool to find credentials in LSASS and hashcat to crack the recovered hashes. This challenge strengthens the understanding of network traffic and memory artifacts and gives an experience with forensic tools.