Shiba Insider
Last updated
Was this helpful?
Last updated
Was this helpful?
Always open malware in a secure environment like a VM.
Let's open the insider.pcap file using Wireshark.
Let's follow the TCP stream via Follow > TCP Stream.
The answer to the previous question told us to use our own password.
If we look at the TCP stream we can see a string sent by us that might be a password.
The string has two == signs at the end. This is an indication that the string has been encrypted using Base64.
Let's use Cyberchef to decode it.
We can now unzip file.zip using the redforever password.
As there are no more Zip files, we can safely say that no more password will be required.
The exiftool utility can be used to obtain file information such as the metadata.
Let's look at the file metadata using the exiftool utility as mentioned previously.
All the information is pretty standard for an image except for the Technique : Steganography field. Steganography is used to hide information in other information most notably images.
The steghide tool needs to be used retrieve the hidden information.
Let's use the steghide utility to retrieve the ID.
The sf flag is used to specify the name of the stego file.
Let's look at our own user profile.
If we look at the user profile, we can see that the user IDs are included in the URI.
What if we replace this ID with the one we retrieved: 0726ba878ea47de571777a.
We have our attacker.
