Traffic

~~ NOTE: It's easier to complete this challenge within a Linux environment. ~~ For this challenge, participants are provided with a file called traffic.7z.

After extracting the file, reveals a bunch of gzip files

The naming convention of the files suggests these are zeek logs. More Info

After extracting the gzip files, we can now spin up a database using Rita

rita import . logs will create a database including all the files in the present working directory and name it logs.

rita show-beacons logs -H will spit out some data to look at. We can already see some suspicious looking connections based on how many were made. However, this format is hard to read and doesn't really show much.

Running the command rita html-report logs will create an organized html report for us.

Looking at the Beacons, there are several outgoing connections that seem to be repeated more than usual. Along with a score that is VERY close to 1, this raises some red flags. Even more so with the highlighted IP.

Trying to access the IP directly reveals this is pointing to some github url. 104 connections being made to one github link? Something isn't right.

Switching to the Beacons SNI page, and searching for any github urls we find a github pages link.

Voilà! Flag is captured :-)