NET100 – Perfect hit

This was a quite easy but fun challenge.
It’s about extracting data from a pcap file with SIP communication captured.

If we take a look at the .pcap we see some SIP communication which can be easily inspected via the setting “Telephonie” in Wireshark. With that, we can see that there are two calls and one of them got rejected. So we are interested in the successful/ completed call.

After playing the stream we get the first flag. But that’s not it because this challenge has two flags hidden. So let’s take a look for the password which is the next topic of interest and should be somewhere at the registration or contact phase of both participants.

After inspecting the traffic we see some unauthorized requests and after that a request with REGISTER and after that a status 200 with all the required information.

But what to do now with interesting information. Just use the SIPcrack 0.2 tool on Kali Linux and let it crack the password for you. But SIPcrack requires a sipdump file and we just got a pcap.. :/
Just use the SIPdimp tool to extract the relevant information from the .pcap and transform the found data into a sipdump file via:

sipdump -p '/root/Downloads/disco.pcap' ./sipFile

* Using pcap file '/root/Downloads/disco.pcap' for sniffing
* Starting to sniff with packet filter 'tcp or udp'

* Dumped login from 37.59.51.72 -> 192.168.72.142 (User: 'sebextor')
* Dumped login from 37.59.51.72 -> 192.168.72.142 (User: 'sebextor')
* Dumped login from 37.59.51.72 -> 192.168.72.142 (User: 'sebextor')
* Dumped login from 37.59.51.72 -> 192.168.72.142 (User: 'sebextor')

* Exiting, sniffed 4 logins

Followed by the SIPcrack tools and your done!

sipcrack -w /usr/share/wordlists/rockyou.txt ./sipFile

* Found Accounts:

Num	Server		Client		User	Hash|Password

1	192.168.72.142	37.59.51.72	sebextor	3551d0c6babbd26a6f331d09958b3611
2	192.168.72.142	37.59.51.72	sebextor	ea6ca2158821cd4357e91a7290c614fe
3	192.168.72.142	37.59.51.72	sebextor	b991929ad456f72b9918a28e8e51947e
4	192.168.72.142	37.59.51.72	sebextor	30c66e99d569039044054906da7e68fe

* Select which entry to crack (1 - 4): 2

* Generating static MD5 hash... d845bafc8c359f2d392f2fd2eb11b083
* Loaded wordlist: '/usr/share/wordlists/rockyou.txt'
* Starting bruteforce against user 'sebextor' (MD5: 'ea6ca2158821cd4357e91a7290c614fe')
* Tried 7476821 passwords in 3 seconds