<h3 id="heading-problem-statement"><strong>Problem Statement</strong></h3>
<pre><code class="lang-plaintext">We need to identify if there were potential vulnerabilities exploited. 
What's the name of the malicious web shell uploaded?

Flag Format: BUBT{..*}

network_artifacts.pcapng
</code></pre>
<h3 id="heading-prerequisites"><strong>Prerequisites</strong></h3>
<ul>
<li>Wireshark (basic use of filters, following HTTP/TCP streams, viewing responses)</li>
</ul>
<h3 id="heading-solution"><strong>Solution</strong></h3>
<p>After reading the statement, I realized that something was uploaded. Files are usually uploaded using the <code>POST</code> method, so I decided to filter the packets by this method.</p>
<p><img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1732444992050/10f86b9b-64da-4ae1-b9bd-7b62b4c91dd4.png" alt="filtering packets by POST method" class="image--center mx-auto" /></p>
<p>Now, I can see that two files were uploaded using the <code>/upload</code> endpoint. So, I started analyzing each response to get more details.</p>
<p><img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1732445383108/365fa1ec-e3a0-4051-bbe5-6b8c39562b15.png" alt class="image--center mx-auto" /></p>
<p><img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1732445254636/ec16f1b9-cbff-45dc-a32f-df896a4d6884.png" alt class="image--center mx-auto" /></p>
<p>The attacker was unable to upload the <a target="_blank" href="https://www.acunetix.com/blog/web-security-zone/what-is-reverse-shell/">reverse shell</a> because the website filters file formats, which is a basic protection mechanism.</p>
<p>But on the second attempt he managed to trick the protection mechanism!</p>
<p><img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1732445569789/ae6f5ca8-45d1-4ad9-b657-7e91fe690a08.png" alt class="image--center mx-auto" /></p>
<p>He included a <code>.jpg</code> extension :D (a good reminder of why you should rigorously test your written functions :3)</p>
<h3 id="heading-credits"><strong>Credits</strong></h3>
<ul>
<li><p><strong>Hashnode</strong> - for the amazing platform</p>
</li>
<li><p><strong>BUBT</strong> - for the workshop</p>
</li>
</ul>


### **Problem Statement**

```plaintext
We need to identify if there were potential vulnerabilities exploited. 
What's the name of the malicious web shell uploaded?

Flag Format: BUBT{..*}

network_artifacts.pcapng
```

### **Prerequisites**

* Wireshark (basic use of filters, following HTTP/TCP streams, viewing responses)
    

### **Solution**

After reading the statement, I realized that something was uploaded. Files are usually uploaded using the `POST` method, so I decided to filter the packets by this method.

![filtering packets by POST method](https://cdn.hashnode.com/res/hashnode/image/upload/v1732444992050/10f86b9b-64da-4ae1-b9bd-7b62b4c91dd4.png align="center")

Now, I can see that two files were uploaded using the `/upload` endpoint. So, I started analyzing each response to get more details.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1732445383108/365fa1ec-e3a0-4051-bbe5-6b8c39562b15.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1732445254636/ec16f1b9-cbff-45dc-a32f-df896a4d6884.png align="center")

The attacker was unable to upload the [reverse shell](https://www.acunetix.com/blog/web-security-zone/what-is-reverse-shell/) because the website filters file formats, which is a basic protection mechanism.

But on the second attempt he managed to trick the protection mechanism!

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1732445569789/ae6f5ca8-45d1-4ad9-b657-7e91fe690a08.png align="center")

He included a `.jpg` extension :D (a good reminder of why you should rigorously test your written functions :3)

### **Credits**

* **Hashnode** - for the amazing platform
    
* **BUBT** - for the workshop

Solution of problem: NS2 given the BUBT CTF Bootcamp contest

NS2 | Network Security Series

network 𖧹 150pts

Problem Statement

Prerequisites

Solution

Credits