Packet Capture: The DNS Tunnel in the Noise

This is a REAL packet capture, not decoded text. /root/case/capture.pcap is a binary libpcap file — you open it with tcpdump, the way an analyst actually works a FOR572-style case.

10.0.0.5 is suspected of exfiltrating data. The attacker is tunnelling it out over DNS: an implant base32-encodes a secret and ships it one chunk at a time as the leading label of ordinary-looking A-record lookups, all under one attacker-controlled parent domain, hidden among genuine DNS and HTTP traffic. It then pulls a second-stage payload over plain HTTP.

Work the capture and record three findings:

1. /root/case/domain.txt — the attacker's DNS-tunnel parent domain. The tunnel queries look like <RANDOM-LABEL>.parent.domain; the leading labels are long and high-entropy (uppercase base32), unlike the real hostnames around them. Write the parent domain those random labels sit directly under.

2. /root/case/exfil.txt — the DECODED exfiltrated secret. Pull the leading labels of the tunnel queries in packet order, concatenate them, and base32-decode (base32 -d). The plaintext is the answer.

3. /root/case/payload.txt — the URL path of the second-stage HTTP download. tcpdump -A prints the GET request; record the path (e.g. /stage2/....bin).

Grading reads the files you write. An empty box, or a guess, fails — you have to read the capture. tcpdump, base32, awk, sed are all on the box; tshark is not.