2026-03-03 07:16:54 网络安全文章来源：ZONE.CI 全球网 0 阅读模式

文章总结： 文章分析Sharkfest2019EUPacketChallenge中的SMBForce案例，通过Wireshark抓包解答了SMB服务器数量、TIE战斗机IP地址、NTLM认证用户名、SMB方言版本等问题。作者使用tshark展示了Kerberos和NTLM认证信息提取、SMB协议协商分析等技巧，文章由AI辅助续写，为网络协议分析提供了实战参考。 综合评分： 68 文章分类： CTF,实战经验,安全工具

cover_image

Wireshark TS | Packet Challenge 之 SMB 案例分析

原创

7ACE 7ACE

Echo Reply

2026年2月23日 10:20 江苏

AI 恐怖如斯

前言

来自于 Sharkfest Packet Challenge 中的一个数据包案例，Sharkfest 是 Wireshark 官方组织的一年一度的大会，致力于在 Wireshark 开发人员和用户社区之间分享知识、经验和最佳实践。印象中早期是一年一次，近几年发展成一年两次，一次貌似固定在美国，一次会在其他地区，像是欧洲或亚洲。Packet Challenge 是大会其中一个比较有意思的活动环节，通过一系列数据包案例设置关卡，参会人员进行分析挑战，测试综合分析能力。

说明：

1、本篇原稿实际是一篇很老的存货，当时对 SMB 协议以及《星球大战》系列电影都不太熟悉，所以并没有写完；

2、此次更新完全依靠 AI Agent 所进行的续写，我只是通读了下，并没有关注案例分析的准确性；

3、同时发表一篇使用 AI Agent 针对原始数据包直接输出的分析报告，供参考。

题目信息

本次案例为 Sharkfest 2019 EU Packet Challenge 中的第四个题目 SMBForce，数据包跟踪文件为 SMBForce.pcapng 。

主要描述如下：

For this part of the packet challenge we have shamelessly recycled trace files that were captured for the preparation of the 2018 Sharkfest. You will quickly notice that the trace is rooted in the Star Wars universe. Show us that you are a true Packet Jedi!

How many SMB servers are used in this network?
There is a Tie Fighter zapping through the network. What is it’s IP address?
The TIE fighter’s pilot (or user) should be authorized by a Kerberos ticket. Oops. For once the pilot slipped and used NTLM for authentication. What is the username?
Which SMB or SMB2 Dialect is used by the Tie fighter when approaching Corelia?
The last question is only for true Jedi Masters: The username found for question 3 is somewhat short. What is the “Full Name” for that account?

数据包信息

数据包跟踪文件基本信息如下：

λ capinfos SMBForce.pcapng
File name: &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; SMBForce.pcapng
File&nbsp;type: &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Wireshark/... - pcapng
File encapsulation: &nbsp;Ethernet
File timestamp precision: &nbsp;nanoseconds (9)
Packet size&nbsp;limit: &nbsp; file hdr: (not&nbsp;set)
Number of packets: &nbsp; 55 k
File size: &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 49 MB
Data size: &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 47 MB
Capture duration: &nbsp; &nbsp;1688.720064374 seconds
First packet time: &nbsp; 2018-10-31 23:01:14.750214708
Last packet time: &nbsp; &nbsp;2018-10-31 23:29:23.470279082
Data byte rate: &nbsp; &nbsp; &nbsp;28 kBps
Data bit rate: &nbsp; &nbsp; &nbsp; 225 kbps
Average packet size: 862.52 bytes
Average packet rate: 32 packets/s
SHA256: &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;dc4db6a295ed531d2c9ae4de33b1027653e86e85c9a663818bc385441f317989
RIPEMD160: &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 31bc0708e324473fda6a8cf5cc99ab2b38d48a26
SHA1: &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;2be9a9ea0d5180ce0622b39d64893bdf3b16ac73
Strict time order: &nbsp; False
Capture hardware: &nbsp; &nbsp;Intel(R) Xeon(R) CPU E5-2630 v4 @ 2.20GHz (with SSE4.2)
Capture oper-sys: &nbsp; &nbsp;Linux 4.9.0-8-amd64
Capture application: Dumpcap (Wireshark) 2.6.3 (Git v2.6.3 packaged as 2.6.3-1~deb9u1)
Number of interfaces&nbsp;in&nbsp;file: 5
Interface&nbsp;#0&nbsp;info:
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Name = ens161
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Encapsulation = Ethernet (1 - ether)
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Capture length = 262144
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Time precision = nanoseconds (9)
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Time ticks per second = 1000000000
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Time resolution = 0x09
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Operating system = Linux 4.9.0-8-amd64
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Number of&nbsp;stat&nbsp;entries = 0
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Number of packets = 1
Interface&nbsp;#1&nbsp;info:
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Name = ens193
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Encapsulation = Ethernet (1 - ether)
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Capture length = 262144
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Time precision = nanoseconds (9)
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Time ticks per second = 1000000000
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Time resolution = 0x09
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Operating system = Linux 4.9.0-8-amd64
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Number of&nbsp;stat&nbsp;entries = 0
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Number of packets = 0
Interface&nbsp;#2&nbsp;info:
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Name = ens224
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Encapsulation = Ethernet (1 - ether)
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Capture length = 262144
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Time precision = nanoseconds (9)
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Time ticks per second = 1000000000
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Time resolution = 0x09
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Operating system = Linux 4.9.0-8-amd64
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Number of&nbsp;stat&nbsp;entries = 0
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Number of packets = 55090
Interface&nbsp;#3&nbsp;info:
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Name = ens225
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Encapsulation = Ethernet (1 - ether)
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Capture length = 262144
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Time precision = nanoseconds (9)
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Time ticks per second = 1000000000
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Time resolution = 0x09
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Operating system = Linux 4.9.0-8-amd64
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Number of&nbsp;stat&nbsp;entries = 0
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Number of packets = 0
Interface&nbsp;#4&nbsp;info:
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Name = ens256
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Encapsulation = Ethernet (1 - ether)
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Capture length = 262144
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Time precision = nanoseconds (9)
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Time ticks per second = 1000000000
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Time resolution = 0x09
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Filter string = not port 3389
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Operating system = Linux 4.9.0-8-amd64
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Number of&nbsp;stat&nbsp;entries = 0
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Number of packets = 0

在 Linux 系统上通过 Dumpcap (Wireshark) 捕获，无截断，捕获文件较大为 49 MB，捕获数据包数量 55K 个，捕获持续时间为 1688 秒，平均速率 225 kbps 。此外，和以前的跟踪文件相比，该跟踪文件中接口数量较多，5个。

统计会话信息显示如下，多个捕获接口以及捕获时长较长的原因，IPv4 和 TCP 会话对很多，需要根据实际问题具体分析。

专家信息如下，同样如此，数据包数量一多，相对而言问题数量也会越多。

数据包分析

考虑到数据包数量较多且较杂，直接切入问题进行针对分析。

1. How many SMB servers are used in this network?

网络中使用了多少个 SMB 服务器?

分析步骤

通过显示过滤表达式 smb or smb2 可过滤 SMB 协议数据包，共计 970 个，如下。

统计-协议分层信息如下，包括 UDP NBDS、TCP NBSS 等。

统计-端点信息如下，排序 445 端口可知，总共有 10.1.1.1、10.1.1.2、10.1.1.3 三台 SMB 服务器。

λ tshark -r SMBForce.pcapng -Y&nbsp;"(smb or smb2) and (tcp.dstport==445)"&nbsp;-T fields -e ip.dst | sort | uniq
10.1.1.1
10.1.1.2
10.1.1.3

分析答案

网络中使用了多少个 SMB 服务器?：3 个服务器。

2. There is a Tie Fighter zapping through the network. What is it’s IP address?

有一架 Tie 战斗机在网络中穿梭。它的 IP 地址是什么?

分析步骤

啥是 Tie Fighter ？？？百度了下才知道是 TIE 战斗机（星球大战里的一种星际战斗机）。虽然对 SMB 协议不熟悉，但不妨碍解题，可以简单查询下 Kerberos 认证信息，毕竟题目提示了 TIE fighter’s pilot ，意味着会有相关的认证信息。

通过显示过滤表达式 kerberos.CNameString 过滤 Kerberos 主体名称信息，如下：

λ tshark -r SMBForce.pcapng -Y&nbsp;"kerberos.CNameString"&nbsp;-T fields -e frame.number -e ip.src -e ip.dst -e kerberos.CNameString
2892 &nbsp; &nbsp;10.20.20.20 &nbsp; &nbsp; 10.1.1.1 &nbsp; &nbsp; &nbsp; &nbsp;[email protected]
2900 &nbsp; &nbsp;10.20.20.20 &nbsp; &nbsp; 10.1.1.1 &nbsp; &nbsp; &nbsp; &nbsp;[email protected]
2901 &nbsp; &nbsp;10.1.1.1 &nbsp; &nbsp; &nbsp; &nbsp;10.20.20.20 &nbsp; &nbsp; drk-1
2912 &nbsp; &nbsp;10.1.1.1 &nbsp; &nbsp; &nbsp; &nbsp;10.20.20.20 &nbsp; &nbsp; drk-1
3194 &nbsp; &nbsp;10.1.1.1 &nbsp; &nbsp; &nbsp; &nbsp;10.20.20.20 &nbsp; &nbsp; drk-1
3585 &nbsp; &nbsp;10.20.20.20 &nbsp; &nbsp; 10.1.1.1 &nbsp; &nbsp; &nbsp; &nbsp;[email protected]
3594 &nbsp; &nbsp;10.20.20.20 &nbsp; &nbsp; 10.1.1.1 &nbsp; &nbsp; &nbsp; &nbsp;[email protected]
3595 &nbsp; &nbsp;10.1.1.1 &nbsp; &nbsp; &nbsp; &nbsp;10.20.20.20 &nbsp; &nbsp; drk-1
32190 &nbsp; 10.20.20.20 &nbsp; &nbsp; 10.1.1.2 &nbsp; &nbsp; &nbsp; &nbsp;tiefighter$
32204 &nbsp; 10.20.20.20 &nbsp; &nbsp; 10.1.1.2 &nbsp; &nbsp; &nbsp; &nbsp;tiefighter$
32207 &nbsp; 10.1.1.2 &nbsp; &nbsp; &nbsp; &nbsp;10.20.20.20 &nbsp; &nbsp; TIEFIGHTER$
...

可以看到有两个不同的主体名称：drk-1 和 tiefighter$，其中 tiefighter$ 明显就是 TIE 战斗机的计算机账户名称，而发起该 Kerberos 认证的源 IP 正是 10.20.20.20 。

进一步验证，通过显示过滤表达式 ntlmssp 过滤 NTLM 认证信息，同样可以看到 10.20.20.20 作为源 IP 进行了 NTLM 认证：

λ tshark -r SMBForce.pcapng -Y&nbsp;"ntlmssp.auth.username"&nbsp;-T fields -e frame.number -e ip.src -e ip.dst -e ntlmssp.auth.username -e ntlmssp.auth.domain
3612 &nbsp; &nbsp;10.20.20.20 &nbsp; &nbsp; 10.1.1.3 &nbsp; &nbsp; &nbsp; &nbsp;drk-1 &nbsp; OUTERRIM
42108 &nbsp; 10.1.1.3 &nbsp; &nbsp; &nbsp; &nbsp;10.1.1.1 &nbsp; &nbsp; &nbsp; &nbsp;NULL &nbsp; &nbsp;NULL

结合题目描述 “Tie Fighter zapping through the network”（TIE 战斗机在网络中穿梭），10.20.20.20 这个 IP 不仅使用了 tiefighter$ 计算机账户进行 Kerberos 认证，还使用 drk-1 用户账户进行了 NTLM 认证，在网络中相当活跃，符合 “穿梭” 的描述。

分析答案

有一架 Tie 战斗机在网络中穿梭。它的 IP 地址是什么?：10.20.20.20 。

#

3. The TIE fighter’s pilot (or user) should be authorized by a Kerberos ticket. Oops. For once the pilot slipped and used NTLM for authentication. What is the username?

TIE 战斗机的飞行员(或用户)应该通过 Kerberos 票据进行授权。哦，有一次，飞行员滑倒了，使用 NTLM 进行验证。用户名是什么?

分析步骤

题目明确指出飞行员本应使用 Kerberos 票据进行授权，但有一次 “滑倒了” 使用了 NTLM 进行验证。这意味着需要在数据包中找出使用 NTLM 认证的情况。

通过显示过滤表达式 ntlmssp.auth.username 过滤 NTLM 认证中的用户名字段：

λ tshark -r SMBForce.pcapng -Y&nbsp;"ntlmssp.auth.username"&nbsp;-T fields -e frame.number -e ip.src -e ip.dst -e ntlmssp.auth.username -e ntlmssp.auth.domain
3612 &nbsp; &nbsp;10.20.20.20 &nbsp; &nbsp; 10.1.1.3 &nbsp; &nbsp; &nbsp; &nbsp;drk-1 &nbsp; OUTERRIM
42108 &nbsp; 10.1.1.3 &nbsp; &nbsp; &nbsp; &nbsp;10.1.1.1 &nbsp; &nbsp; &nbsp; &nbsp;NULL &nbsp; &nbsp;NULL

可以看到在 Frame 3612 中，源 IP 10.20.20.20 向目标 IP 10.1.1.3 发起了 NTLM 认证，使用的用户名为 drk-1，域为 OUTERRIM 。

展开 Frame 3612 的详细数据包信息，可以看到 SMB2 Session Setup Request 中包含了 NTLMSSP_AUTH 认证信息：

Frame 3612: 671 bytes on wire (5368 bits), 636 bytes captured
...
SMB2 (Server Message Block Protocol version 2)
&nbsp; &nbsp; Session Setup Request, NTLMSSP_AUTH, User: OUTERRIM\drk-1
&nbsp; &nbsp; &nbsp; &nbsp; NTLMSSP
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; NTLMSSP Identifier: NTLMSSP
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; NTLMSSP Message Type: NTLMSSP_AUTH (0x00000003)
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; NTLMSSP_AUTH
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; NTLM Client Challenge Response
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; NTLMv2 Response
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; User Name: drk-1
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Domain Name: OUTERRIM

而 Frame 42108 中的 NTLM 认证用户名为 NULL，属于匿名认证，并非题目所问的飞行员使用的认证。

结合问题 2 的分析，10.20.20.20 就是 TIE 战斗机的 IP 地址，而它使用 NTLM 认证的用户名正是 drk-1 。

分析答案

使用 NTLM 进行验证的用户名是什么?：drk-1 。

4. Which SMB or SMB2 Dialect is used by the Tie fighter when approaching Corelia?

Tie 战斗机在接近 Corelia 时使用哪种 SMB 或 SMB2 方言?

分析步骤

题目中的 “Corelia” 应该是指网络中的某台服务器。结合前面的分析，10.1.1.1 是域控制器 Corelia.outerrim.local，也就是说问的是 TIE 战斗机（10.20.20.20）使用的 SMB/SMB2 方言版本。

SMB2 的方言版本是在 Negotiate 阶段协商确定的。直接查看 TIE 战斗机（10.20.20.20）相关的 SMB Negotiate Response：

λ tshark -r SMBForce.pcapng -Y&nbsp;"smb2.cmd==0 && smb2.dialect && ip.dst==10.20.20.20"&nbsp;-T fields -e frame.number -e ip.src -e smb2.dialect
3579 &nbsp; &nbsp;10.1.1.3 &nbsp; &nbsp; &nbsp; &nbsp;0x0202
3581 &nbsp; &nbsp;10.1.1.3 &nbsp; &nbsp; &nbsp; &nbsp;0x0210

可以看到服务器返回了两个协商响应：

Frame 3579: 0x0202 表示 SMB 2.0.2
Frame 3581: 0x0210 表示 SMB 2.1.0

SMB 协商过程中，客户端先发送 SMB1 Negotiate Request（包含支持的方言列表），服务器如果支持 SMB2，会返回 SMB2 Negotiate Response。Frame 3579 是 SMB1 协商响应（选择 SMB 2.002 方言），Frame 3581 是 SMB2 协商响应，最终确定的方言是 SMB 2.1.0（0x0210）。

分析答案

Tie 战斗机在接近 Corelia 时使用哪种 SMB 或 SMB2 方言?：SMB 2.1.0 。

#

5. The last question is only for true Jedi Masters: The username found for question 3 is somewhat short. What is the “Full Name” for that account?

最后一个问题只针对真正的绝地大师：第三个问题的用户名有点短。那个账户的“全名”是什么?

分析步骤

题目要求找出问题 3 中用户名 drk-1 对应的账户全名（Full Name）。在 Windows 域环境中，用户账户的全名通常存储在 Active Directory 中，可以通过 SAMR（Security Account Manager Remote）协议查询获取。

从前面的分析可知，攻击者 10.20.20.20 通过 SAMR 接口进行了用户信息查询，因此查看 SAMR QueryUserInfo 响应中的详细信息：

λ tshark -r SMBForce.pcapng -Y&nbsp;"samr && ip.src==10.1.1.1"&nbsp;-T fields -e frame.number -e _ws.col.Info
4277 &nbsp; &nbsp;Connect5 response
4279 &nbsp; &nbsp;EnumDomains response
4281 &nbsp; &nbsp;LookupDomain response
4283 &nbsp; &nbsp;OpenDomain response
4285 &nbsp; &nbsp;OpenDomain response
4287 &nbsp; &nbsp;LookupNames response
4289 &nbsp; &nbsp;OpenUser response
4291 &nbsp; &nbsp;QueryUserInfo response &nbsp; &nbsp;<-- 用户信息查询响应
4293 &nbsp; &nbsp;QuerySecurity response
4295 &nbsp; &nbsp;GetGroupsForUser response
...

Frame 4291 是 QueryUserInfo 响应，应该包含用户的全名信息。展开该数据包的详细内容：

λ tshark -r SMBForce.pcapng -Y&nbsp;"frame.number==4291"&nbsp;-V | grep -A 50&nbsp;"QueryUserInfo"
SAMR (pidl), QueryUserInfo
&nbsp; &nbsp; Operation: QueryUserInfo (36)
&nbsp; &nbsp; [Request&nbsp;in&nbsp;frame: 4290]
&nbsp; &nbsp; Pointer to Info (samr_UserInfo)
&nbsp; &nbsp; &nbsp; &nbsp; samr_UserInfo
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Info
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Info21
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Last Logon: Oct 31, 2018 23:02:35.112174800 CST
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Last Logoff: No time specified (0)
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Last Password Change: Oct 31, 2018 21:35:44.262806900 CST
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Acct Expiry: Infinity (absolute time)
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Allow Password Change: Nov &nbsp;1, 2018 21:35:44.262806900 CST
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Force Password Change: Infinity (absolute time)
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Account Name:
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Account Name: drk-1
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Full Name:
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Full Name: DRK-1 Probe Droid
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Home Directory:
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Home Drive:
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Logon Script:
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ...

可以看到在 SAMR QueryUserInfo 响应中，用户账户信息包含：

| 字段 | 值 | | — | — | | Account Name | drk-1 | | Full Name | DRK-1 Probe Droid | | Last Logon | Oct 31, 2018 23:02:35 | | Last Password Change | Oct 31, 2018 21:35:44 |

这个全名 “DRK-1 Probe Droid”（DRK-1 探测机器人）与星球大战的设定相符，DRK-1 是一种探测机器人（Probe Droid），用于侦察和情报收集，正好对应题目中 “TIE 战斗机的飞行员” 的设定。

分析答案

账户的”全名”是什么?：DRK-1 Probe Droid 。

往期推荐

1. Wireshark 提示和技巧 | 捕获点之 TCP 三次握手

2. Wireshark 提示和技巧 | a == ${a} 显示过滤宏

3. Wireshark TS | 当超时或快速重传遇到零窗口

4. Wireshark TS | 防火墙空闲会话超时问题

5. 网络设备 MTU MSS Jumboframe 全解

后台回复「TT」获取 Wireshark 提示和技巧系列 合集

后台回复「TS」获取 Wireshark Troubleshooting系列 合集

如需交流，可后台直接留言，我会在第一时间回复，谢谢！

免责声明：

本文所载程序、技术方法仅面向合法合规的安全研究与教学场景，旨在提升网络安全防护能力，具有明确的技术研究属性。

任何单位或个人未经授权，将本文内容用于攻击、破坏等非法用途的，由此引发的全部法律责任、民事赔偿及连带责任，均由行为人独立承担，本站不承担任何连带责任。

本站内容均为技术交流与知识分享目的发布，若存在版权侵权或其他异议，请通过邮件联系处理，具体联系方式可点击页面上方的联系我。

本文转载自：Echo Reply 7ACE 7ACE《Wireshark TS | Packet Challenge 之 SMB 案例分析》