Spot the phone-home
A machine may be infected. The capture at /home/student/case/capture.pcap has a few DNS lookups in it. One of them is a well-known site; the other is a suspicious domain the malware used to phone home.
Find the suspicious domain and write it down.
How it works: the terminal below is a real Linux machine running in your browser. Click it and
type. Tasks tick themselves off as you complete them; questions are answered in the box under each task.
Press Reset any time for a fresh machine. Your password on this machine (for
sudo) is student.
Hints
List the names with `tshark -r
Ignore the well-known site; the other name is the suspect.
Solution explanation
The lookups were www.debian.org (a normal site) and sync-update-cdn.net (made to sound like an update service, but not a real one). The odd name is the malware's phone-home, and writing it down gives the team an indicator to block and to hunt for on other machines. DNS is often the quickest place to catch an infection, because the lookup happens before any real data is even sent.
Show solution
tshark -r /home/student/case/capture.pcap -Y dns -T fields -e dns.qry.name 2>/dev/null | sort -u
echo 'C2 domain: sync-update-cdn.net' > /home/student/findings.txt