Académie de l'investigation - Porte dérobée

Description

A remote machine is connected to the machine under analysis through a backdoor, with the ability to run arbitrary commands.

Questions:

• What is the port number listenning for this connexion?
• What is the remote IP address connected during the dump?
• What is the timestamp of the creation of the processus in UTC?

Note : The flag follows the format: FCSC{port:IP:YYYY-MM-DD HH:MM:SS}.

This challenge has been split into seven parts:

• Académie de l’investigation - C’est la rentrée.
• Académie de l’investigation - Administration.
• Académie de l’investigation - Premiers artéfacts.
• Académie de l’investigation - Porte dérobée.
• Académie de l’investigation - Rédaction.
• Académie de l’investigation - Partage.
• Académie de l’investigation - Dans les nuages.