Horreur, malheur 5/5 - Un peu de CTI

Description

You’ve just been hired as Chief Information Security Officer (CISO) for a strategic company.

Arriving at your office on your first day, you realize that your predecessor has left you a USB stick with a note on it: VPN compromised (integrity). Version 22.3R1 b1647.

You’ve almost completed your analysis! All that remains is to qualify the IP address present in the last command used by the attacker.

You need to determine which attacker group this IP address belongs to, as well as the legitimate management interface that was exposed at the time of the attack.

The flag is in the format: FCSC{<UNCXXXX>:<service name>}.

Note: This is a genuine malicious IP address, do not interact directly with this IP address.

This challenge has been split into five parts:

• Horreur, malheur 1/5 - Archive chiffrée.
• Horreur, malheur 2/5 - Accès initial.
• Horreur, malheur 3/5 - Simple persistance.
• Horreur, malheur 4/5 - Pas si simple persistance.
• Horreur, malheur 5/5 - Un peu de CTI.