SOCrate 5/6 - Vol de clés

Description

In June 2023, an operator of vital importance falls victim to an attack that compromises its entire information system. You received the Linux and Windows logs and must answer the investigators’ questions.

This challenge is part of a serie. The parts are numbered in the chronological order of the attack, but it is not necessary to solve them in order :

• SOCrate 1/6 - Technologie
• SOCrate 2/6 - Reverse shell
• SOCrate 3/6 - Outil téléchargé
• SOCrate 4/6 - Latéralisation
• SOCrate 5/6 - Vol de clés
• SOCrate 6/6 - Outil utilisé

The attacker wanted to retrieve a sensitive file from a machine, but did not have sufficient rights. He gave himself the permissions and then downloaded the file. Find the FQDN of the target machine and the path to this file. Also find the source IP address from which the attacker was operating to connect to the target machine.

Flag format (case insensitive): FCSC{FQDN_VICTIME|CHEMIN_ABSOLU|IP_SOURCE}

Example: FCSC{laptop-1337.gouv.lan|C:\Users\Public\secret.pdf|10.42.43.44}