Name Dropper
Easy 15 ptsA workstation that is supposedly idle. No TCP sessions the firewall would have caught — all it does is look up names. It is still exfiltrating data, one query at a time. Reassemble what left the building.
Hints
Open them in order. They nudge, they do not solve.
Hint 1
Filter dns and read the query names. Most are ordinary; a handful share a suffix that is not.
Hint 2
Those queries are numbered in their first label, and the second half of each label is hexadecimal.
Hint 3
Concatenate the hex in index order and decode as ASCII. dns.qry.name contains "exfil" isolates them.
The capture
Forged on this server. Open it in Wireshark, or run
tshark -r resolve.pcap.