Advent Of Cyber 2 Try Hack Me [Day 7] The Grinch really Did steal Christmas

Today in here I am going to do a walkthrough about Advent of cyber 2 — day 7

As the first step need to download the pcap file which is given by try hack me website. To view these files need to have some special software which can see the network packets in here I am going to you the software call Wireshark.
here is the link for download Wireshark

Open “pcap1.pcap” in Wireshark. What is the IP address that initiates an ICMP/ping?


So in filter bar type ICMP then it will show the results as it is shown in fig-1.

initial IP address can be found in first packet. Which is list as source IP so answer in

If we only wanted to see HTTP GET requests in our “pcap1.pcap” file, what filter would we use?

this is the format to get any type of request
<protocol>.request.method == <option>

So answer is http.request.method == GET

Now apply this filter to “pcap1.pcap” in Wireshark, what is the name of the article that the IP address “” visited?

To find out the visited pages I use the same which used in above part and add an extra part to it to filter so i can get a better view at pcap files

so you can see that i added this command in to previews command
&& ip.addr==

So in the hit they mention that website has DIR call posts in that DIR there is a page call reindeer-of-the-week
so answer is reindeer-of-the-week

Let’s begin analysing “pcap2.pcap”. Look at the captured FTP traffic; what password was leaked during the login process?

so in the question they mention something about ftp file so in filter bar we can put ftp and get all the ftp files in the pcap

when you go through this you can see a packet name PASS. that packet use password in plain text
so answer is plaintext_password_fiasco

Continuing with our analysis of “pcap2.pcap”, what is the name of the protocol that is encrypted?

In this file there are lot of packets use differces type of protocol to transfer data over network the only encrypted protocol in here is SSH
so answer is SSH

Analyse “pcap3.pcap” and recover Christmas!What is on Elf McSkidy’s wishlist that will be used to replace Elf McEage

so in pcap file when elf are transferring file they must use the http method so type http.request.method

you can see there are 2 packets if you follow the TCP stream in second packet you can see a file call wishlist.txt but its in encoded format so file must be in the second packet
now we need extract the file form second packet.

to get this you need select the second packet and go to file → export object →http the you will get a window like this then select the file and press save them zip file will be saved on you PC

So this is the wish list so the answer is Rubber Ducky




Associate security Engineer At Hsenid mobile

Love podcasts or audiobooks? Learn on the go with our new app.

Recommended from Medium

Digital identity and financial inclusion

Technical update: Guarda now has a custom SSL certificate

{UPDATE} Word Search : Brain Training Hack Free Resources Generator

Car Hacking. Yep, It’s a Thing.


Looking to backup and restore your wallet? Here’s how (Windows OS)

How we store your Stellar secret key

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store
mohomed arfath

mohomed arfath

Associate security Engineer At Hsenid mobile

More from Medium

Kathleen’s Five-Minute Writing Tip

Blue sparrow: the best reward in draws

Top 8 Cybersecurity Threats for 2022