Friday, January 6, 2017

The Four of Clubs

Metasploitable 3


The Four of Clubs


Using the meterpreter’s search command I looked for the four of clubs and downloaded a WAV file.

meterpreter > search -f four_of_clubs*
Found 3 results...
    C:\Program Files\OpenSSH\home\Public\Music\four_of_clubs.wav (550302 bytes)
    C:\Users\Public\Music\four_of_clubs.wav (550302 bytes)
    C:\vagrant\resources\flags\four_of_clubs.wav (550302 bytes)

meterpreter > cd Users
cmeterpreter > cd Public
meterpreter > cd Music
meterpreter > dir
Listing: C:\Users\Public\Music
==============================

Mode              Size    Type  Last modified              Name
----              ----    ----  -------------              ----
40776/rwxrwxrw-   0       dir   2009-07-14 00:57:55 -0400  Sample Music
100777/rwxrwxrwx  380     fil   2009-07-14 00:57:55 -0400  desktop.ini
100776/rwxrwxrw-  550302  fil   2016-11-25 20:47:41 -0500  four_of_clubs.wav

meterpreter > download four_of_clubs.wav

‘binwalk’ showed me there was a PNG file attached to the WAV file

root@igor-kali:~# binwalk four_of_clubs.wav

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
58            0x3A            PNG image, 521 x 729, 8-bit/color RGBA, non-interlaced
120           0x78            Zlib compressed data, best compression


I used ‘foremost’ this time to separate all the files


root@igor-kali:~# foremost four_of_clubs.wav
Processing: four_of_clubs.wav
|*|

root@igor-kali:~# cd output/
root@igor-kali:~/output# ls
audit.txt  png  wav
root@igor-kali:~/output# cd png/
root@igor-kali:~/output/png# ls

00000000.png

Serious guy!

No comments:

Post a Comment