You could try sniffing and reassembling smb traffic, possibly gleaning the target source files in the mix. Although it is possible that the blue-team is using promiscuous detection, this is likely the quietest way of reaching your flag. I do not know of a win32 tool which will do specifically tcp stream reassembly on win32. Someone on this list likely does, however. If there a nix somewhere in the mix, you could try http://www.hsc.fr/ressources/outils/smbsniff Good luck, Marten Kaye. ---------------------------------------------------------------------------- This list is provided by the SecurityFocus Security Intelligence Alert (SIA) Service. For more information on SecurityFocus' SIA service which automatically alerts you to the latest security vulnerabilities please see: https://alerts.securityfocus.com/
This archive was generated by hypermail 2b30 : Wed Sep 26 2001 - 08:01:58 PDT