> For the complete documentation index, see [llms.txt](https://crypt0nite.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://crypt0nite.gitbook.io/writeups/ctfs/hacktoberctf/traffic-analysis/an-evil-christmas-carol-1-and-2.md).

# An Evil Christmas Carol 1 and 2

#### Link to file: 

```
File: https://tinyurl.com/y259doyq
Password: hacktober
```

### An Evil Christmas Carol 1: 

#### Briefing: 

```
A malicious dll was downloaded over http in this traffic, what was the ip address that delivered this file?
```

Like the others, you can just filter for `http` traffic and get the flag: 

![](https://815184494-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MInDVexIZ47VkOdGSlp%2F-MKHmPbi2IbMHr1goQyB%2F-MKHnIygnUFBvV68YugC%2FScreenshot%202020-10-23%20at%2001.13.00.png?alt=media\&token=c6feb64c-b4f1-4107-a725-ea528c00b341)

`flag{205.185.125.104}` 

### An Evil Christmas Carol 2: 

#### Briefing: 

```
What is the domain used by the post-infection traffic over HTTPS?
Use the file from An Evil Christmas Carol.
```

We're looking for a domain, so it must be a `dns` query. Therefore filtering for DNS traffic and specifying the ip (`10.0.0.163` as this is the infected client from part 1, and the infected client must've made the query) we can get the flag- 

![](https://815184494-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MInDVexIZ47VkOdGSlp%2F-MKHmPbi2IbMHr1goQyB%2F-MKHoQj2-aoIJwcqO49b%2FScreenshot%202020-10-23%20at%2001.17.53.png?alt=media\&token=e88304c8-5f0d-47fb-950d-00fda0fd36be)

`flag{vlcafxbdjtlvlcduwhga.com}` 

By das