SMB Lateral Movement: Admin Share and svcctl in a PCAP
Endpoint telemetry on an application server reported a new service installed at 02:17 UTC, with a binary nobody recognises. The server sits on the same switch as a mirror port, and the network team kept a capture from that minute.
The internal network is 10.10.0.0/16, with workstations in 10.10.20.0/24 and servers in 10.10.50.0/24. SMB2 is decoded at header level here: command, status, tree (share) path and file name. Everything in this file is synthetic: private addresses, made-up host names and a "binary" made of filler text.
What you will find in the capture
- Background: ARP, DNS and a normal SMB connection to a department share
- A second SMB session that authenticates and connects to more than one share
- A file write, and then a named pipe opened on the same server
SMB Lateral Movement: Admin Share and svcctl in a PCAP
Endpoint telemetry on an application server reported a new service installed at 02:17 UTC, with a binary nobody recognises. The server sits on the same switch as a mirror port, and the network team kept a capture from that minute.
The internal network is 10.10.0.0/16, with workstations in 10.10.20.0/24 and servers in 10.10.50.0/24. SMB2 is decoded at header level here: command, status, tree (share) path and file name. Everything in this file is synthetic: private addresses, made-up host names and a "binary" made of filler text.
You will practise
- Follow an SMB2 session from Negotiate to Logoff
- Read tree connect paths to see which shares were used
- Spot a file written to an administrative share
- Recognise the svcctl named pipe and what it is for
- Separate ordinary file sharing from remote administration
8 questions. Each hint costs 25% of that question’s points; a wrong try costs a little. Your score is out of 100.
Loading the capture…
Loading…
Sample report · illustrative data
Sample result: Cleartext HTTP Login case
Example run of the starter case on a synthetic capture (documentation and private IP ranges, .example names, a made-up account).
Scoring
- Score
- 82/100 (example)
- Grade
- B, solid analysis
- Hints used
- 2 (example)
- Time
- 6m 40s (example)
Findings in the example run
| Question | Filter that finds it | Read |
|---|---|---|
| Where is the login submitted? | http.request.method == "POST" | One POST to the intranet over port 80 |
| What crossed the wire? | http.file_data contains "username=" | Username and password readable as typed |
| Did it work? | http.response.code == 302 | Redirect plus a session cookie without Secure |
Recommended next steps (example)
- Serve the intranet over HTTPS only, with HSTS and Secure cookies
- Reset the exposed password and end the account's sessions
- Search wider captures for other cleartext logins
Made-up example data. Your own run uses your inputs. Downloads of the full report need Pro.
Downloads
Take the capture into Wireshark or your own tools, and keep the analyst report with the answer key.
17.7 kB · 104 packets · SHA-256 dfe26b720395e1d9825aeab2aeef60d1385f1f7cb8b8181e637de1bbea3da21f
Sample of the debrief
This capture shows a workstation authenticating to a server over SMB2, writing an executable to the ADMIN$ share and then opening the svcctl named pipe on IPC$. That sequence is how a remote service is created to run a copied binary: lateral movement with administrator credentials, unless an administrator can show it was planned.
The full debrief, with next steps and the MITRE ATT&CK mapping, appears when you finish the case.
What you will learn
- Follow an SMB2 session from Negotiate to Logoff
- Read tree connect paths to see which shares were used
- Spot a file written to an administrative share
- Recognise the svcctl named pipe and what it is for
- Separate ordinary file sharing from remote administration
Frequently asked questions
How do you detect lateral movement over SMB in a PCAP?
Filter SMB2 tree connects (smb2.tree) and look for administrative shares such as ADMIN$, C$ and IPC$ from workstations to servers, then for CREATE requests that write executables and for named pipes like svcctl being opened.
What is the svcctl named pipe?
It is the endpoint of the Windows Service Control Manager remote interface. Tools that run commands remotely bind to it over DCE/RPC to create and start a service on the target.
What is the difference between ADMIN$ and IPC$?
ADMIN$ is a hidden share that maps to the Windows folder and needs administrator rights. IPC$ carries named pipes for remote procedure calls; it holds no files.
How do you find which file was copied over SMB?
File names are in SMB2 CREATE requests. Filter smb2.filename, check the Tree ID against the tree connect to see which share it was on, then follow the WRITE requests on that file.
Is this real traffic?
No. PlayCISO generated it from a fixed seed with private addresses, made-up host names and locally administered MAC addresses. The "executable" is filler text and the pipe messages carry no real RPC calls.