Thanks,
That partialy work, the hex numer are remove, but the ASCII trailer is alway present (im really bad in regex, can you help me please?)
00 6e 0b 00 .n..
4d 5a e8 00 00 00 00 5b 52 45 55 89 e5 81 c3 81 MZ.....[ REU.....
12 00 00 ff d3 89 c3 57 68 04 00 00 00 50 ff d0 .......W h....P..
68 f0 b5 a2 56 68 05 00 00 00 50 ff d3 00 00 00 h...Vh.. ..P.....
00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 ........ ........
Thanks you so much!
Francis Provencher Conseiller en sécurité de l'information Ministère de la Sécurité publique du Québec Direction des technologies de l'information Division de la sécurité informatique Tél: 1 418 646-6777 #30083 BlackBerry; 1 418 473 6419 Courriel: Francis.provencher@xxxxxxxxxxxxxx Certifié; SANS GCIA, SANS GPEN, SANS GSEC, C|EH, SSCP, Security +
>>> ronnie sahlberg <ronniesahlberg@xxxxxxxxx> 19/08/13 15:43 >>>
sed -e "s/[^ ]* //"
On Mon, Aug 19, 2013 at 12:21 PM, FRANCIS PROVENCHER
<FRANCIS.PROVENCHER@xxxxxxxxxxxxxx> wrote:
> Hi,
>
> I want to extract an exe from a TCP Stream.
>
> First i add a filter on wireshark, "tcp.stream eq 2010"
>
> I see after the 3 way handshack, the start of the .exe (HEX file Signature
> "4D 5a")
>
> The download of this executable is on 52000 packets, to extract the file, i
> have choose the option "follow TCP Stream" and after click on "Hex Dump"
> option.
>
> The output look like this;
>
> 00000000 00 6e 0b 00
> .n..
> 00000004 4d 5a e8 00 00 00 00 5b 52 45 55 89 e5 81 c3 81
> MZ.....[ REU.....
> 00000014 12 00 00 ff d3 89 c3 57 68 04 00 00 00 50 ff d0
> .......W h....P..
> 00000024 68 f0 b5 a2 56 68 05 00 00 00 50 ff d3 00 00 00
> h...Vh.. ..P.....
> 00000034 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00
> ........ ........
> 00000044 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68
> ........ !..L.!Th
> 00000054 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f
> is progr am canno
> 00000064 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20
> t be run in DOS
> 00000074 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00
> mode.... $.......
>
>
> How can i remove hex number and ascii trailer from this output to have some
> thing like this?
>
> 00 6e 0b 00
> 4d 5a e8 00 00 00 00 5b 52 45 55 89 e5 81 c3 81
> 12 00 00 ff d3 89 c3 57 68 04 00 00 00 50 ff d0
>
>
> Thanks all!
>
> Francis Provencher
> Conseiller en sécurité de l'information
> Ministère de la Sécurité publique du Québec
> Direction des technologies de l'information
> Division de la sécurité informatique
> Tél: 1 418 646-6777 #30083 BlackBerry; 1 418 473 6419
> Courriel: Francis.provencher@xxxxxxxxxxxxxx
>
> Certifié; SANS GCIA, SANS GPEN, SANS GSEC, C|EH, SSCP, Security +
>
>
> ___________________________________________________________________________
> Sent via: Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
> Archives: http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>
> mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe
___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe
|