Decoding the Metasploit shell

Let's start investigating the file in Wireshark to try to deduce what happened. We will focus on gathering the following details:

• C2 server IP
• C2 server port
• Infected system IP
• Infected system's port
• Actions performed by the attacker
• Time of the attack
• Duration of the attack

Let's fire up Wireshark and choose Statistics | Conversations | TCP tab:

We can see that we have two conversations primarily between 192.168.46.128 and 192.168.46.129 on port 80 and 4433. Let's filter the conversation using TCP as the filter and analyze the output:

We can see that the first TCP packets (23-25) are nothing but the three-way handshake. However, next, we have a separate conversation starting from packet 71. Another strange thing is that the communication port being used is port 80. However, for some reason, the data being displayed is...