Search the Community

Anyone been able to decode DJI Mavic air flight logs, exported using Assistant 2? Files compressed with zlib. Decompression shows some plain text, but a lot of random symbols etc

Hello! I have a wifi pineapple mark V that fights with me, it don't want to work.. It disconnects sometimes. I use the pineapple with an 3g modem and i have the logs if somebody want to check it out for me, THANKS! Logs: Syslog Output:Sep 24 21:50:38 Pineapple daemon.info hostapd: wlan0: STA 00:22:fa:55:7d:72 WPA: group key handshake completed (RSN) Sep 24 21:50:26 Pineapple daemon.info dnsmasq[2093]: using local addresses only for domain lan Sep 24 21:50:26 Pineapple daemon.info dnsmasq[2093]: using nameserver 8.8.8.8#53 Sep 24 21:50:26 Pineapple daemon.info dnsmasq[2093]: using nameserver 8.8.8.8#53 Sep 24 21:50:26 Pineapple daemon.info dnsmasq[2093]: using nameserver 195.54.122.221#53 Sep 24 21:50:26 Pineapple daemon.info dnsmasq[2093]: using nameserver 195.54.122.211#53 Sep 24 21:50:26 Pineapple daemon.info dnsmasq[2093]: reading /tmp/resolv.conf.auto Sep 24 21:50:25 Pineapple user.notice firewall: Reloading firewall due to ifup of wan2 (3g-wan2) Sep 24 21:50:25 Pineapple daemon.debug pppd[15135]: Script /lib/netifd/ppp-up finished (pid 15158), status = 0x1 Sep 24 21:50:24 Pineapple daemon.notice netifd: Interface 'wan2' is now up Sep 24 21:50:24 Pineapple daemon.debug pppd[15135]: Script /lib/netifd/ppp-up started (pid 15158) Sep 24 21:50:24 Pineapple daemon.notice pppd[15135]: secondary DNS address 195.54.122.211 Sep 24 21:50:24 Pineapple daemon.notice pppd[15135]: primary DNS address 195.54.122.221 Sep 24 21:50:24 Pineapple daemon.notice pppd[15135]: remote IP address 10.64.64.64 Sep 24 21:50:24 Pineapple daemon.notice pppd[15135]: local IP address 46.194.125.212 Sep 24 21:50:24 Pineapple daemon.warn pppd[15135]: Could not determine remote IP address: defaulting to 10.64.64.64 Sep 24 21:50:24 Pineapple daemon.debug pppd[15135]: rcvd [iPCP ConfAck id=0x6 ] Sep 24 21:50:24 Pineapple daemon.debug pppd[15135]: sent [iPCP ConfAck id=0x61] Sep 24 21:50:24 Pineapple daemon.debug pppd[15135]: rcvd [iPCP ConfReq id=0x61] Sep 24 21:50:24 Pineapple daemon.debug pppd[15135]: sent [iPCP ConfReq id=0x6 ] Sep 24 21:50:24 Pineapple daemon.debug pppd[15135]: rcvd [iPCP ConfNak id=0x5 ] Sep 24 21:50:24 Pineapple daemon.debug pppd[15135]: sent [iPCP ConfNak id=0x60 ] Sep 24 21:50:24 Pineapple daemon.debug pppd[15135]: rcvd [iPCP ConfReq id=0x60] Sep 24 21:50:23 Pineapple daemon.debug pppd[15135]: sent [iPCP ConfReq id=0x5 ] Sep 24 21:50:23 Pineapple daemon.debug pppd[15135]: rcvd [iPCP ConfNak id=0x4 ] Sep 24 21:50:22 Pineapple daemon.debug pppd[15135]: sent [iPCP ConfReq id=0x4 ] Sep 24 21:50:22 Pineapple daemon.debug pppd[15135]: rcvd [iPCP ConfNak id=0x3 ] Sep 24 21:50:21 Pineapple daemon.debug pppd[15135]: sent [iPCP ConfReq id=0x3 ] Sep 24 21:50:21 Pineapple daemon.debug pppd[15135]: rcvd [iPCP ConfNak id=0x2 ] Sep 24 21:50:20 Pineapple daemon.debug pppd[15135]: sent [iPCP ConfReq id=0x2 ] Sep 24 21:50:20 Pineapple daemon.debug pppd[15135]: rcvd [iPCP ConfNak id=0x1 ] Sep 24 21:50:19 Pineapple daemon.debug pppd[15135]: sent [iPCP ConfReq id=0x1 ] Sep 24 21:50:19 Pineapple daemon.notice pppd[15135]: CHAP authentication succeeded Sep 24 21:50:19 Pineapple daemon.info pppd[15135]: CHAP authentication succeeded Sep 24 21:50:19 Pineapple daemon.debug pppd[15135]: rcvd [CHAP Success id=0x1 ""] Sep 24 21:50:19 Pineapple daemon.debug pppd[15135]: rcvd [LCP EchoRep id=0x0 magic=0xad46dc8 13 96 3e 4b] Sep 24 21:50:19 Pineapple daemon.debug pppd[15135]: sent [CHAP Response id=0x1 , name = "shwkad"] Sep 24 21:50:19 Pineapple daemon.debug pppd[15135]: rcvd [CHAP Challenge id=0x1 <36c94fc6f05d23a0b289ec718c3f4460>, name = "UMTS_CHAP_SRVR"] Sep 24 21:50:19 Pineapple daemon.debug pppd[15135]: rcvd [LCP DiscReq id=0x4a magic=0xad46dc8] Sep 24 21:50:19 Pineapple daemon.debug pppd[15135]: sent [LCP EchoReq id=0x0 magic=0x13963e4b] Sep 24 21:50:19 Pineapple daemon.debug pppd[15135]: sent [LCP ConfAck id=0x49 ] Sep 24 21:50:19 Pineapple daemon.debug pppd[15135]: rcvd [LCP ConfReq id=0x49 ] Sep 24 21:50:19 Pineapple daemon.debug pppd[15135]: rcvd [LCP ConfAck id=0x1 ] Sep 24 21:50:19 Pineapple daemon.debug pppd[15135]: sent [LCP ConfRej id=0x48 ] Sep 24 21:50:19 Pineapple daemon.debug pppd[15135]: rcvd [LCP ConfReq id=0x48 ] Sep 24 21:50:19 Pineapple daemon.debug pppd[15135]: sent [LCP ConfReq id=0x1 ] Sep 24 21:50:18 Pineapple daemon.notice pppd[15135]: Connect: 3g-wan2 <--> /dev/ttyUSB0 Sep 24 21:50:18 Pineapple daemon.info pppd[15135]: Using interface 3g-wan2 Sep 24 21:50:18 Pineapple daemon.debug pppd[15135]: using channel 102 Sep 24 21:50:18 Pineapple daemon.info pppd[15135]: Serial connection established. Sep 24 21:50:18 Pineapple daemon.debug pppd[15135]: Script USE_APN=internet.telenor.se /usr/sbin/chat -t5 -v -E -f /etc/chatscripts/3g.chat finished (pid 15138), status = 0x0 Sep 24 21:50:18 Pineapple local2.info chat[15139]: send ( ^M) Sep 24 21:50:18 Pineapple local2.info chat[15139]: -- got it Sep 24 21:50:18 Pineapple local2.info chat[15139]: CONNECT Sep 24 21:50:18 Pineapple local2.info chat[15139]: ATD*99***1#^M^M Sep 24 21:50:18 Pineapple local2.info chat[15139]: ^M Sep 24 21:50:18 Pineapple local2.info chat[15139]: expect (CONNECT) Sep 24 21:50:18 Pineapple local2.info chat[15139]: send (ATD*99***1#^M) Sep 24 21:50:18 Pineapple local2.info chat[15139]: -- got it Sep 24 21:50:18 Pineapple local2.info chat[15139]: OK Sep 24 21:50:18 Pineapple local2.info chat[15139]: AT+CGDCONT=1,"IP","internet.telenor.se"^M^M Sep 24 21:50:18 Pineapple local2.info chat[15139]: ^M Sep 24 21:50:18 Pineapple local2.info chat[15139]: expect (OK) Sep 24 21:50:18 Pineapple local2.info chat[15139]: timeout set to 30 seconds Sep 24 21:50:18 Pineapple local2.info chat[15139]: send (AT+CGDCONT=1,"IP","internet.telenor.se"^M) Sep 24 21:50:18 Pineapple local2.info chat[15139]: -- got it Sep 24 21:50:18 Pineapple local2.info chat[15139]: OK Sep 24 21:50:18 Pineapple local2.info chat[15139]: ATE1^M^M Sep 24 21:50:18 Pineapple local2.info chat[15139]: ^M Sep 24 21:50:18 Pineapple local2.info chat[15139]: expect (OK) Sep 24 21:50:18 Pineapple local2.info chat[15139]: send (ATE1^M) Sep 24 21:50:18 Pineapple local2.info chat[15139]: -- got it Sep 24 21:50:18 Pineapple local2.info chat[15139]: OK Sep 24 21:50:18 Pineapple local2.info chat[15139]: AT&F^M^M Sep 24 21:50:18 Pineapple local2.info chat[15139]: expect (OK) Sep 24 21:50:18 Pineapple local2.info chat[15139]: send (AT&F^M) Sep 24 21:50:18 Pineapple local2.info chat[15139]: timeout set to 10 seconds Sep 24 21:50:18 Pineapple local2.info chat[15139]: report (CONNECT) Sep 24 21:50:18 Pineapple local2.info chat[15139]: abort on (ERROR) Sep 24 21:50:18 Pineapple local2.info chat[15139]: abort on (NO CARRIER) Sep 24 21:50:18 Pineapple local2.info chat[15139]: abort on (BUSY) Sep 24 21:50:17 Pineapple daemon.notice pppd[15135]: pppd 2.4.5 started by root, uid 0 Sep 24 21:50:16 Pineapple daemon.notice netifd: wan2 (15115): Trying to set mode Sep 24 21:50:14 Pineapple daemon.notice netifd: Interface 'wan2' is now down Sep 24 21:50:14 Pineapple daemon.info pppd[14409]: Exit. Sep 24 21:50:13 Pineapple daemon.notice pppd[14409]: Connection terminated. Sep 24 21:50:13 Pineapple daemon.notice pppd[14409]: Modem hangup Sep 24 21:50:12 Pineapple daemon.debug pppd[14409]: sent [iPCP ConfReq id=0x8 ] Sep 24 21:50:12 Pineapple daemon.debug pppd[14409]: rcvd [iPCP ConfNak id=0x7 ] Sep 24 21:50:11 Pineapple daemon.debug pppd[14409]: sent [iPCP ConfReq id=0x7 ] Sep 24 21:50:11 Pineapple daemon.notice pppd[14409]: CHAP authentication succeeded Sep 24 21:50:11 Pineapple daemon.info pppd[14409]: CHAP authentication succeeded Sep 24 21:50:11 Pineapple daemon.debug pppd[14409]: rcvd [CHAP Success id=0x1 ""] Sep 24 21:50:11 Pineapple daemon.debug pppd[14409]: rcvd [LCP EchoRep id=0x0 magic=0xad44ea1 3e 3a 82 65] Sep 24 21:50:11 Pineapple daemon.debug pppd[14409]: sent [CHAP Response id=0x1 <3b1668dae2f95e391b35e54599064dc3>, name = "shwkad"] Sep 24 21:50:11 Pineapple daemon.debug pppd[14409]: rcvd [CHAP Challenge id=0x1 , name = "UMTS_CHAP_SRVR"] Sep 24 21:50:11 Pineapple daemon.debug pppd[14409]: rcvd [LCP DiscReq id=0x47 magic=0xad44ea1] Sep 24 21:50:11 Pineapple daemon.debug pppd[14409]: sent [LCP EchoReq id=0x0 magic=0x3e3a8265] Sep 24 21:50:11 Pineapple daemon.debug pppd[14409]: sent [LCP ConfAck id=0x46 ] Sep 24 21:50:11 Pineapple daemon.debug pppd[14409]: rcvd [LCP ConfReq id=0x46 ] Sep 24 21:50:11 Pineapple daemon.debug pppd[14409]: rcvd [LCP ConfAck id=0x2 ] Sep 24 21:50:11 Pineapple daemon.debug pppd[14409]: sent [LCP ConfRej id=0x45 ] Sep 24 21:50:11 Pineapple daemon.debug pppd[14409]: rcvd [LCP ConfReq id=0x45 ] Sep 24 21:50:11 Pineapple daemon.debug pppd[14409]: sent [LCP ConfReq id=0x2 ] Sep 24 21:50:10 Pineapple daemon.notice pppd[14409]: Connect: 3g-wan2 <--> /dev/ttyUSB0 Sep 24 21:50:10 Pineapple daemon.info pppd[14409]: Using interface 3g-wan2 Sep 24 21:50:10 Pineapple daemon.debug pppd[14409]: using channel 100 Sep 24 21:50:10 Pineapple daemon.info pppd[14409]: Serial connection established. Sep 24 21:50:10 Pineapple daemon.debug pppd[14409]: Script USE_APN=internet.telenor.se /usr/sbin/chat -t5 -v -E -f /etc/chatscripts/3g.chat finished (pid 15083), status = 0x0 Sep 24 21:50:10 Pineapple local2.info chat[15084]: send ( ^M) Sep 24 21:50:10 Pineapple local2.info chat[15084]: -- got it Sep 24 21:50:10 Pineapple local2.info chat[15084]: CONNECT Sep 24 21:50:10 Pineapple local2.info chat[15084]: ATD*99***1#^M^M Sep 24 21:50:10 Pineapple local2.info chat[15084]: ^M Sep 24 21:50:10 Pineapple local2.info chat[15084]: expect (CONNECT) Sep 24 21:50:10 Pineapple local2.info chat[15084]: send (ATD*99***1#^M) Sep 24 21:50:10 Pineapple local2.info chat[15084]: -- got it Sep 24 21:50:10 Pineapple local2.info chat[15084]: OK Sep 24 21:50:10 Pineapple local2.info chat[15084]: AT+CGDCONT=1,"IP","internet.telenor.se"^M^M Sep 24 21:50:10 Pineapple local2.info chat[15084]: ^M Sep 24 21:50:10 Pineapple local2.info chat[15084]: expect (OK) Sep 24 21:50:10 Pineapple local2.info chat[15084]: timeout set to 30 seconds Sep 24 21:50:10 Pineapple local2.info chat[15084]: send (AT+CGDCONT=1,"IP","internet.telenor.se"^M) Sep 24 21:50:10 Pineapple local2.info chat[15084]: -- got it Sep 24 21:50:10 Pineapple local2.info chat[15084]: OK Sep 24 21:50:10 Pineapple local2.info chat[15084]: ATE1^M^M Sep 24 21:50:10 Pineapple local2.info chat[15084]: ^M Sep 24 21:50:10 Pineapple local2.info chat[15084]: expect (OK) Sep 24 21:50:10 Pineapple local2.info chat[15084]: send (ATE1^M) Sep 24 21:50:10 Pineapple local2.info chat[15084]: -- got it Sep 24 21:50:10 Pineapple local2.info chat[15084]: OK Sep 24 21:50:10 Pineapple local2.info chat[15084]: AT&F^M^M Sep 24 21:50:10 Pineapple local2.info chat[15084]: expect (OK) Sep 24 21:50:10 Pineapple local2.info chat[15084]: send (AT&F^M) Sep 24 21:50:10 Pineapple local2.info chat[15084]: timeout set to 10 seconds Sep 24 21:50:10 Pineapple local2.info chat[15084]: report (CONNECT) Sep 24 21:50:10 Pineapple local2.info chat[15084]: abort on (ERROR) Sep 24 21:50:10 Pineapple local2.info chat[15084]: abort on (NO CARRIER) Sep 24 21:50:10 Pineapple local2.info chat[15084]: abort on (BUSY) Sep 24 21:49:40 Pineapple daemon.info dnsmasq[2093]: using local addresses only for domain lan Sep 24 21:49:40 Pineapple daemon.info dnsmasq[2093]: using nameserver 8.8.8.8#53 Sep 24 21:49:40 Pineapple daemon.info dnsmasq[2093]: reading /tmp/resolv.conf.auto Sep 24 21:49:39 Pineapple daemon.debug pppd[14409]: Script /lib/netifd/ppp-down finished (pid 15042), status = 0x1 Sep 24 21:49:39 Pineapple daemon.notice netifd: Interface 'wan2' has lost the connection Sep 24 21:49:39 Pineapple daemon.notice pppd[14409]: Connection terminated. Sep 24 21:49:39 Pineapple daemon.notice pppd[14409]: Modem hangup Sep 24 21:49:39 Pineapple daemon.debug pppd[14409]: sent [LCP TermAck id=0x44] Sep 24 21:49:39 Pineapple daemon.debug pppd[14409]: Script /lib/netifd/ppp-down started (pid 15042) Sep 24 21:49:39 Pineapple daemon.info pppd[14409]: Sent 1182292 bytes, received 47287650 bytes. Sep 24 21:49:39 Pineapple daemon.info pppd[14409]: Connect time 18.3 minutes. Sep 24 21:49:39 Pineapple daemon.info pppd[14409]: LCP terminated by peer Sep 24 21:49:39 Pineapple daemon.debug pppd[14409]: rcvd [LCP TermReq id=0x44] Sep 24 21:40:38 Pineapple daemon.info hostapd: wlan0: STA 00:22:fa:55:7d:72 WPA: group key handshake completed (RSN) Sep 24 21:32:09 Pineapple daemon.info hostapd: wlan0: STA 20:54:76:4e:cc:af IEEE 802.11: deauthenticated due to inactivity (timer DEAUTH/REMOVE) Sep 24 21:32:08 Pineapple daemon.info hostapd: wlan0: STA 20:54:76:4e:cc:af IEEE 802.11: disassociated Sep 24 21:31:32 Pineapple daemon.info dnsmasq[2093]: using local addresses only for domain lan Sep 24 21:31:32 Pineapple daemon.info dnsmasq[2093]: using nameserver 8.8.8.8#53 Sep 24 21:31:32 Pineapple daemon.info dnsmasq[2093]: using nameserver 8.8.8.8#53 Sep 24 21:31:32 Pineapple daemon.info dnsmasq[2093]: using nameserver 195.54.122.221#53 Sep 24 21:31:32 Pineapple daemon.info dnsmasq[2093]: using nameserver 195.54.122.211#53 Sep 24 21:31:32 Pineapple daemon.info dnsmasq[2093]: reading /tmp/resolv.conf.auto Sep 24 21:31:25 Pineapple user.notice firewall: Reloading firewall due to ifup of wan2 (3g-wan2) Sep 24 21:31:25 Pineapple daemon.debug pppd[14409]: Script /lib/netifd/ppp-up finished (pid 14437), status = 0x1 Sep 24 21:31:25 Pineapple daemon.notice netifd: Interface 'wan2' is now up Sep 24 21:31:25 Pineapple daemon.debug pppd[14409]: Script /lib/netifd/ppp-up started (pid 14437) Sep 24 21:31:25 Pineapple daemon.notice pppd[14409]: secondary DNS address 195.54.122.211 Sep 24 21:31:25 Pineapple daemon.notice pppd[14409]: primary DNS address 195.54.122.221 Sep 24 21:31:25 Pineapple daemon.notice pppd[14409]: remote IP address 10.64.64.64 Sep 24 21:31:25 Pineapple daemon.notice pppd[14409]: local IP address 46.194.113.61 Sep 24 21:31:25 Pineapple daemon.warn pppd[14409]: Could not determine remote IP address: defaulting to 10.64.64.64 Sep 24 21:31:25 Pineapple daemon.debug pppd[14409]: rcvd [iPCP ConfAck id=0x6 ] Sep 24 21:31:25 Pineapple daemon.debug pppd[14409]: sent [iPCP ConfAck id=0x5f] Sep 24 21:31:25 Pineapple daemon.debug pppd[14409]: rcvd [iPCP ConfReq id=0x5f] Sep 24 21:31:25 Pineapple daemon.debug pppd[14409]: sent [iPCP ConfReq id=0x6 ] Sep 24 21:31:25 Pineapple daemon.debug pppd[14409]: rcvd [iPCP ConfNak id=0x5 ] Sep 24 21:31:25 Pineapple daemon.debug pppd[14409]: sent [iPCP ConfNak id=0x5e ] Sep 24 21:31:25 Pineapple daemon.debug pppd[14409]: rcvd [iPCP ConfReq id=0x5e] 0.0.0.0> 195.54.122.211> 195.54.122.221> 46.194.113.61> 195.54.122.211> 195.54.122.221> 46.194.113.61> 195.54.122.211> 195.54.122.221> 46.194.113.61> 0x3e3a8265> 0x0> 0xad44ea1> chap md5> 0x0> 0x3e3a8265> 0x0> 0xad44ea1> chap md5> 0x0> 0xad44ea1> chap md5> 0x0> 0.0.0.0> 0.0.0.0> 46.194.113.61> 10.11.12.14> 10.11.12.13> 10.11.12.14> 10.11.12.13> 46.194.113.61> 0x13963e4b> 0x0> 0xad46dc8> chap md5> 0x0> 0x13963e4b> 0x0> 0xad46dc8> chap md5> 0x0> 0xad46dc8> chap md5> 0x0> 0.0.0.0> 0.0.0.0> 0.0.0.0> 10.11.12.14> 10.11.12.13> 10.11.12.14> 10.11.12.13> 0.0.0.0> 10.11.12.14> 10.11.12.13> 10.11.12.14> 10.11.12.13> 0.0.0.0> 10.11.12.14> 10.11.12.13> 10.11.12.14> 10.11.12.13> 0.0.0.0> 10.11.12.14> 10.11.12.13> 10.11.12.14> 10.11.12.13> 0.0.0.0> 0.0.0.0> 195.54.122.211> 195.54.122.221> 46.194.125.212> 195.54.122.211> 195.54.122.221> 46.194.125.212> 195.54.122.211> 195.54.122.221> 46.194.125.212>

I just flashed the new firmware and downloaded sslsplit on my pineapple. I started it and then went for a bus ride, and a walk around the city. When I got home I opened up the log file and I can see a lot of information like this- 2014-08-15 11:38:00 UTC ssl [172.16.42.228]:46824 [198.142.186.29]:443 sni:- crt:google.com/google.com/*.2mdn.net/*.android.com/*.appengine.google.com/*.au.doubleclick.net/*.cc-dt.com/*.cloud.google.com/*.de.doubleclick.net/*.doubleclick.com/*.doubleclick.net/*.fls.doubleclick.net/*.fr.doubleclick.net/*.google-analytics.com/*.google.ac/*.google.ad/*.google.ae/*.google.af/*.google.ag/*.google.al/*.google.am/*.google.as/*.google.at/*.google.az/*.google.ba/*.google.be/*.google.bf/*.google.bg/*.google.bi/*.google.bj/*.google.bs/*.google.bt/*.google.by/*.google.ca/*.google.cat/*.google.cc/*.google.cd/*.google.cf/*.google.cg/*.google.ch/*.google.ci/*.google.cl/*.google.cm/*.google.cn/*.google.co.ao/*.google.co.bw/*.google.co.ck/*.google.co.cr/*.google.co.hu/*.google.co.id/*.google.co.il/*.google.co.im/*.google.co.in/*.google.co.je/*.google.co.jp/*.google.co.ke/*.google.co.kr/*.google.co.ls/*.google.co.ma/*.google.co.mz/*.google.co.nz/*.google.co.th/*.google.co.tz/*.google.co.ug/*.google.co.uk/*.google.co.uz/*.google.co.ve/*.google.co.vi/*.google.co.za/*.google.co.zm/*.google.co.zw/*.google.com/*.google.com.af/*.google.com.ag/*.google.com.ai/*.google.com.ar/*.google.com.au Being new to the pineapple and sslsplit I'm not quite sure what I have done wrong. There is a lot of data, but I can't seem to find any user names or passwords. I ran sslsplit with PineAP and Karma but was I supposed to start something else at the same time? I read http://champagneandsecurity.wordpress.com/2014/07/26/sslsplit-on-wifi-pineapple/%C2'> but it looked to me like a guide for the command line sslsplit and not an infusion. Was I supposed to follow this to the tee because all I did was click start, Any help would be really appreciated.

So, I was reading Mubix's blog a little while back and he wrote about how PSEXEC shows up in the events log. It got me thinking, why can't I find a list anywhere of things like that which should be red flags in event, and other, logs? Anyone care to help build such a list? I'm starting off with what Mubix mentioned (though, I'm sure it will get changed later) and another obvious one. Windows Server 2003 Event ID 552 - when someone uses something such as RUNAS, it could be a sysad doing their job or an attacker doing something else, but worth looking into. What other things can we all think of? Assuming a network that has a centralized log management server, so all server (say Windows 2003/2008 and maybe some Linux or Solairs ones) logs can be easily alerted off of, as well as firewall events. Anything that's an obvious red flag (like PSEXEC) or warrants further research.