Here are some pcaps:

phase 1: intrusion of client via malicious java exploit in web page (cve20131493.pcap)
phase 1 (alternate): intrusion of web server via SQL injection (SQLi-3_Get.pcap)
phase 2: remote shell access via reverse bind shell: (shell_80_rev...)
phase 2 (alternate): backdoor access via JSP backdoor tool upload (webshell5.pcap)
phase 3: panda (chinese APT group) C&C: post2_fix and get.pcap (post2_fix) over Unknown UDP and (get.pcap) over HTTP