NeverLAN CTF 2018, 23 February 2018 at 19:00 UTC, lasts 77 hours

Question

Let's participate in NeverLAN CTF 2018.

---

NeverLAN CTF is a Jeopardy-style CTF and lasts 77 hours. You can find additional details on the CTFtime event page and study the write-ups of the 2017 edition here.

General info :

• We compete as team secse.
• We communicate over Slack. To get an invitation to the group you can contact any member of the team. (We will need to know an email address to send the invitation to and a reference to your Security.SE profile.)
• For questions, join us in the public chat room.

Good luck everyone!

---

The team ranked 8th out of 670 non-student teams, with 8130 points in total!

Answer 1

Fuzzy Packets 300

Description

Fuzzy loves it when you show love! Can you find it?

We were provided with a pcapng file. This is a list of packets. After opening it with Wireshark, it displays the following :

After some basic search in description, it seems clear that the flag was encoded somewhere.

We can see that some ping get a reply and some don't. So I thought about binary. Maybe when 192.241.233.138 was replying it meant 1 and 0 otherwise. After some digging, it seems that this theory was wrong. So I kept digging and remarked that ICMP code field was sometimes 0 and sometimes 1. There are no reasons for ICMP to have a code field at 1 when the type is echo (8).

I then applied a filter to get only the packets that initiated the ping with ip.src_host==172.26.13.12 and exported the selection as plain text. This gave the following :

No.     Time           Source                Destination           Protocol Length Info
      1 0.000000       172.26.13.12          192.241.233.138       ICMP     81     Echo (ping) request  id=0x0000, seq=0/0, ttl=64 (no response found!)

Frame 1: 81 bytes on wire (648 bits), 81 bytes captured (648 bits) on interface 0
Ethernet II, Src: Apple_7f:ab:f5 (ac:bc:32:7f:ab:f5), Dst: Technico_08:2d:a1 (10:13:31:08:2d:a1)
Internet Protocol Version 4, Src: 172.26.13.12, Dst: 192.241.233.138
Internet Control Message Protocol
    Type: 8 (Echo (ping) request)
    Code: 0
    Checksum: 0x8153 [correct]
    [Checksum Status: Good]
    Identifier (BE): 0 (0x0000)
    Identifier (LE): 0 (0x0000)
    Sequence number (BE): 0 (0x0000)
    Sequence number (LE): 0 (0x0000)
    [No response seen]
    Data (39 bytes)

0000  54 68 69 73 20 69 73 20 6e 6f 74 20 74 68 65 20   This is not the 
0010  66 6c 61 67 20 79 6f 75 27 72 65 20 6c 6f 6f 6b   flag you're look
0020  69 6e 67 20 66 6f 72                              ing for
        Data: 54686973206973206e6f742074686520666c616720796f75...
        [Length: 39]

No.     Time           Source                Destination           Protocol Length Info
      2 0.004361       172.26.13.12          192.241.233.138       ICMP     81     Echo (ping) request  id=0x0000, seq=0/0, ttl=64 (no response found!)

Frame 2: 81 bytes on wire (648 bits), 81 bytes captured (648 bits) on interface 0
Ethernet II, Src: Apple_7f:ab:f5 (ac:bc:32:7f:ab:f5), Dst: Technico_08:2d:a1 (10:13:31:08:2d:a1)
Internet Protocol Version 4, Src: 172.26.13.12, Dst: 192.241.233.138
Internet Control Message Protocol
    Type: 8 (Echo (ping) request)
    Code: 1
    Checksum: 0x8152 [correct]
    [Checksum Status: Good]
    Identifier (BE): 0 (0x0000)
    Identifier (LE): 0 (0x0000)
    Sequence number (BE): 0 (0x0000)
    Sequence number (LE): 0 (0x0000)
    [No response seen]
    Data (39 bytes)

0000  54 68 69 73 20 69 73 20 6e 6f 74 20 74 68 65 20   This is not the 
0010  66 6c 61 67 20 79 6f 75 27 72 65 20 6c 6f 6f 6b   flag you're look
0020  69 6e 67 20 66 6f 72                              ing for
        Data: 54686973206973206e6f742074686520666c616720796f75...
        [Length: 39]
...

Applying a Search and replace on it with the following regex : [\s\S]*?Code: (\d) -> $1 gave this binary :

0110011001101100011000010110011101111011010100110110000101111001010010000110100100110010010000000100011001110101011110100111101001111001010011100100111101010000001101000100110101100101001011010110110101100101011101000110000101100011011011110111001001110100011001010111100001111101

Converting the binary to ascii finally gave the flag :

flag{SayHi2@FuzzyNOP4Me-metacortex}