RITSEC_CTF

RITSEC_CTF Forensics Writeup

---

Challenge : Intercepted Transmission

Challenge Description

• We have intercepted a transmission from the aliens. We believe they were pinging government installations in order to find the locations.

---

Solution

1. Analyze the PCAP file:
   • We are given transmission.pcapng. Opening it in Wireshark, we see multiple ICMP packets.
     
2. Filter ICMP packets:
   • Apply the following Wireshark filter to isolate ICMP traffic:

     icmp
     

   • Observing the data field in ICMP packets, we notice that some contain readable text.
3. Identify Flag Containing Packets:
   • By sorting packets based on length, we discover that ICMP packets with a data length of 43 contain pieces of the flag.
     
   • Extracting data from these specific packets, we concatenate them to reconstruct the flag.
4. Extract Flag using TShark:
   • Using tshark, we can extract ICMP data and convert it:

     tshark -r transmission.pcapng -Y "icmp && frame.len == 43" -T fields -e data | xxd -r -p
     

   • This outputs the final flag.

Flag

RS{Its_A_Coverup}