Skip to content

Latest commit

 

History

History
123 lines (86 loc) · 5.48 KB

README.md

File metadata and controls

123 lines (86 loc) · 5.48 KB

Wireshark twoo twooo two twoo...

Write-up author: jon-brandy

DESCRIPTION:

Can you find the flag? shark2.pcapng.

HINTS:

  1. Did you really find the flag?
  2. Look for traffic that seems suspicious.

STEPS:

  1. First, open the file using wireshark.
  2. When i tried to follow the tcp stream at tcp.stream eq 5. I found a clue.

image

  1. Then, when i followed the tcp stream at tcp.stream eq 19. I found a flag.

image

  1. But the pico server reject it, means it's not the flag.
  2. Based from the hint, let's check the dns traffic.
  3. Change the wireshark query to -> udp.port == 53.
  4. Then follow this udp stream.

image

  1. You can see there's a clue.

image

CLUE : reddshrimpandherring.com

  1. Now let's access the website by type this command on your kali linux terminal:
curl http://www.reddshrimpandherring.com

OUTPUT:

<html>
        <head>
                <script>
                        var forwardingUrl = "/page/bouncy.php?&bpae=GbhWt6smolx797uvwVkZt3kXTsk4y6o5kxYr9vEtHeCvozli8ejbu66RQjMt7Id%2F7sjqbfF2RWJS6uRJLVU6cM1l4JPz4jN%2BdEK08uU5XoZTutPs3nk6NJZHL7zrQL9jPzLObHYglnvQjCJOZRjSxzO%2FCVgogGfHMa%2BW9CIiUsvkxfYjbS%2BH7gPMad2eIkvK0lceLuxHaNFOS36EUftr9629OTdxBoJrH9vtM8OWk9YvsYJmsDtXNeyMnbc3jeGSUNaUpys%2FeBFPEBItGU5NvlHEiKjDoy%2B7ARshbjLab8QdkfzGpTdHwX2gAWtyM8aKXAOS%2BcdOaC3eXJW%2FN5mOCl5t%2BYc7uFiRbQz6%2FaOm1RLGwKDH9cpHdb%2BROQylniESiaa0aCJUDFzfFIDLuYHiGTf00Jc%3D&redirectType=js";
                        var destinationUrl = "/page/bouncy.php?&bpae=GbhWt6smolx797uvwVkZt3kXTsk4y6o5kxYr9vEtHeCvozli8ejbu66RQjMt7Id%2F7sjqbfF2RWJS6uRJLVU6cM1l4JPz4jN%2BdEK08uU5XoZTutPs3nk6NJZHL7zrQL9jPzLObHYglnvQjCJOZRjSxzO%2FCVgogGfHMa%2BW9CIiUsvkxfYjbS%2BH7gPMad2eIkvK0lceLuxHaNFOS36EUftr9629OTdxBoJrH9vtM8OWk9YvsYJmsDtXNeyMnbc3jeGSUNaUpys%2FeBFPEBItGU5NvlHEiKjDoy%2B7ARshbjLab8QdkfzGpTdHwX2gAWtyM8aKXAOS%2BcdOaC3eXJW%2FN5mOCl5t%2BYc7uFiRbQz6%2FaOm1RLGwKDH9cpHdb%2BROQylniESiaa0aCJUDFzfFIDLuYHiGTf00Jc%3D&redirectType=meta";
                        var addDetection = true;
                        if (addDetection) {
                                var inIframe = window.self !== window.top;
                                forwardingUrl += "&inIframe=" + inIframe;
                                var inPopUp = (window.opener !== undefined && window.opener !== null && window.opener !== window);
                                forwardingUrl += "&inPopUp=" + inPopUp;
                        }
                        window.location.replace(forwardingUrl);
                </script>
                <noscript>
                        <meta http-equiv="refresh" content="1;url=/page/bouncy.php?&bpae=GbhWt6smolx797uvwVkZt3kXTsk4y6o5kxYr9vEtHeCvozli8ejbu66RQjMt7Id%2F7sjqbfF2RWJS6uRJLVU6cM1l4JPz4jN%2BdEK08uU5XoZTutPs3nk6NJZHL7zrQL9jPzLObHYglnvQjCJOZRjSxzO%2FCVgogGfHMa%2BW9CIiUsvkxfYjbS%2BH7gPMad2eIkvK0lceLuxHaNFOS36EUftr9629OTdxBoJrH9vtM8OWk9YvsYJmsDtXNeyMnbc3jeGSUNaUpys%2FeBFPEBItGU5NvlHEiKjDoy%2B7ARshbjLab8QdkfzGpTdHwX2gAWtyM8aKXAOS%2BcdOaC3eXJW%2FN5mOCl5t%2BYc7uFiRbQz6%2FaOm1RLGwKDH9cpHdb%2BROQylniESiaa0aCJUDFzfFIDLuYHiGTf00Jc%3D&redirectType=meta" />
                </noscript>
        </head>
</html>
  1. Seems we got no clue.
  2. Now let's open the wireshark again, and check all of the dns traffic.
  3. We found a different DNS destination this time. It goes to 18.217.1.57.

image

  1. Next, apply the filter to -> dns and ip.dst_host == 18.217.1.57 then press enter

image

  1. If you see the packets inside, it looks like a partition of base64 encoded text.

image

  1. Now, let's follow every udp stream at this destination ip host and concate every each one of them.

image

image

image

image

image

RESULT:

cGljb0NURntkbnNFM3hmMWxfZnR3X2RlYWRiZWVmfQ==
  1. Finally, decode it using this command at your kali linux terminal:
echo "cGljb0NURntkbnNfM3hmMWxfZnR3X2RlYWRiZWVmfQ==" | base64 -d
  1. Or you can use this python code:
import base64
import os

os.system('cls')
strings = 'cGljb0NURntkbnNfM3hmMWxfZnR3X2RlYWRiZWVmfQ=='
base64_bytes = strings.encode('ascii')
message_bytes = base64.b64decode(base64_bytes)
result = message_bytes.decode('ascii')

print(result)
  1. We got the flag!

FLAG

picoCTF{dns_3xf1l_ftw_deadbeef}