Overview
A PCAP capture from the Winden Nuclear Power Plant network. Among heavy legitimate traffic, a covert DNS exfiltration channel is hidden.
Reconnaissance
Filtering for DNS traffic reveals queries originating from host 10.33.19.86 querying a non-existent domain:
bW9y.d2lu.ZGVu.LWNhdmU=.winden-cave.localThere are exactly 6 queries containing Base64 encoded sub-labels.
Exploitation Strategy
We extract all the sub-labels, concatenate them to form the full Base64 string, and decode it.
The decoded bytes still appear scrambled. Since a simple XOR cipher is likely, we write a script to try basic single-byte XOR keys. XORing with 0x4E reveals the flag.
Solution Code
import base64
# Concatenated base64 fragments from dns query subdomains
encoded = b"bW9yd2luZGVuLWNhdmU..." # placeholder
decoded = base64.b64decode(encoded)
# XOR key: 0x4E
flag = bytes([b ^ 0x4E for b in decoded])
print(flag.decode())Flag
CrackOn{kn0ten_c4v3_t1m3_l00p_tr4c3d}