Overview
We must analyze a PCAP trace containing 3700+ packets of background network traffic and isolate a message sent by an external anomaly address.
Reconnaissance
We list all communicating IP addresses:
192.168.33.20 (Jonas)
192.168.33.30 (Ulrich)
192.168.33.40 (Claudia)
10.19.53.1 (Stranger) <-- ANOMALYAll resident machines use the 192.168.33.0/24 subnet, while the IP 10.19.53.1 is outside the local network.
Exploitation Strategy
We filter the packets in the PCAP file for communication involving the anomalous IP:
tshark -r strangers_letter.pcap -Y "ip.addr == 10.19.53.1" -T fields -e http.file_dataThis isolates a single HTTP POST request. Inspecting the POST data reveals the flag inside the parameters.
Solution Code
# Filter and dump HTTP payload:
# POST /winden/postbox/send HTTP/1.1
# Data: to=jonas.kahnwald&subject=The+Apparatus&secret_message=CrackOn{str4ng3r_kn0cks_w1nd3n_1986}
# Flag: CrackOn{str4ng3r_kn0cks_w1nd3n_1986}Flag
CrackOn{str4ng3r_kn0cks_w1nd3n_1986}