Overview
Given a PCAP capture file containing gaming traffic. Examining the protocol distribution reveals an anomaly: a few ICMP packets at the very end of a capture dominated by TCP gaming packets.
Reconnaissance
Using the filter icmp.type == 3 isolates 5 ICMP Destination Unreachable packets. These packets are suspicious because they all originate from an internal IP and carry embedded UDP DNS packets.
Exploitation Strategy
Expanding the packet payload down to the original UDP DNS query layers exposes domain query labels of the format: <hex-data>.p[N].ctf.com.
We extract the hex payloads from packets #565, #568, #571, #574, and #577 and reconstruct the flag.
Solution Code
parts = [
"4b-61-61-6c-7b-62-72-33-61-6b",
"31-6e-67-5f-62-34-64",
"5f-77-31-74-68",
"5f-77-31-72-65",
"73-68-34-72-6b-7d"
]
flag = ''.join(
bytes([int(x, 16) for x in p.split('-')]).decode()
for p in parts
)
print(flag)Flag
Kaal{br3ak1ng_b4d_w1th_w1resh4rk}