rawSEC MINICON CTF 2020 PCAP 1 Challenge Write Up

I had an opportunity to participate this CTF this time, I joined this CTF just for fun and to gain new knowledge along the way by completing some of the challenges. In this particular challenge, I'm using this tool to find the flag:

• Notepad++
• Wireshark
• Microsoft Excel
• Python
• XLRD python library
• Command line

First I load the PCAP_1.pcap to Wireshark.

Scrolling through the packet capture file, I notice there is GET request from 172.16.236.163 to 69.172.200.235 which can be seen there is a key value and its look like a base64 string, so I try to export it if there is any object from HTTP protocol.

To extract object in particular stream in the pcap file using Wireshark, you have to go to File > Export Objects > HTTP.

Looking at the export object there is a lot of base64 string can be found, decoding this string one by one does not seem practical. Therefore, I save all the objects into designated folder first to extract the string. I create a folder name base64 in Desktop, and save all the objects there.

Here is all the object that has been saved. Next, I open the terminal in the folder, run command as follow:

root@kali:~/Desktop/base64# ls > base64.txt

This will save the output of ls to a text file name as base64.txt.

To remove ‘%3fkey=’ from the string I’m using notepad++ and transfer the sanitized string to an excel file.

Checking the count of the string, there is 1000 base64 string that needed to be decode.

After that, I wrote a python script that will take the base64 string in the excel and decode it to ASCII.

This script require python and xlrd library to be install. Some of you must be wondering why I'm using this library, because I already made this script but for different purpose, to save some time, I just use what I already had. You can get this library by using pip

root@kali:~/Desktop# pip install xlrd

Here is the python script I that wrote.

# Reading an excel file using Python
import xlrd
import base64

# Give the location of the file
loc = "/root/Desktop/base64.xlsx"

# To open Workbook
wb = xlrd.open_workbook(loc)
sheet = wb.sheet_by_index(0)

for i in range(sheet.nrows):
    base64_message = (sheet.cell_value(i,0))
    message_bytes = base64.b64decode(base64_message)
    message = message_bytes.decode('ascii')
    print(message)

output of the decode string

root@kali:~/Desktop# python base64decode.py
kNfmJFQuUELAcIumgmNhRtUZCroCaChnIiY
kGiWwUJeBhukgxxeSaNZxqGZNzyWDdJDAqW

.
.
rZVYSsGAseXDyWWQzOudcUXzsFRrzumWZjs
rVifqLVPHfqmvOzXRhwvscMJZDPqnmaloFI
rawsec{iM_nOt_WhaT_You_LoOklng_fOr}
rawsec{yOu_gOt_mE_wiTh_BaSe64}
rkxuHhcfbgHufhIzRtVMFYhfQkEQXXIgnYl
rpMWUuCbncfcFsKOqnTGUwyIUmDIJJaXGpT
.
.

Among the gibberish string there is 2 meaningful string, the flag is

rawsec{yOu_gOt_mE_wiTh_BaSe64}

I think this is another way of doing this challenge, I sure there is more easier method out there, but for me I prefer using simple script and readily available tool to save time and effort.

That all for my write up on PCAP_1 Challenge of rawSEC MINICON CTF 2020.