TCTT2022: network-challenge05 (Network Security)
Let’s open the pcap file with Wireshark.
Gather more information from the Statistics tab.
Conversations
Most packets are sent between 212.192.246.16 and 199.127.63.153. What’s really interesting is that there are many different ports but each of them are used only a few times. Let’s investigate the ports further.
Destinations and Ports
It looks like most of the protocols are on random ports and only exist just to increase the number of packets. Since the count of destinations and ports is exactly 6969 (nice), this is probably intentional. We probably won’t get any information from these packets.
Looking at ports that were used more than a few time give interesting targets to investigate further.
53 is the well-known port for DNS protocol, and it was used more than 400 times in this capture. Filtering for dns result in getting something like this…
We can see weird string in the info column in packets that were sent between 212.192.246.16 and 199.127.63.153. Let’s check for packet bytes in those packets now.
Now we see a very suspicious ‘secret.pdf’ in the packet bytes of almost every DNS packets. The last packet with secret.pdf has the query name ‘Name: 7x4BAA==-.secret.pdf’. Because it ended with ‘==’ that indicate that these packets contain a small part of a big base64 encoded file in the DNS query name.
Get Gym’s stories in your inbox
Join Medium for free to get updates from this writer.
Filtering DNS query name with TShark with this command
- r to read the pcap file.
- T and e to display the dns query name field.
- Y to filter out other packets file as we are looking for packets with port 53 (DNS) and came from 199.127.63.153. We have to add the ip.src filter because the ip 212.192.246.16 send the query name back which would double the same DNS query name.
- | nano dns_name05 to pipe the output to create a file named ‘dns_name05’
After changing dns_name05 to dns_name05.txt, this is the content
1.debian.pool.ntp.org 1.debian.pool.ntp.org 1.debian.pool.ntp.org 1.debian.pool.ntp.org 2.debian.pool.ntp.org 2.debian.pool.ntp.org 2.debian.pool.ntp.org
2.debian.pool.ntp.org 3.debian.pool.ntp.org 3.debian.pool.ntp.org 3.debian.pool.ntp.org 3.debian.pool.ntp.org 0.debian.pool.ntp.org 0.debian.pool.ntp.org
0.debian.pool.ntp.org 0.debian.pool.ntp.org 1.debian.pool.ntp.org 1.debian.pool.ntp.org 1.debian.pool.ntp.org 1.debian.pool.ntp.org 2.debian.pool.ntp.org
2.debian.pool.ntp.org 2.debian.pool.ntp.org 2.debian.pool.ntp.org 3.debian.pool.ntp.org 3.debian.pool.ntp.org 3.debian.pool.ntp.org 3.debian.pool.ntp.org
H4sICDpYH2MAA3NlY3JldC5wZGYArPhjgC3NtiCKlo1Vtm3btm3btu1Vx-.irbtm3btm3c9e19Tr/Tp7vfvT96zowZw4gcGTljkMgLi9Iw0LLBQpE0/f-.3AQjHg0*PbGVrCQnFz0yl72JvQCRk4G1jbmdHJG5iZOOEz/mUr0kkb2Jq-.Rm9jSqChR4NMpOTu6GDkrO5qYKNrZOeMz0P9LRMbA0UrC1tTur5l/QBNj-.secret.pdf
/L9iJry8dDImzgbGf23iM3L8S1DVwsTNxFHe0cTUxNHE1uivD6Z/WeDlh-.YUysTX*VyyM/z2ofwVDJ2TnYvvXIZ2UhbGTFj7TP1o6*P9Vj*l/p/f356-.8j5/9IRdHEyc7F8a/bvyKidrbO/0wM*Cz/joBOxN1ZTMnZwNnkL1lMiQ2-.f7V86Ykrs*Oz/ISHvaGekZOKsRfd3IemUTdyd6SRs/joR/Pck9O9J4p*w-.secret.pdf
/mZubGEgaOeuhf9PgqwMjPhsHIw6*H/TsHX*G5ATPvO/rTvaudj/Z8D/Q-.uiU6JQdDWyd7P8J3MiDTkiJTtjE1cLIRFFM8K9dZQNDp78i/74P/07OCZ-./*v64D839ZB1ELa2cTRzpR679ZCZsY2Rmb0Emb2Jo5m*MzsbMy/KPl5Ox-.oYmADC*We2aRpZbehivhl2/sjgDcEOhlJJwESCaSCyGg1YiuzRnxlCC2f-.secret.pdf
orkUiVc3L7mh1*M0velFIcYaqL8G4Eqc2BnHxGQ2PWly05HjteP3s3X2x-.6/nCtb3NY/N46P45exWfxf*lg62fzuXLWmngPmShwYOvtzv6RoenhQtDH-.zHRIAO4lNgs*P16hb/9wdYVy4b1JcA*oto0GLcwPZQ1maqnFjXzgqj6Y2-.bL9Yfu7e9Provva6fR9pYePjtsfCTMPCflUUivogcmSmMjhxz7LegvQqk-.secret.pdf
ZLdthUU894Lv50kuzCcmuugPvK4Ch55yyxvya7quUr*9oi9Kvf35Irek5-.4mATwNatGI23V/PDfNRHxdWN*Tojw1M0WoouuynO3tvV71S7yu6v04L3C-.ntOunPzUZaO7PHjYXSGcIPadv2lFMSeDwHvmdavUmQkp0w9gohjlpgsh8-.f0qVHOCowUh5lSeHe4xhrfcvp3Z7WsF7UFvh9jaKvQmC86FqMF*BkSreZ-.secret.pdf
pJHe/ODX0iefcb3*cI/aQux5XuCEtEdcQv22pvoMYEdwJ5TX3VV8a7lsg-.TmqE07RHStR*EEfSEaZUmI2IUaLMqF4MQGy39RL1kV/Bm6LP0CPOowLRD-.5hBnYyjf3U8MU9dNAEm0GxwtCuPodpiC5OtFpCWa6FO*xQ99av9jKY1VN-.zU0cWbb/CXbvrjRv2Gu0XGRfTgN5E7W2nkcMC7Co0gj2ym9qpf5LQKdf7-.secret.pdf
1dVjLxMwunxLYPtRNtaCXtpKbHxLcvcsbKgP7ZaN6qZLf516gcXLhua13-.NCu7z1ba99sCvXSLvzrCw3eIHn4SAiYQZuQzhGczdBKBUw37fyeKXRBC*-.O70os6LCKH1Et9Gd*/UK8zDNgB4UZf3/cdMsfcjho1HprpAR7z2BnYuly-.X17llFx/ndeC0CTSVqskZYVQzqfTXzWCSXt20ZQpaeAnYch*8Dbxazfg9-.secret.pdf
zfhyQhZvs7qZf*do09l4n51MfNR5xm89jzPZp1Vlz80BliYbuKvgtsgbj-.xJwtB162I4C5gPMrAOcoW99PLsTX66tkgQbDIM3KxRg5VDHpoDznbFM*R-.fqlBRS/HOJha12Ieed4ZoqL7HJ0n2Xox3VBHOdPrDLGVsKu7lAK5Z92ao-.P5W2T6TuK7tXj6vRZ/YrE9OZe7aNjTyraL/0LDwQLyxF950aRF1IYRT89-.secret.pdf
............................
......(many line later).....
............................
kjY7lecODshvHCSuVEtaJR5aIoddZ*uy5G2F4Gl4aXSpzr6txuGLZ4UpL-.ebfZmfgScue3ny9KvC44ltnVxf3MpdFy/ztDnSezuY7KmZdzFdMsFhget-.fSbkFR6adbxS3PXrA36N5SlF6dXVfcOjtezSN9fzMzrS/yY/P9d5rR6bM-.cm2LmLWvRW6n6vvVIjdgFmtGT*g15PT1cY*MBw50Xu*Wu7pwTtL/G9Up/-.secret.pdf
e1xku3tJS0G6AAYYl/T0QEc/DgzawAiVTkWooAPfHRkDtthYg9YwyxPZA-.eCwEMHAQFrqqxc9QwGHStsJI4A77Mlg6aO68m6gAAZdH7UZb4Ox4ZjAOx-.gWu7mww*71jrTdO2m6dJShgZ6AJPDmeAvDAAJvJotHEuijqEI2MEkoj8E-.gChhXQXbqo3BaWDQRg0UZSOlx6R4ke1OzL0bCO33UDgThkEDQ19dXyxen-.secret.pdf
xeZ6glhdXV0QA4EQhBZqoHl*LIQqQLN4Kl89mMI8GpfBQRhsFjB2T3Vn8-.xF9FAr44pczyS*LpzVOTIvG9gaFD0CsFg4ccySUSbZcNp1Pg7kGNgwal8-.1jeyAlacBmNpcONOdcbs651pyT0pyT0JyT3pwTA3zTAXAEvB74B3s9cAq-.vP8mUTvtGlMPnMsfTp9NAmAl7wyyEJySLHSdLp5FowuNC2MJQY34cYJ8J-.secret.pdf
gckwQHbAMJfKYTMBmp87zGUxWF7UCT7ChxPCuDo42clf5Cs8UdGVFVA5Q-.rKYcbJCJZLJRCBHNpv5V4o71cV3n7Cp8GUAYYRfDowuGgs5QjgSBkuCiG-.sxRBIGM8l0QnPc0oZNZ3j4/RnLSZr/RY1sbP59lby9vxbKxoZkyqbxx07-.b0tSAz2fQSTpEbSIeMjNDm2ExWLQ2gUhBG*G1tdE6GKKuCY5gZEoxNhkn-.secret.pdf
*0fbL94sWTyEyqLBf8XbJFsRyQN/w/UjyI8gP4L8CPIjyI8gP4L8/UEm/-.vaFE7pwAPg24ht8XxGEK4c*yle4AIhcRHCYSYuIKYPHYVL9hBOKIwNhwg-.DC5cMGBpOUsVO3li32sAfowNgNC3cUcLMzgAW0AcgFAO3ZbAQY07YHLVk-.ebEB3QjR11jMzw0PaRB3hcmGGJVK0CWOTzeTBxuA/awj9mzGYCMwFzZhj-.secret.pdf
MyNMY9Phr7sSFqMzeVUSxOFvV0ofwMwTJ2s8MSdLzjFVQ37aWDdzo3LVu-.QWCnsRDEYJimXBNP/Si3IxNOWmheitylvrgdovJ0NZfxLqpRyqAZEm5S*-.T5hbVNr5t6z4pHAD8ph5DnLYw4WOPSLu9//rm*8fEajmwBYcPcKpEFFnB-.hD2kpDICDhO9fLiwGIODxODzgMQkjAuOfAOsbhiUQpmEQBE3DtHWm6Wlr-.secret.pdf
T9fTxutipmE6Y5voVExnuq2ukO3UuBgsVkQekAgMJwLTFoHhRWAEkbWaj-.umIwHSnY5CI2kMi8oBE5AGJyAMSkQckIg9IRB6YaVzwRGhanQkY/NTzJe-.joYqeeGxHCQjrTMSLuO4ZwqQwmzB1v34mmhf7XnTrRi1QuMtEHREhbBys-.tpaZG2WD2vTcw/xdqoC0X3gWMMxr/HXNAvIHxgk3ljIOIxC*c/wWbs1t2-.secret.pdf
7x4BAA==-.secret.pdf 0.debian.pool.ntp.org 0.debian.pool.ntp.org 0.debian.pool.ntp.org 0.debian.pool.ntp.org 1.debian.pool.ntp.org 1.debian.pool.ntp.org
1.debian.pool.ntp.org 1.debian.pool.ntp.orgWe can now delete everything that isn’t a part of the base64. In this case, I made a python code that would remove ‘secret.pdf’ , ‘-.’, and also replacing ‘*’ with ‘+’ because ‘*’ is not a base64 characters.
path = r"secret05.txt" # depend on where you run the app
with open(path, "r", encoding='utf-8') as file:
data = file.read().rstrip()
data = data.replace("secret.pdf ", "")
data = data.replace("-.", "")
data = data.replace("*", "+")
print(data)
f = open("sus05.txt", "w")
f.write(data)
f.close()Now we will turn the result base64 to a pdf file.
Apparently the base64 from the pcap file is actually a gzip file.
Download the pcap file and unzip it with
Reading the content of the pdf file…
Selecting all of the string with Ctrl+A give interesting result.
Something is hidden below the base64!
This is the hidden text: 5c6cb5fa5aa3419217ccab2fd0d8096afb3c52220bbee5001d6e632523302635
Decoding the base64 with cyberchef.
The last sentence from the output give us an AES encryption key, since AES use the same key for encryption and decryption, we can use this key to decrypt the hex.
Here is the result.
