Skip to content

Instantly share code, notes, and snippets.

@rewanthtammana

rewanthtammana/nullconCTF - misc 2

Created February 11, 2018 16:23
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save rewanthtammana/625e8467fed88119e997cbf448ae5be2 to your computer and use it in GitHub Desktop.
Save rewanthtammana/625e8467fed88119e997cbf448ae5be2 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
nullconCTF - misc 2
Hints given - I don't like HTTP but I like table tennis.
Table tennis is also called as ping pong. This means the data is transmitted in ping packets. So, our data is in ICMP packets.
Add a filter in wireshark, ip.proto=="icmp" and you will get all the icmp packets.
You can also see that there is a data value in the ICMP packets. There are so many data packets and I used tshark to automate extration stuff but the results were not of any use.
Then I observed the size of data in each packet varies, they are of different sizes like 48 bytes and 2 bytes.
You can clearly see that the 48 byte packets are trash data. So, I manually written all the 2 bytes values on the paper and then decoded that value which gave me the flag.
Flag - hackim18{'51mpL3st_Ch4ll3ng3_s0lv3d'}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment