247CTF - Follow The Sequence

Posted on In Views: Word count in article: 166 Reading time ≈ 1 mins.

Multi-path TCP (MPTCP) challenge: data is spread across multiple subflows. Task is to combine the requests and recover the flag.

Solution Steps

1
2
3
4
5
6
7
8
9
10
11
# 1. Merge the three PCAP files
mergecap -w merged_chall.pcap chall-i1.pcap chall-i2.pcap chall-i3.pcap

# 2. Extract TCP flows
tcpflow -r merged_chall.pcap -o ./output_dir

# 3. Concatenate already ordered payload fragments without truncating any input
cat a b c > combined.bin

# 4. Extract embedded archive with binwalk
binwalk -eM combined.bin

a, b and c denote extracted payload fragments, not filenames produced automatically by tcpflow. Their mapping, direction and data-sequence ordering must be established from MPTCP DSS options; tcpflow reconstructs individual TCP streams, not the MPTCP connection as a whole. The captures and this mapping are unavailable, so this command sequence does not yet reproduce the final archive.

Key Findings

  • Identified ZIP archive at offset 0x78145B containing 11 files
  • Extracted files include multiple JPEGs: Flag.jpg, Here.jpg, Is.jpg, NOT_A_FLAG.jpg
  • Flag is embedded in one of the extracted images
247CTF{[flag redacted]}