CSAW CTF 2015 : Forensics 100 - Transfer write-up

Category : Forensics 
Points : 100

Challenge Description :

I was sniffing some web traffic for a while, I think I finally got something interesting. Help me find flag through all these packets.
net_756d631588cb0a400cc16d1848a5f0fb.pcap

Opening it up with Wireshark gives some few HTTP packets. After looking through those packets, I noticed that one of them contains the word FLAG.

The start of the conversation contains a python script and some random padding at the end which was more likely to be the script's output.

Looking through the python script we notice there is a variable called FLAG (censored) that gets encoded with Base64 then looped through one of the following ciphers ROT13, ROT3 and Base64 (randomly chosen).

 One thing to mention is that the script keeps the cipher index attached to the encrypted string, this will make it easier for us to reverse the whole thing.

	def encode(pt, cnt=50):
	tmp = '2{}'.format(b64encode(pt))
	for cnt in xrange(cnt):
	c = random.choice(enc_ciphers)
	i = enc_ciphers.index(c) + 1
	_tmp = globals()[c](tmp)
	tmp = '{}{}'.format(i, _tmp)
	return tmp

view raw encode.py hosted with ❤ by GitHub

I wrote a quick python script to do the decryption :

	import string
	from base64 import b64decode
	dec_ciphers = ['rot13', 'b64d', 'caesard']
	def rot13(s):
	_rot13 = string.maketrans(
	"ABCDEFGHIJKLMabcdefghijklmNOPQRSTUVWXYZnopqrstuvwxyz",
	"NOPQRSTUVWXYZnopqrstuvwxyzABCDEFGHIJKLMabcdefghijklm")
	return string.translate(s, _rot13)
	def b64d(s):
	return b64decode(s)
	def caesard(plaintext, shift=-3):
	alphabet = string.ascii_lowercase
	shifted_alphabet = alphabet[shift:] + alphabet[:shift]
	table = string.maketrans(alphabet, shifted_alphabet)
	return plaintext.translate(table)
	def decode(pt, cnt):
	tmp = pt
	for i in xrange(cnt):
	index = int(tmp[0])
	choice = dec_ciphers[index - 1]
	decoded = globals()[choice](tmp[1:])
	tmp = decoded
	rawd = b64decode(decoded[1:])
	return rawd
	if __name__ == '__main__':
	data = '2Mk16Sk5iakYxVFZoS1RsWnZXbFZaYjFaa1prWmFkMDVWVGs1U2IyODFXa1ZuTUZadU1YVldiV[...]'
	for j in range(1, 200):
	try:
	FLAG = decode(data, j)
	if 'flag' in FLAG:
	print FLAG
	except:
	pass

view raw flag.py hosted with ❤ by GitHub

Executing the script would give :

flag{li0ns_and_tig3rs_4nd_b34rs_0h_mi}