Description for this challenge was:
Admire our cutest Stegosaurus ever!
They give you a pcap file called stego.pcap, sooooo let's fire up Wireshark and see if a shark can find a dinosaur.
Initially saw a /message.png route being hit, so I decided to see if I could extract that out of the pcap.
In Wireshark, this is really simple, just follow the TCP stream / File > Export Objects > HTTP, and you'll see it pop up with the file seen in the traffic.
Save and open the file and we get:
Something about this pun in this makes me tear up a bit....
(Also Pro-Tip for trolling stego solvers in the future, add some random artifacts into the image like they mean something, after staring at that dino leg on the right with the seam, I almost thought it could be hidden there... Not sure if it was the caffeine or sleep-deprivation, either way it'll work on someone)
Anyways, down to business.
Running this image through the standard stego tools & photo editing tools got nothing. Tried a quick sweep through the threshold, bitplanes, alpha, stereograph, etc. Nothing too interesting was in the exif data either.
So after taking a break on this one and coming back I looked in the packets again to see if anything else was there for carving.
Started to look for any patterns in any part of the packets (being only 2k of them & fairly regular).
Then I stumbled upon this little gem:
What... is this Urgent pointer thing all about ? Why so Urgent ?
This must be the Nova Microdash of TCP packets.....
So let's see if we can find out what's so urgent.
After going through a few, it looks like they may actually be in the printable character range. This one was 70, let's convert that, write it down and go to the next one. The next was 123, these two combined make the characters 'F{' ... going backwards we'll also see 67 & 84 as 'CT'... All of this together is 'CTF{' -- Looks like we're on the right track.
Now I could've probably done this by hand, but I didn't want to, felt a little lazy and also thought it was a good time to explore tshark more. So in a new terminal I went ahead and executed this command (kinda luckily guessed this one, I'm not very experienced with tshark):
> tshark -r stego.pcap -T fields -e tcp.urgent_pointer 0 0 0 0 0 0 67 0 84 0 70 0 123 0 65 0 110 0 100 0 ...
(Cut the output down for brevity) -- The problem with this output is there are all these 0 bytes that are sneaking in to our nice characters we want to extract. We could just grep these out to make life easier:
> tshark -r stego.pcap -T fields -e tcp.urgent_pointer | egrep -vi "^0$" 67 84 70 123 65 110 100 ...
There's probably a really cool hacky way to turn these all to chars on the command-line (leave a comment if you know one), but I just threw it in a python script, did some normal vim/sed magic for converting it to a list, and printed out the result:
arr = [
67,
84,
70,
123,
65,
110,
100,
95,
89,
111,
117,
95,
84,
104,
111,
117,
103,
104,
116,
95,
73,
116,
95,
87,
97,
115,
95,
73,
110,
95,
84,
104,
101,
95,
80,
105,
99,
116,
117,
114,
101,
125,
]
print "".join([chr(x) for x in arr])
After running this we get the answer:
CTF{And_You_Thought_It_Was_In_The_Picture}
Learned a lot in this challenge including urgent flags, how evil a stego creator can get (including imagined scenarios that could've been worse), and how to spell Stegosaurus.
