Are you a good listener? Expect us!

This time you’re the target. :-)

Ok, I started tcpdump on my VPN tunnel interface (all CTF gates are available only through openvpn tunnel) and tooked a waiting position.

18:49:16.639534 IP (tos 0x0, ttl 63, id 6960, offset 0, flags [DF], proto UDP (17), length 64) > [udp sum ok] 24723+ MX? dctfu3792.1337.def. (36)
18:49:16.639686 IP (tos 0x0, ttl 64, id 29941, offset 0, flags [none], proto UDP (17), length 92) > [udp sum ok] 24723* q: MX? dctfu3792.1337.def. 1/0/0 dctfu3792.1337.def. MX 10 (64)

Looks like someone is trying to use us as DNS server… Okaay, let’s set our ip as mail server (MX) in dnsmasq:



Then restart dnsmasq, launch nc on smtp (25) port and get back to tcpdump.
Ta-daaaam: > Flags [S], cksum 0x2074 (correct), seq 2422406009, win 29200, options [mss 1369,sackOK,TS val 20805670 ecr 0,nop,wscale 7], length 0
18:50:48.022220 IP (tos 0x0, ttl 64, id 1784, offset 0, flags [DF], proto TCP (6), length 64)

Someone is wanted to communicate us via SMTP. Why not? Simulating “SMTP” protocol manually :)
Legend: S – server, C – client.

S: 220 ESMTP is glad to see you!
C: EHLO dns
S: 250 domain name should be qualified
S: 250
C: RCPT TO:<[email protected].def>
S: 250
S: 354 Enter mail, end with "." on a line by itself
C: Received: by dns (Postfix, from userid 0)
		id 9961A4D6F; Sat,  3 Oct 2015 17:50:48 +0200 (CEST)
	Date: Sat, 3 Oct 2015 17:50:48 +0200
	From: MISC 500 <>
	To: [email protected].def
	Subject: Almost there!
	Message-ID: <>
	MIME-Version: 1.0
	Content-Type: multipart/mixed; boundary="qMm9M+Fa2AknHoGS"
	Content-Disposition: inline
	User-Agent: Mutt/1.5.21 (2010-09-15)
	Content-Type: text/plain; charset=us-ascii
	Content-Disposition: inline
	Content-Type: application/vnd.tcpdump.pcap
	Content-Disposition: attachment; filename="ftps.pcap"
	Content-Transfer-Encoding: base64

We received ftpfs.pcap file. This is a traffic dump file. I opened it in wireshark and saw that this is a dump of samba dialogue. I exported SMB object (File->Export Objects -> SMB/SMB2).

DCTF 2015 MISC 350


It’s a zipfile with.. what? emotions… aaa.. “Emotional Roller Coaster” :) I opened random gif and saw the following:


Looks like it’s base64 encoded data. Then I noticed that these gifs have near modification dates. I tried to fetch all exif data from these gifs in order of their modification:

ls -tr | xargs exiftool | grep 'Camera Model Name' | awk '{print $5}' | base64 -D >b.tmp && file b.tmp
b.tmp: Zip archive data, at least v1.0 to extract
unzip b.tmp
Archive:  b.tmp
   creating: sol/
 extracting: sol/flag
  inflating: junk
  inflating: junk (copy)
  inflating: junk (3rd copy)
  inflating: junk (4th copy)
  inflating: junk (5th copy)
  inflating: junk (6th copy)
  inflating: junk (7th copy)
  inflating: junk (8th copy)
  inflating: junk (9th copy)
  inflating: junk (10th copy)
  inflating: junk (11th copy)
  inflating: junk (12th copy)
  inflating: junk (another copy)
cat sol/flag

Gotcha :)
Flag: DCTF{e4045481e906132b24c173c5ee52cd1e}.