AirTech CTF 2024 - Back To The Bases

A network forensics CTF chall. writeup.

first

Let's get Cracking...

There was a Wire Shark file given in order for us solve the challenge. You can also download the challenge file by clicking here

When I opened the file I noticed that there are some TCP packets.

first

So without any delay I followed the TCP Stream from Analyze > Follow > TCP Stream menu. After following it I found the following chat.

first

As they are talking about a file. So I applied the FTP filter and found a flag.txt file.

first

So I extracted it from File > Extract Object > FTP Data.

first

After saving and opening the file I found the following text.

first


AFAi^Xd%^W  ^TA ^XAj]j]j]!)btGBQZUQhvA--

Now if you remember from the chat there where two more leads as well.

first

So I simply opened CyberChief and typed XOR and used 05 as the key but sadly it didn't work.

first

But when you have a key you always have the option to Brute Force it. When I Brute Forced the cipher I found a base64 encoded string.

first

Simply decoded the string and got the flag.

Flag: AT24{y4m44444t33333_kud@$@1}

Stay in the loop with my latest content – follow me on Medium for more!