This level was more like a Trivia level. pkt400_b1d0e962f07dde0.pcap was given with a single package inside.
sequence numbers can be magical
The description was not a red herring, look into the Comments to get more infos. Thx to Acidtrux/Team Anomaly for this information
Sequence number: 1 (relative sequence number)
Next sequence number: 52 (relative sequence number)
Acknowledgement number: 1 (relative ack number)
There wasn't much to look into, so i assume most of you concentrated first on the given IP-Addresses and tried to communicate with them.
(UNKNOWN) [22.214.171.124] 69 (?) : Connection refused
But we stoped after we resolved that this is a .MIL address (CON1R.NIPR.MIL)
After solving Packet Madness 100, i just played around with the data field.
I wrote a small tool to play around with the vars. Pseudecode was like:
for a = 1 to 255
for b = 1 to len(data)
print(value - a)
The output looks like:
For completeness a has the value 80d. This means you have to subtract 80d from every byte to get this string.
Where did the nop certifier meet Rick in his most famoustale?
Now the Google part begins. We brainstormed in the round and found that the NOP Certifier could be Dave Aitel. But who is Rick?
We mailed Dave if he can tell us, who Rick is. But he didn't know it.
We got this fast, because we had luck to have my friend adc in our team :)
Dave Aitel graduated from the same uni as adc is being studying atm. So he took his old address email@example.com and googled for it.
This took us little more google time.
Finally we found The Birth of a Gay Slut where we have the Rick :)
Inside the text you will see
parking lot of "Stardust"