Mittwoch, 26. Mai 2010

Defcon 18 CTF Writeup - Packet Madness 400

I didn't see any writeup on this, so i write up our version.

This level was more like a Trivia level. pkt400_b1d0e962f07dde0.pcap was given with a single package inside.

sequence numbers can be magical

The description was a red herring, but the first look was on the sequence number.
The description was not a red herring, look into the Comments to get more infos. Thx to Acidtrux/Team Anomaly for this information

Sequence number: 1 (relative sequence number)
Next sequence number: 52 (relative sequence number)
Acknowledgement number: 1 (relative ack number)

There wasn't much to look into, so i assume most of you concentrated first on the given IP-Addresses and tried to communicate with them.

(UNKNOWN) [] 69 (?) : Connection refused
But we stoped after we resolved that this is a .MIL address (CON1R.NIPR.MIL)

After solving Packet Madness 100, i just played around with the data field.


I wrote a small tool to play around with the vars. Pseudecode was like:

for a = 1 to 255
for b = 1 to len(data)
print(value - a)

The output looks like:


For completeness a has the value 80d. This means you have to subtract 80d from every byte to get this string.

Where did the nop certifier meet Rick in his most famoustale?

Now the Google part begins. We brainstormed in the round and found that the NOP Certifier could be Dave Aitel. But who is Rick?

We mailed Dave if he can tell us, who Rick is. But he didn't know it.

We got this fast, because we had luck to have my friend adc in our team :)

Dave Aitel graduated from the same uni as adc is being studying atm. So he took his old address and googled for it.

This took us little more google time.
Finally we found The Birth of a Gay Slut where we have the Rick :)

Inside the text you will see parking lot of "Stardust"

1 Kommentar:

  1. Actually the sequence number wasn't a red herring, but it gave the same result. The sequence number was xFB xEE x28 xFF. With some Googling, we found that xFB xEE x28 is the magic sequence for BOCU, Binary Ordered Compression for Unicode. The final xFF byte is a reset character. More on that can be found here:

    With a BOCU decoder tool we were able to extract the same string. Nice job doing it the hard way, you probably got it faster than we did.

    Acidtrux/Team Anomaly