A Warning
Challenge:
Luciafer is being watched! Someone on the inside of Lytton Labs can see what she is doing and is sending her a message.
One of them says: "Stay away from Lytton Labs… you have been warned."
To find the flag, find the message. You'll know it when you see it. Submit the flag as
flag{flag-goes-here}
.Use the PCAP from LYTTON LABS 01 - Monstrum ex Machina.
Solution:
Performing a string search for "you have been warned" in Wireshark identified a couple streams that were actually related to solving future challenges, but the search at least provided us a source IP address to pivot on:
We applied a filter of ip.src == 192.168.100.105
and the first stream in the results (stream #73225) contained a JPG named da-warning-message.jpg
which was transferred over HTTP.
wget -O da-warning-message.jpg http://192.168.100.105/da-warning-message.jpg
--2021-08-22 17:57:03-- http://192.168.100.105/da-warning-message.jpg
Connecting to 192.168.100.105:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 578908 (565K) [image/jpeg]
Saving to: 'da-warning-message.jpg'
0K .......... .......... .......... .......... .......... 8% 123M 0s
50K .......... .......... .......... .......... .......... 17% 89.4M 0s
100K .......... .......... .......... .......... .......... 26% 392M 0s
150K .......... .......... .......... .......... .......... 35% 242M 0s
200K .......... .......... .......... .......... .......... 44% 110M 0s
250K .......... .......... .......... .......... .......... 53% 411M 0s
300K .......... .......... .......... .......... .......... 61% 384M 0s
350K .......... .......... .......... .......... .......... 70% 468M 0s
400K .......... .......... .......... .......... .......... 79% 431M 0s
450K .......... .......... .......... .......... .......... 88% 414M 0s
500K .......... .......... .......... .......... .......... 97% 429M 0s
550K .......... ..... 100% 333M=0.002s
2021-08-22 17:57:03 (225 MB/s) - 'da-warning-message.jpg' saved [578908/578908]
We used Wireshark's File->Export Objects->HTTP option to export the JPG, which revealed the flag.
Leave a comment