Ph4nt0m 1ntrud3r (PicoCTF Write Up)

Challenge Overview

In this picoCTF challenge, we are given a network capture file (.pcap). The description tells us that a “phantom intruder” has stolen sensitive data and our task is to analyze the network traffic to recover the hidden flag.

A .pcap file contains captured network packets, meaning it records all communication that happened on a network during a specific period of time. By analyzing these packets we can inspect protocols, payloads, and potentially hidden information left by an attacker.

To investigate the capture file, I used Wireshark, a popular network analysis tool that allows us to inspect packets in detail.

The first thing I did was open the provided .pcap file in Wireshark.

After loading the file, Wireshark displays a list of packets with columns such as:

Packet number, Time, Source, Destination, Protocol, Length, and Packet information

At first glance, the traffic does not look particularly suspicious. However, when inspecting the packet payloads in the lower pane, I started noticing strings that looked like encoded data. These strings looked very familiar because they follow the typical pattern of Base64 encoding.

To speed up the investigation, instead of manually inspecting every packet in Wireshark, I used tshark, the command-line version of Wireshark, to extract the relevant packet data.

From earlier inspection, I noticed that the suspicious packets had very small TCP payload lengths, specifically 12 bytes and 4 bytes. These small packets are unusual and suggested that they might contain fragments of encoded data.

To filter only those packets, I used the following command:

tshark -r myNetworkTraffic.pcap -Y "tcp.len==12 || tcp.len==4" -T fields -e tcp.segment_data | xxd -r -p

Explanation of the command:

• -r myNetworkTraffic.pcap → reads the provided PCAP file
• -Y "tcp.len==12 || tcp.len==4" → filters packets with payload length 12 or 4 bytes
• -T fields -e tcp.segment_data → extracts only the TCP payload data
• xxd -r -p → converts the extracted hex data back into readable ASCII

After running the command, several Base64-encoded fragments appeared in the output.

However, the fragments did not immediately form a readable message. This happened because the extracted pieces were not in the correct order.

To fix this, I opened the capture again in Wireshark and sorted the packets by the Time column. By arranging them chronologically, it became easier to observe the correct sequence of packet transmissions.

After sorting by time, I could see how each encoded fragment was transmitted step-by-step by the attacker. This allowed me to reconstruct the encoded message in the correct order.

Once the fragments were arranged properly, I combined them and decoded the Base64 string to reveal the final flag.

cGljb0NURg==
ezF0X3c0cw==
bnRfdGg0dA==
XzM0c3lfdA==
YmhfNHJfMw==
NmY0YTY2Ng==
fQ==

Conclusion

This challenge demonstrates a simple but realistic technique used in network-based data exfiltration. Instead of sending sensitive information directly, the attacker:

1. Encoded the message using Base64
2. Split the encoded message into multiple network packets
3. Transmitted them separately across the network

By analyzing the packet capture file, extracting the encoded payloads, and decoding them, we were able to reconstruct the hidden message and recover the flag.

This challenge highlights the importance of network traffic analysis skills in digital forensics, especially when investigating suspicious activity or hidden data within packet captures.

Recognizing Base64 Encoded Data

Base64 is a common encoding method used to convert binary data into readable ASCII text. There are a few indicators that suggest a string might be Base64 encoded:

• It only contains letters, numbers, +, or /
• It often ends with = or ==
• The strings appear random but structured

The payload strings I found matched these characteristics perfectly. This strongly suggested that the attacker encoded the hidden message using Base64 before sending it across the network.

Another important observation was that each packet contained only a small fragment of encoded text. This implies that the attacker split the message into multiple parts before transmitting it.

written by Annisa E. Putri