Mittwoch, 26. Mai 2010

Defcon 18 CTF Writeup - Packet Madness 400



sequence numbers can be magical


Sequence number: 1 (relative sequence number)
Next sequence number: 52 (relative sequence number)
Acknowledgement number: 1 (relative ack number)


(UNKNOWN) [] 69 (?) : Connection refused




for a = 1 to 255
for b = 1 to len(data)
print(value - a)

The output looks like:



Where did the nop certifier meet Rick in his most famoustale?





This took us little more google time.

Inside the text you will see parking lot of "Stardust"

1 Kommentar:

  1. Actually the sequence number wasn't a red herring, but it gave the same result. The sequence number was xFB xEE x28 xFF. With some Googling, we found that xFB xEE x28 is the magic sequence for BOCU, Binary Ordered Compression for Unicode. The final xFF byte is a reset character. More on that can be found here:

    With a BOCU decoder tool we were able to extract the same string. Nice job doing it the hard way, you probably got it faster than we did.

    Acidtrux/Team Anomaly