Security if God wills it

perdu Writeup (Nuit Du Hack 2018)

perdu was a 100-point forensics challenge at Nuit Du Hack 2018. I personally didn't beat it in time, mainly due to a lack of sleep, a high consumption of beer and the fact that socializing is much more amusing than flagging.

Although someone else from our team ended up flagging it, I decided to solve it after the event ended and write it up myself.

Challenge description

Because we can't access the platform anymore, this challenge shall remain without description for now. The description mentions data exfiltration, and we are provided with a file named perdu.pcap.


Opening the .pcap in wireshark, we can observe a lot of HTTP exchanges with

I spent a lot of time trying to figure out whether anything was hidden in the requests, but I came up with nothing.

After following several inconclusive leads, I noticed that all the TCP ports used in the communication were in the range [4000;4200].

Extracting data

Looking at the last 3 digits, it is natural to assume that the ports may be used to encode ASCII characters.

SIben and I came up with this cool oneliner to extract the data:

~$ tshark -r perdu.pcap -Y http.request -Tfields -e tcp.srcport | cut -c 2-4 | awk '{ printf("%c", $0); }'

It basically retrieves all the ports used in the HTTP requests, subtract 4000 to them and prints the result as an ASCII character.

The output is the following:

   ==Phrack Inc.==

                    Volume One, Issue 7, Phile 3 of 10

The following was written shortly after my arrest...

                       \/\The Conscience of a Hacker/\/


                               +++The Mentor+++

                          Written on January 8, 1986

        Damn kids.  They're all alike.

        I am a hacker, enter my world...
        Damn underachiever.  They're all alike.

        Damn kid.  Probably copied it.  They're all alike.

                Or feels threatened by me...
                Or thinks I'm a smart ass...
                Or doesn't like teaching and shouldn't be here...






                               +++The Mentor+++
Well done : ndh16_{e132697f156befd669df0726f06ab338f0a225da3267661cfa9bb720161b2af9}

Yay for the hacker manifesto, flagged!

Flag: ndh16_{e132697f156befd669df0726f06ab338f0a225da3267661cfa9bb720161b2af9}

comments powered by Disqus

Receive Updates