## Challenge description:Something is suspicious about defund's math papers. See if you can find anything in the [network packets](https://github.com/TheEquus/angstromCTF2019-Writeups/blob/master/misc/paper_trail.pcapng) we've intercepted from his computer.
## Solution: We are given the file: paper_trail.pcapng. Opening this with wireshark, we can see it's a TCP connection of an IRC chat.By following the TCP stream, we get the following messages:
```PRIVMSG defund :I have to confide in someone, even if it\'s myselfPRIVMSG defund :my publications are all randomly generated :(PRIVMSG defund :aPRIVMSG defund :cPRIVMSG defund :tPRIVMSG defund :fPRIVMSG defund :{PRIVMSG defund :fPRIVMSG defund :aPRIVMSG defund :kPRIVMSG defund :ePRIVMSG defund :_PRIVMSG defund :mPRIVMSG defund :aPRIVMSG defund :tPRIVMSG defund :hPRIVMSG defund :_PRIVMSG defund :pPRIVMSG defund :aPRIVMSG defund :pPRIVMSG defund :ePRIVMSG defund :rPRIVMSG defund :sPRIVMSG defund :}```
And with that, we get our flag: `actf{fake_math_papers}`