# Sniffer - Forensics
### Points : #### Solved : #
###### Files :[sniffer.rar](sniffer.rar)
######  HintsNone
---
# Walkthrough
Unraring the sniffer.rar file will extract a pcap file containing captured network trafic. After opening the file using wireshark, there a are a lot of UDP and TCP streams but extracting them wasn't helpful.
That being said, taking a look at the "Ethernet" packets was actually helpful as each one of them contains some data. We can filter the packets using tshark given that these packets have fixed length (29)
```$  tshark -r pcap_sniffer.pcap -Y '((frame.len == 29))'  262  75.983811 Applicon_01:6c:cf → 45:00:00:1d:00:01 0x0a00 29  Ethernet II  263  75.986726 Applicon_01:6c:cf → 45:00:00:1d:00:01 0x0a00 29  Ethernet II  264  75.987725 Applicon_01:6c:cf → 45:00:00:1d:00:01 0x0a00 29  Ethernet II  265  75.988776 Applicon_01:6c:cf → 45:00:00:1d:00:01 0x0a00 29  Ethernet II  266  75.989697 Applicon_01:6c:cf → 45:00:00:1d:00:01 0x0a00 29  Ethernet II  267  75.990853 Applicon_01:6c:cf → 45:00:00:1d:00:01 0x0a00 29  Ethernet II  268  75.991871 Applicon_01:6c:cf → 45:00:00:1d:00:01 0x0a00 29  Ethernet II  269  75.992966 Applicon_01:6c:cf → 45:00:00:1d:00:01 0x0a00 29  Ethernet II  270  75.993987 Applicon_01:6c:cf → 45:00:00:1d:00:01 0x0a00 29  Ethernet II  271  75.994926 Applicon_01:6c:cf → 45:00:00:1d:00:01 0x0a00 29  Ethernet II  272  75.995933 Applicon_01:6c:cf → 45:00:00:1d:00:01 0x0a00 29  Ethernet II  273  75.996932 Applicon_01:6c:cf → 45:00:00:1d:00:01 0x0a00 29  Ethernet II  274  75.997886 Applicon_01:6c:cf → 45:00:00:1d:00:01 0x0a00 29  Ethernet II  275  75.999012 Applicon_01:6c:cf → 45:00:00:1d:00:01 0x0a00 29  Ethernet II  276  76.000019 Applicon_01:6c:cf → 45:00:00:1d:00:01 0x0a00 29  Ethernet II  277  76.001019 Applicon_01:6c:cf → 45:00:00:1d:00:01 0x0a00 29  Ethernet II  278  76.001986 Applicon_01:6c:cf → 45:00:00:1d:00:01 0x0a00 29  Ethernet II  279  76.003135 Applicon_01:6c:cf → 45:00:00:1d:00:01 0x0a00 29  Ethernet II  280  76.004500 Applicon_01:6c:cf → 45:00:00:1d:00:01 0x0a00 29  Ethernet II  281  76.005722 Applicon_01:6c:cf → 45:00:00:1d:00:01 0x0a00 29  Ethernet II  282  76.037106 Applicon_01:6c:cf → 45:00:00:1d:00:01 0x0a00 29  Ethernet II  283  76.038075 Applicon_01:6c:cf → 45:00:00:1d:00:01 0x0a00 29  Ethernet II  284  76.039100 Applicon_01:6c:cf → 45:00:00:1d:00:01 0x0a00 29  Ethernet II  285  76.040085 Applicon_01:6c:cf → 45:00:00:1d:00:01 0x0a00 29  Ethernet II  286  76.041019 Applicon_01:6c:cf → 45:00:00:1d:00:01 0x0a00 29  Ethernet II  287  76.042006 Applicon_01:6c:cf → 45:00:00:1d:00:01 0x0a00 29  Ethernet II  288  76.043057 Applicon_01:6c:cf → 45:00:00:1d:00:01 0x0a00 29  Ethernet II  289  76.044099 Applicon_01:6c:cf → 45:00:00:1d:00:01 0x0a00 29  Ethernet II  290  76.045035 Applicon_01:6c:cf → 45:00:00:1d:00:01 0x0a00 29  Ethernet II  291  76.045973 Applicon_01:6c:cf → 45:00:00:1d:00:01 0x0a00 29  Ethernet II  292  76.046954 Applicon_01:6c:cf → 45:00:00:1d:00:01 0x0a00 29  Ethernet II  293  76.047919 Applicon_01:6c:cf → 45:00:00:1d:00:01 0x0a00 29  Ethernet II  294  76.048853 Applicon_01:6c:cf → 45:00:00:1d:00:01 0x0a00 29  Ethernet II  295  76.049791 Applicon_01:6c:cf → 45:00:00:1d:00:01 0x0a00 29  Ethernet II  296  76.050780 Applicon_01:6c:cf → 45:00:00:1d:00:01 0x0a00 29  Ethernet II  297  76.051738 Applicon_01:6c:cf → 45:00:00:1d:00:01 0x0a00 29  Ethernet II
```
We can simply extract the data via this command
```$ tshark -r pcap_sniffer.pcap -Y '((frame.len == 29))'  -T  fields -e data020f010101010800a4ff0000000053020f010101010800b1ff0000000046020f01010101080087ff0000000070020f010101010800a0ff0000000057020f010101010800a4ff0000000053020f010101010800a2ff0000000055020f0101010108008bff000000006c020f010101010800c0ff0000000037020f01010101080096ff0000000061020f010101010800b3ff0000000044020f010101010800b5ff0000000042020f010101010800c4ff0000000033020f0101010108009fff0000000058020f010101010800c5ff0000000032020f010101010800a6ff0000000051020f0101010108007fff0000000078020f0101010108009dff000000005a020f010101010800b1ff0000000046020f010101010800beff0000000039020f010101010800c2ff0000000035020f010101010800aaff000000004d020f010101010800afff0000000048020f010101010800a1ff0000000056020f01010101080091ff0000000066020f0101010108009dff000000005a020f0101010108008dff000000006a020f010101010800b1ff0000000046020f01010101080082ff0000000075020f0101010108009dff000000005a020f010101010800b1ff0000000046020f010101010800beff0000000039020f01010101080083ff0000000074020f010101010800aaff000000004d020f0101010108007dff000000007a020f010101010800beff0000000039
```
Now we just go other the data and extract the last two bits while removing extra spaces
```$ for val in $(tshark -r pcap_sniffer.pcap -Y '((frame.len == 29))'  -T  fields -e data ); do a=${val:28:2}; echo $a ; done | tr -d [:space:] 5346705753556c3761444233583251785a4639354d4856665a6a46755a4639744d7a3939```This is interesting, we can decode this from hex to ascii
```$ echo 5346705753556c3761444233583251785a4639354d4856665a6a46755a4639744d7a3939 | xxd -r -pSFpWSUl7aDB3X2QxZF95MHVfZjFuZF9tMz99```
This sounded like it is encoded in base64, let's verify that
```$ echo SFpWSUl7aDB3X2QxZF95MHVfZjFuZF9tMz99 | base64 -dHZVII{h0w_d1d_y0u_f1nd_m3?}```
That's it! Here is the one liner :```$ for val in $(tshark -r pcap_sniffer.pcap -Y '((frame.len == 29))'  -T  fields -e data ); do a=${val:28:2}; echo $a ; done | tr -d [:space:] | xxd -r -p | base64 -dHZVII{h0w_d1d_y0u_f1nd_m3?}```
## Flag
HZVII{h0w\_d1d\_y0u\_f1nd\_m3?}
