## TransferWriteup by @auscompgeek.
> I was sniffing some web traffic for a while, I think i finally got something interesting. Help me find flag through all these packets.>> net_756d631588cb0a400cc16d1848a5f0fb.pcap
Let's cut to the chase.
The provided pcap contains a TCP connection from 192.168.15.133 to 192.168.15.135:80.There are no packets from 192.168.15.135, besides ACKs, in this connection.
The first PSH packet in the connection contains some Python:```pythonimport stringimport randomfrom base64 import b64encode, b64decode
FLAG = 'flag{xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx}'
enc_ciphers = ['rot13', 'b64e', 'caesar']# dec_ciphers = ['rot13', 'b64d', 'caesard']
def rot13(s):	_rot13 = string.maketrans(    	"ABCDEFGHIJKLMabcdefghijklmNOPQRSTUVWXYZnopqrstuvwxyz",    	"NOPQRSTUVWXYZnopqrstuvwxyzABCDEFGHIJKLMabcdefghijklm")	return string.translate(s, _rot13)
def b64e(s):	return b64encode(s)
def caesar(plaintext, shift=3):    alphabet = string.ascii_lowercase    shifted_alphabet = alphabet[shift:] + alphabet[:shift]    table = string.maketrans(alphabet, shifted_alphabet)    return plaintext.translate(table)
def encode(pt, cnt=50):	tmp = '2{}'.format(b64encode(pt))	for cnt in xrange(cnt):		c = random.choice(enc_ciphers)		i = enc_ciphers.index(c) + 1		_tmp = globals()[c](tmp)		tmp = '{}{}'.format(i, _tmp)
	return tmp
if __name__ == '__main__':	print encode(FLAG, cnt=?)```
The rest of the TCP stream contains the ciphertext, which begins with`2Mk16Sk5iakYxVFZoS1RsWnZXbFZaYjFaa1prWmFkMDVWVGs1U2IyODFXa1ZuTUZadU1Y`.
The provided Python code first prepends '2' to the plaintext, base64 encodes it,then goes into a loop.  For each iteration of the loop:
1. pick a random cipher from rot13, base64, and a Caesar shift of 3;2. perform the cipher on the current `pt`; then3. prepend the cipher index (1 for rot13, 2 for base64, 3 for Caesar) to `pt`.
All three ciphers are trivially reversible, and which cipher is used for eachiteration is given by the index, so reversing the algorithm is fairly trivial.
### Solution```python#!/usr/bin/env python2
import stringimport randomfrom base64 import b64encode, b64decode
FLAG = open('net-encoded.txt').read()
enc_ciphers = ['rot13', 'b64e', 'caesar']dec_ciphers = ['rot13', 'b64d', 'caesard']
def rot13(s):	_rot13 = string.maketrans(		"ABCDEFGHIJKLMabcdefghijklmNOPQRSTUVWXYZnopqrstuvwxyz",		"NOPQRSTUVWXYZnopqrstuvwxyzABCDEFGHIJKLMabcdefghijklm")	return string.translate(s, _rot13)
def b64e(s):	return b64encode(s)
def b64d(s):	return b64decode(s)
def caesar(plaintext, shift=3):	alphabet = string.ascii_lowercase	shifted_alphabet = alphabet[shift:] + alphabet[:shift]	table = string.maketrans(alphabet, shifted_alphabet)	return plaintext.translate(table)
def caesard(ciphertext, shift=3):	return caesar(ciphertext, shift=-shift)
def encode(pt, cnt=50):	tmp = '2{}'.format(b64encode(pt))	for cnt in xrange(cnt):		c = random.choice(enc_ciphers)		i = enc_ciphers.index(c) + 1		_tmp = globals()[c](tmp)		tmp = '{}{}'.format(i, _tmp)
	return tmp
def decode(ct):	while ct[0].isdigit():		i = int(ct[0]) - 1		c = dec_ciphers[i]		ct = globals()[c](ct[1:])	return ct
if __name__ == '__main__':	print decode(FLAG)```
Our final flag is `flag{li0ns_and_tig3rs_4nd_b34rs_0h_mi}`.