Elizabeth Feinler

Challenge Description

Challenge Attachment

3KB

NoName.pcap

Open

we will open the packet using wireshark

Straight away we notice the unusual DNS traffic within the capture file, with what appears to be subdomains encoded using octal. Let’s extract the hex and see what, if anything, it decodes to:

tshark -r NoName.pcap -Tfields -e dns.qry.name > names.txt

now let's extract the numbers part using a python script

data = """
143.google.WiCys.com
150.fit.WiCys.edu
143.fit.WiCys.edu
164.netflix.WiCys.in
146.google.WiCys.com
173.fit.WiCys.edu
143.fit.WiCys.edu
162.US.WiCys.gov
63.google.WiCys.com
141.google.WiCys.com
164.netflix.WiCys.in
60.google.WiCys.com
162.fit.WiCys.edu
137.US.WiCys.gov
60.netflix.WiCys.in
146.US.WiCys.gov
137.google.WiCys.com
144.netflix.WiCys.in
60.fit.WiCys.edu
155.netflix.WiCys.in
141.google.WiCys.com
151.netflix.WiCys.in
156.US.WiCys.gov
137.US.WiCys.gov
156.fit.WiCys.edu
64.google.WiCys.com
155.US.WiCys.gov
63.netflix.WiCys.in
137.netflix.WiCys.in
163.fit.WiCys.edu
171.google.WiCys.com
163.US.WiCys.gov
164.US.WiCys.gov
63.fit.WiCys.edu
155.fit.WiCys.edu
175.fit.WiCys.edu
"""

# Split each line by period (".") and extract the first part
lines = data.strip().split('\n')
numbers = [line.split('.')[0] for line in lines]

# Concatenate the extracted numbers into a single line without spaces
result = ' '.join(numbers)

# Print the result
print(result)

let's run the script

Flag

chctf{cr3at0r_0f_d0main_n4m3_syst3m}