# &#x20;Elizabeth Feinler

### <mark style="color:blue;">Challenge Description</mark>

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FL3WODV73lYfxZXnsZfA8%2Fimage.png?alt=media&#x26;token=b16cbed2-199e-4e38-9426-ec1424472486" alt=""><figcaption></figcaption></figure></div>

### <mark style="color:blue;">Challenge Attachment</mark>

{% file src="<https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FzUj1IOqKQWvXqbhGOreY%2FNoName.pcap?alt=media&token=0d1ac5a3-4722-454d-a945-57117b994ac7>" %}

we will open the packet using wireshark

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FRgURrNf1zHFj08zzNaMo%2Fimage.png?alt=media&#x26;token=c8444a60-df1d-4604-acd5-f9b318c96609" alt=""><figcaption></figcaption></figure></div>

Straight away we notice the unusual DNS traffic within the capture file, with what appears to be subdomains encoded using octal. Let’s extract the hex and see what, if anything, it decodes to:

```bash
tshark -r NoName.pcap -Tfields -e dns.qry.name > names.txt
```

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FgNFCVGnY2AEqKhLJ0h9R%2Fimage.png?alt=media&#x26;token=3269f58d-ad7d-4431-a7aa-cbe6fbc9a465" alt=""><figcaption></figcaption></figure></div>

now let's extract the numbers part using a python script

```python
data = """
143.google.WiCys.com
150.fit.WiCys.edu
143.fit.WiCys.edu
164.netflix.WiCys.in
146.google.WiCys.com
173.fit.WiCys.edu
143.fit.WiCys.edu
162.US.WiCys.gov
63.google.WiCys.com
141.google.WiCys.com
164.netflix.WiCys.in
60.google.WiCys.com
162.fit.WiCys.edu
137.US.WiCys.gov
60.netflix.WiCys.in
146.US.WiCys.gov
137.google.WiCys.com
144.netflix.WiCys.in
60.fit.WiCys.edu
155.netflix.WiCys.in
141.google.WiCys.com
151.netflix.WiCys.in
156.US.WiCys.gov
137.US.WiCys.gov
156.fit.WiCys.edu
64.google.WiCys.com
155.US.WiCys.gov
63.netflix.WiCys.in
137.netflix.WiCys.in
163.fit.WiCys.edu
171.google.WiCys.com
163.US.WiCys.gov
164.US.WiCys.gov
63.fit.WiCys.edu
155.fit.WiCys.edu
175.fit.WiCys.edu
"""

# Split each line by period (".") and extract the first part
lines = data.strip().split('\n')
numbers = [line.split('.')[0] for line in lines]

# Concatenate the extracted numbers into a single line without spaces
result = ' '.join(numbers)

# Print the result
print(result)
```

let's run the script

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2Fctr5qn3nZpilIEoMwBOo%2Fimage.png?alt=media&#x26;token=fc1ed4f0-9190-46fd-ab5c-c4baa69844a6" alt=""><figcaption></figcaption></figure></div>

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FSTkx4L3beDLUiOxKQgUF%2Fimage.png?alt=media&#x26;token=4eb2db6c-cff0-41a1-ae27-1fcc058b7504" alt=""><figcaption></figcaption></figure></div>

### Flag

```
chctf{cr3at0r_0f_d0main_n4m3_syst3m}
```
