247CTF - Custom Protocol Writeup

#!/usr/bin/env python3
from scapy.all import *
from scapy.layers.inet import TCP

PCAP_FILE = "custom_protocol_log.pcap"

def print_hex(pcap_path):
    packets = rdpcap(pcap_path)
    for pkt in packets:
        if TCP in pkt and pkt.haslayer(Raw):
            raw = pkt[Raw].load
            try:
                # Attempt to decode or print as hex
                print(raw.hex())
            except Exception as e:
                print(f"[-] Error: {e}")

if __name__ == "__main__":
    print_hex(PCAP_FILE)

b925afc1 00 31 00 30 00 323430323435313235
b925afc1 00 32 00 30 00 323032383630353038
b925afc1 00 33 00 32 00 33383232383038323633

import zlib

def calc_custom_crc_hex(hex_data: str) -> str:
    data_bytes = bytes.fromhex(hex_data)
    crc_val = zlib.crc32(data_bytes)
    # Convert CRC32 integer to decimal string, then hex-encode that string
    return str(crc_val).encode().hex()

base_hex = "b925afc100310030"
print(f"Payload: {base_hex}")
print(f"Custom CRC Hex: {calc_custom_crc_hex(base_hex)}")
# Output: 323430323435313235 (Matches the PCAP!)

#!/usr/bin/env python3
import zlib
from pwn import *

HOST = "35f9359cc67c7983.247ctf.com"
PORT = 50385
context.log_level = "info"

def calc_custom_crc_hex(hex_data: str) -> str:
    data_bytes = bytes.fromhex(hex_data)
    crc_val = zlib.crc32(data_bytes)
    return str(crc_val).encode().hex()

def solve():
    sep = "00"
    counter = "31"
    # 原记录覆盖单字节 0x30..0x3e；0x3a..0x3e 是标点，不是十进制 10..14
    commands = [bytes([value]).hex() for value in range(0x30, 0x3f)]

    for cmd in commands:
25 collapsed lines
        conn = None
        try:
            conn = remote(HOST, PORT, timeout=5)
            # Receive Session ID
            session_id = conn.recvline(drop=True).decode(errors="replace")
            log.info(f"Session ID: {session_id} | Testing Command: {cmd}")

            # Construct payload: [SessionID][00][Counter][00][Command][00][Checksum]
            base_hex = f"{session_id}{sep}{counter}{sep}{cmd}"
            crc_hex = calc_custom_crc_hex(base_hex)
            payload = f"{base_hex}{sep}{crc_hex}"

            conn.sendline(payload.encode())

            raw_response = conn.recvall(timeout=3).decode(errors="replace")
            try:
                # Server returns hex-encoded response
                decoded_response = bytes.fromhex(raw_response).decode(errors="replace")
                if "247CTF" in decoded_response:
                    log.success(f"Flag found: {decoded_response}")
                    conn.close()
                    return
            except ValueError:
                log.warning(f"Failed to decode hex response: {raw_response}")
            print("-" * 40)
        except (EOFError, OSError, ValueError) as exc:
            log.warning(f"Command {cmd} failed: {exc}")
        finally:
            if conn is not None:
                conn.close()

if __name__ == "__main__":
    solve()