247CTF - Follow The Sequence

posted
read
104 words · 1 min
tags
#247ctf#ctf#writeup
contents

Multi-path TCP (MPTCP) challenge: data is spread across multiple subflows. Task is to combine the requests and recover the flag.

Solution Steps

Terminal window
# 1. Merge the three PCAP files
mergecap -w merged_chall.pcap chall-i1.pcap chall-i2.pcap chall-i3.pcap


# 2. Extract TCP flows
tcpflow -r merged_chall.pcap -o ./output_dir


# 3. Concatenate already ordered payload fragments without truncating any input
cat a b c > combined.bin


# 4. Extract embedded archive with binwalk
binwalk -eM combined.bin

a, b and c denote extracted payload fragments, not filenames produced automatically by tcpflow. Their mapping, direction and data-sequence ordering must be established from MPTCP DSS options; tcpflow reconstructs individual TCP streams, not the MPTCP connection as a whole. The captures and this mapping are unavailable, so this command sequence does not yet reproduce the final archive.

Key Findings

  • Identified ZIP archive at offset 0x78145B containing 11 files
  • Extracted files include multiple JPEGs: Flag.jpg, Here.jpg, Is.jpg, NOT_A_FLAG.jpg
  • Flag is embedded in one of the extracted images

247CTF{[flag redacted]}