back to home

PSYCHORAPTURE, pt. 1 Challenge #1 - Axon

This challenge can be found when Eli uses his scrapers to impersonate the Guacs.

The Setup

Help the team review the internet traffic capture produced by Sally's scraper!

Review the private IP addresses pinging back to the nucleus. Could they mean anything?

We are given a network capture, capture.pcap, of about 4700 packets over 42 seconds.

The Beacons

Opening the file with Wireshark, we see mostly HTTP trafic back and forth from different addresses.

The "public" address is always the same: 13.37.13.37. The "private" addresses are numerous.

We can assume that this public address is the "nucleus" mentioned in the challenge description, and the private addresses are those we need to analyze.

Let's use the wireshart CLI tools to analyze the requests:

$ tshark -r capture.pcap -Y "http.request" -T fields -e ip.src -e ip.dst -e http.request.method -e http.request.uri -e http.host
10.0.0.75       13.37.13.37     POST    /checkin        hq.axos.com
10.0.0.75       13.37.13.37     POST    /checkin        hq.axos.com
10.0.0.75       13.37.13.37     POST    /checkin        hq.axos.com
10.0.0.69       13.37.13.37     POST    /checkin        hq.axos.com
10.0.0.89       13.37.13.37     POST    /checkin        hq.axos.com
10.0.0.75       13.37.13.37     POST    /checkin        hq.axos.com
10.0.0.123      13.37.13.37     POST    /checkin        hq.axos.com
...

The last byte of these addresses might make your CTF senses tingle: 75 is K, 69 is E, 87 is Y and 123 is {.

It seems we need to list the last bytes of these addresses. It also seems we need to ignore any subsequent occurence of each address.

$ tshark -r capture.pcap -Y "http.request" -T fields -e ip.src | awk '!seen[$0]++'
10.0.0.75
10.0.0.69
10.0.0.89
10.0.0.123
...
10.0.0.125

Decoding the last byte of each address, we get our key!