This is an older challenge that I had an unpublished writeup for.
The publishing date doesn’t align with when the CTF took place.

---

Traffic (the title might be wrong) was challenge that was part of BitDefender’s Cybersecurity Grand Prix event (one of the regional events from that series).

This challenge started with a pcap file that

I noticed a few interesting things:

• there’s a directory listing captured in this file and the user those documents afterwards
• there’s a bunch of file being downloaded

Let’s start with the files:

• one of them has some information about Area 51
• one of them has some
• and one of them is a cake recipe (in romanian)

Then, I extracted the images using NetworkMiner.
I’ll leave the meaning of this to the romanian speaking audience, but let’s just say that while the images were valid they weren’t getting me any closer to the flag.

Then I noticed the next interesting thing in the PCAP file: a bunch of DNS traffic.
And something unusual is that among some “regular” domains I could see queries to “feisbuc.com”.
Fun fact: “feisbuc” is how you would phonetically write “facebook” in romanian.

I made wireshark display only the DNS data and I exported it as JSON (Because I suck at using wireshark for this).
Then I used jq to filter the data and get the domains that were queried.

jq '.[] | ._source.layers.dns.Queries | .[] | ."dns.qry.name"' dns_data.json | grep feisbuc

If I only look at the “*.feisbuc.com” domains it looks like some data is being exfiltrated here.
So I try to put all those strings together and use CyberChef to decode them.

Interestingly enough … this fails.
I clearly have the correct data, but something isn’t working correctly here.

At first I thought that I have to put them in a different order but that did not help.
After a bit of experimentation, I found out that every line is individually encoded with base64.
So I made a python script to decode them and print the final message.

import base64

encoded = [
    "SGVsbG8geW8",
    "dW5nIGV4cGw",
    "b3JlciwgeW8",
    "dSBoYXZlIGY",
    "b3VuZCB0aGU",
    "IHNlY3JldCA",
    "bWVzc2FnZSE",
    "IEJEQ1RGe2Q",
    "TjVfMTVfaDQ",
    "UmRfNzBfRDM",
    "NzNDN30gQ28",
    "bmdyYXR1bGE",
    "dGlvbnMh"
]

result = []

for line in encoded:
    decoded = base64.b64decode(line + '==')
    result.append(decoded.decode('utf-8'))

print(''.join(result))

And with this, challenge solved.