Follow the Sequence (net)
Intro
My solution of a Network challenge Follow the Sequence on the CTF site 247CTF.com.
Instructions
We are trying to improve resource utilisation by spreading data across several subflows. We needed to install a new kernel module, but the speed upgrade is worth it! Can you combine requests and recover the flag?
Exploit
# 1. Pull raw MPTCP data sequence numbers and payloads from each capture
for f in chall-i1.pcap chall-i2.pcap chall-i3.pcap; do
tshark -r "$f" -Y 'tcp.len > 0 && mptcp.dss.dsn' \
-o mptcp.relative_sequence_numbers:FALSE \
-T fields -e mptcp.dss.dsn -e tcp.payload
done > segments.txt
# 2. Sort by sequence number, drop duplicates, turn hex back into bytes
sort -n -u -k1,1 segments.txt | cut -f2 | xxd -r -p > stream.bin
# 3. Check the start (should be "HTTP/1.1 200 OK")
head -c 300 stream.bin
# 4. Strip the HTTP header and unzip
off=$(grep -obUaP '\r\n\r\n' stream.bin | head -1 | cut -d: -f1)
tail -c +$((off + 5)) stream.bin > out.zip
unzip out.zip -d out
# 5. List files by size; the flag is the caption on flag/Here.jpg (open the image)
ls -lS out/flag/