{"id":131,"date":"2020-05-05T13:56:55","date_gmt":"2020-05-05T11:56:55","guid":{"rendered":"https:\/\/blog.caturday-lovers.fr.nf\/?p=131"},"modified":"2020-05-05T20:54:01","modified_gmt":"2020-05-05T18:54:01","slug":"les-chatons-ont-la-reponse-fcsc-2020-cap-ou-pcap","status":"publish","type":"post","link":"https:\/\/blog.caturday-lovers.fr.nf\/?p=131","title":{"rendered":"Les chatons ont la r\u00e9ponse \u2013 FCSC 2020 \/\/ Cap ou Pcap"},"content":{"rendered":"\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"499\" height=\"772\" src=\"https:\/\/blog.caturday-lovers.fr.nf\/wp-content\/uploads\/2020\/05\/2020-05-05_12h47_05.png\" alt=\"\" class=\"wp-image-133\" srcset=\"https:\/\/blog.caturday-lovers.fr.nf\/wp-content\/uploads\/2020\/05\/2020-05-05_12h47_05.png 499w, https:\/\/blog.caturday-lovers.fr.nf\/wp-content\/uploads\/2020\/05\/2020-05-05_12h47_05-194x300.png 194w\" sizes=\"auto, (max-width: 499px) 100vw, 499px\" \/><\/figure><\/div>\n\n\n\n<!--more-->\n\n\n\n<h2 class=\"wp-block-heading\">Wireshark, doo doo doo doo doo doo doo, \/\/musique<\/h2>\n\n\n\n<figure class=\"wp-block-embed-youtube wp-block-embed is-type-video is-provider-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio\"><div class=\"wp-block-embed__wrapper\">\n<iframe loading=\"lazy\" title=\"Baby Shark Dance | #babyshark Most Viewed Video | Animal Songs | PINKFONG Songs for Children\" width=\"500\" height=\"281\" src=\"https:\/\/www.youtube.com\/embed\/XqZsoesa55w?feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share\" referrerpolicy=\"strict-origin-when-cross-origin\" allowfullscreen><\/iframe>\n<\/div><figcaption>pas de raison que je sois le seul \u00e0 souffrir !<\/figcaption><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Intro<\/h2>\n\n\n\n<p>Un fichier de capture Wireshark, un fichier \u00e9chang\u00e9, votre mission agent Hunt si vous l&rsquo;acceptez est de retrouver le fichier top secret super important s\u00e9curit\u00e9 national DEFCON 1.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Explications<\/h2>\n\n\n\n<p>Nous allons devoir plonger dans les profondeurs abyssales de wireshark, ou pas. Vu le nombre de paquets ,cela ne devrait pas \u00eatre trop compliqu\u00e9 de trouver notre petit dedans.<br><br>Pour les n\u00e9ophytes, nous avons devant nous une capture de paquets, c&rsquo;est la base de la communication entre postes. Chaque protocole \u00e0 son type de paquet et ils sont identifiables via wireshark et sont plus ou moins analysables (coucou le protocol TLS\/SSL).<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Allons p\u00eacher Moby dick<\/h2>\n\n\n\n<p>Un petit click droit sur le premier paquet, suivre, puis flux TCP nous donne les informations  dont nous avons besoin. Nous savons que nous allons devoir reconstruire\/retrouver un fichier nomm\u00e9 flag.zip, qu&rsquo;il a \u00e9t\u00e9 exfiltr\u00e9 du poste via une commande netcat vers le poste 172.20.20.133:20200 au format hexadecimal sans saut de ligne.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"831\" src=\"https:\/\/blog.caturday-lovers.fr.nf\/wp-content\/uploads\/2020\/05\/2020-05-05_13h04_23-1-1024x831.png\" alt=\"\" class=\"wp-image-138\" srcset=\"https:\/\/blog.caturday-lovers.fr.nf\/wp-content\/uploads\/2020\/05\/2020-05-05_13h04_23-1-1024x831.png 1024w, https:\/\/blog.caturday-lovers.fr.nf\/wp-content\/uploads\/2020\/05\/2020-05-05_13h04_23-1-300x243.png 300w, https:\/\/blog.caturday-lovers.fr.nf\/wp-content\/uploads\/2020\/05\/2020-05-05_13h04_23-1-768x623.png 768w, https:\/\/blog.caturday-lovers.fr.nf\/wp-content\/uploads\/2020\/05\/2020-05-05_13h04_23-1.png 1282w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n\n<h2 class=\"wp-block-heading\">Flexions, extractions<\/h2>\n\n\n\n<p>Comme nous avons trouv\u00e9 quoi, comment et vers qui, nous allons devoir trouver le paquet qui contient le flux. La trace \u00e9tant tr\u00e8s petite, nous pouvons utiliser notre bon sens, et nous allons filtrer sur la taille des paquets, en esp\u00e9rant trouver une \u00ab\u00a0anomalie\u00a0\u00bb compar\u00e9e aux autres.<br><br>Deux paquets se tirent la bourre en t\u00eate, le 27\u00e8me et le 12\u00e8me, commen\u00e7ons par le plus lourd :<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>0000   35 30 34 62 30 33 30 34 31 34 30 30 30 30 30 30   504b030414000000\n0010   30 38 30 30 61 32 33 31 38 32 35 30 36 35 32 33   0800a23182506523\n0020   35 63 33 39 34 32 30 30 30 30 30 30 34 37 30 30   5c39420000004700\n0030   30 30 30 30 30 38 30 30 31 63 30 30 36 36 36 63   000008001c00666c\n0040   36 31 36 37 32 65 37 34 37 38 37 34 35 35 35 34   61672e7478745554\n0050   30 39 30 30 30 33 62 66 63 38 38 35 35 65 62 66   090003bfc8855ebf\n0060   63 38 38 35 35 65 37 35 37 38 30 62 30 30 30 31   c8855e75780b0001\n0070   30 34 65 38 30 33 30 30 30 30 30 34 65 38 30 33   04e803000004e803\n0080   30 30 30 30 30 64 63 39 63 31 31 31 38 30 33 30   00000dc9c1118030\n0090   30 38 30 34 63 30 62 66 64 35 38 34 30 34 30 38   0804c0bfd5840408\n00a0   62 63 33 33 36 33 30 33 35 36 65 30 30 35 36 38   bc33630356e00568\n00b0   63 32 62 31 37 37 64 64 65 66 39 65 65 62 35 61   c2b177ddef9eeb5a\n00c0   38 66 65 36 65 65 30 36 63 65 38 65 35 36 38 34   8fe6ee06ce8e5684\n00d0   66 30 38 34 35 39 39 37 31 39 32 61 61 64 34 34   f0845997192aad44\n00e0   65 63 61 65 64 63 37 66 38 65 31 61 63 63 34 65   ecaedc7f8e1acc4e\n00f0   33 65 63 31 61 38 65 64 61 31 36 34 64 34 38 63   3ec1a8eda164d48c\n0100   32 38 63 37 37 62 37 63 35 30 34 62 30 31 30 32   28c77b7c504b0102\n0110   31 65 30 33 31 34 30 30 30 30 30 30 30 38 30 30   1e03140000000800\n0120   61 32 33 31 38 32 35 30 36 35 32 33 35 63 33 39   a231825065235c39\n0130   34 32 30 30 30 30 30 30 34 37 30 30 30 30 30 30   4200000047000000\n0140   30 38 30 30 31 38 30 30 30 30 30 30 30 30 30 30   0800180000000000\n0150   30 31 30 30 30 30 30 30 61 34 38 31 30 30 30 30   01000000a4810000\n0160   30 30 30 30 36 36 36 63 36 31 36 37 32 65 37 34   0000666c61672e74\n0170   37 38 37 34 35 35 35 34 30 35 30 30 30 33 62 66   78745554050003bf\n0180   63 38 38 35 35 65 37 35 37 38 30 62 30 30 30 31   c8855e75780b0001\n0190   30 34 65 38 30 33 30 30 30 30 30 34 65 38 30 33   04e803000004e803\n01a0   30 30 30 30 35 30 34 62 30 35 30 36 30 30 30 30   0000504b05060000\n01b0   30 30 30 30 30 31 30 30 30 31 30 30 34 65 30 30   0000010001004e00\n01c0   30 30 30 30 38 34 30 30 30 30 30 30 30 30 30 30   0000840000000000\n<\/code><\/pre>\n\n\n\n<p>Hummm, j&rsquo;ai envie de dire, pas d\u00e9connant avec ce que l&rsquo;on recherche, nous voulons de l&rsquo;hexad\u00e9cimal, et ici la colonne de droite en est remplie. En plus nous avons les <a rel=\"noreferrer noopener\" href=\"https:\/\/en.wikipedia.org\/wiki\/List_of_file_signatures\" target=\"_blank\">magic Bytes<\/a> d&rsquo;un fichier zip au d\u00e9but, la cha\u00eene suivante :<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">50 4B 03 04<\/pre>\n\n\n\n<p>Nous sommes d\u00e9sormais s\u00fbrs d&rsquo;\u00eatre au bon endroit, et allons donc pouvoir reconstruire le zip.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">M\u00e9thode 1 : CyberChef<\/h2>\n\n\n\n<p>J&rsquo;ai d\u00e9couvert cet outil lors du challenge FCSC, et franchement, il est super puissant, surtout dans un cas comme celui-ci. Vous entrez le stream hexdump  dans la zone input, et comme par magie, il assemble la recette et vous donne la sortie du fichier zip!<br>\u00c0 ce stade, nous avons notre flag :<br><\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">FCSC{6ec28b4e2b0f1bd9eb88257d650f558afec4e23f3449197b4bfc9d61810811e3}<\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"502\" src=\"https:\/\/blog.caturday-lovers.fr.nf\/wp-content\/uploads\/2020\/05\/2020-05-05_13h36_58-1024x502.png\" alt=\"\" class=\"wp-image-139\" srcset=\"https:\/\/blog.caturday-lovers.fr.nf\/wp-content\/uploads\/2020\/05\/2020-05-05_13h36_58-1024x502.png 1024w, https:\/\/blog.caturday-lovers.fr.nf\/wp-content\/uploads\/2020\/05\/2020-05-05_13h36_58-300x147.png 300w, https:\/\/blog.caturday-lovers.fr.nf\/wp-content\/uploads\/2020\/05\/2020-05-05_13h36_58-768x376.png 768w, https:\/\/blog.caturday-lovers.fr.nf\/wp-content\/uploads\/2020\/05\/2020-05-05_13h36_58-1536x753.png 1536w, https:\/\/blog.caturday-lovers.fr.nf\/wp-content\/uploads\/2020\/05\/2020-05-05_13h36_58.png 1920w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption>un peu trop facile, j&rsquo;aime quand c&rsquo;est un peu moins trop facile !<\/figcaption><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">M\u00e9thode 2 : celle des semi-barbus<\/h2>\n\n\n\n<p>Car un vrai barbu aurait tout fait en ligne de commande, nous allons utiliser un autre outil en ligne que j&rsquo;appr\u00e9cie, <a rel=\"noreferrer noopener\" href=\"https:\/\/hexed.it\/\" target=\"_blank\">Hexed.it<\/a>. <br>Copions notre flux Hexdump comme mis dans la capture d&rsquo;\u00e9cran :<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"502\" src=\"https:\/\/blog.caturday-lovers.fr.nf\/wp-content\/uploads\/2020\/05\/2020-05-05_13h42_35-1024x502.png\" alt=\"\" class=\"wp-image-140\" srcset=\"https:\/\/blog.caturday-lovers.fr.nf\/wp-content\/uploads\/2020\/05\/2020-05-05_13h42_35-1024x502.png 1024w, https:\/\/blog.caturday-lovers.fr.nf\/wp-content\/uploads\/2020\/05\/2020-05-05_13h42_35-300x147.png 300w, https:\/\/blog.caturday-lovers.fr.nf\/wp-content\/uploads\/2020\/05\/2020-05-05_13h42_35-768x376.png 768w, https:\/\/blog.caturday-lovers.fr.nf\/wp-content\/uploads\/2020\/05\/2020-05-05_13h42_35-1536x753.png 1536w, https:\/\/blog.caturday-lovers.fr.nf\/wp-content\/uploads\/2020\/05\/2020-05-05_13h42_35.png 1920w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption>ins\u00e9rez les donn\u00e9es<\/figcaption><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"502\" src=\"https:\/\/blog.caturday-lovers.fr.nf\/wp-content\/uploads\/2020\/05\/2020-05-05_13h42_41-1024x502.png\" alt=\"\" class=\"wp-image-141\" srcset=\"https:\/\/blog.caturday-lovers.fr.nf\/wp-content\/uploads\/2020\/05\/2020-05-05_13h42_41-1024x502.png 1024w, https:\/\/blog.caturday-lovers.fr.nf\/wp-content\/uploads\/2020\/05\/2020-05-05_13h42_41-300x147.png 300w, https:\/\/blog.caturday-lovers.fr.nf\/wp-content\/uploads\/2020\/05\/2020-05-05_13h42_41-768x376.png 768w, https:\/\/blog.caturday-lovers.fr.nf\/wp-content\/uploads\/2020\/05\/2020-05-05_13h42_41-1536x753.png 1536w, https:\/\/blog.caturday-lovers.fr.nf\/wp-content\/uploads\/2020\/05\/2020-05-05_13h42_41.png 1920w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption>Et voil\u00e0 !!!<\/figcaption><\/figure>\n\n\n\n<p> Il ne nous reste plus qu&rsquo;\u00e0 exporter notre zip reconstruit, d\u00e9ziper et de profiter de notre flag durement gagn\u00e9.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1010\" height=\"186\" src=\"https:\/\/blog.caturday-lovers.fr.nf\/wp-content\/uploads\/2020\/05\/image.png\" alt=\"\" class=\"wp-image-142\" srcset=\"https:\/\/blog.caturday-lovers.fr.nf\/wp-content\/uploads\/2020\/05\/image.png 1010w, https:\/\/blog.caturday-lovers.fr.nf\/wp-content\/uploads\/2020\/05\/image-300x55.png 300w, https:\/\/blog.caturday-lovers.fr.nf\/wp-content\/uploads\/2020\/05\/image-768x141.png 768w\" sizes=\"auto, (max-width: 1010px) 100vw, 1010px\" \/><\/figure>\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":1,"featured_media":13,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[19],"tags":[83,60,89,61,88,85,86,87,84],"class_list":["post-131","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-kitensgotanswer","tag-cap-ou-pcap","tag-ctf","tag-cyberchef","tag-fcsc","tag-hexdump","tag-packets","tag-paquets","tag-tcp","tag-wireshark"],"_links":{"self":[{"href":"https:\/\/blog.caturday-lovers.fr.nf\/index.php?rest_route=\/wp\/v2\/posts\/131","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.caturday-lovers.fr.nf\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.caturday-lovers.fr.nf\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.caturday-lovers.fr.nf\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.caturday-lovers.fr.nf\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=131"}],"version-history":[{"count":2,"href":"https:\/\/blog.caturday-lovers.fr.nf\/index.php?rest_route=\/wp\/v2\/posts\/131\/revisions"}],"predecessor-version":[{"id":163,"href":"https:\/\/blog.caturday-lovers.fr.nf\/index.php?rest_route=\/wp\/v2\/posts\/131\/revisions\/163"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.caturday-lovers.fr.nf\/index.php?rest_route=\/wp\/v2\/media\/13"}],"wp:attachment":[{"href":"https:\/\/blog.caturday-lovers.fr.nf\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=131"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.caturday-lovers.fr.nf\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=131"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.caturday-lovers.fr.nf\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=131"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}