Title : [writeups] Internetwache CTF 2016 - 404 Flag not found #misc80
Released : 2016-02-22 09:52:58 -0500
Viewed : 775


Description: I tried to download the flag, but somehow received only 404 errors :( Hint: The last step is to look for flag pattern.

Attachment: misc80.zip

Download file misc80.zip, extract, and i got flag pcap file. Open with Wireshark.

In the first line i saw this

496e2074686520656e642c206974277320616c6c2061626f757420666c61.2015.ctf.internetwache.org: type A, class IN

and the subdomain looks like a hexa. Then i decode it and got

In the end, it's all about fla

Euhm, an incomplete words. Maybe the next words is in the next packets.

67732e0a5768657468657220796f752077696e206f72206c6f736520646f decoded and get

Whether you win or lose do

Combine with the first packet.

In the end, it's all about flags.
Whether you win or lose do

Now, i just grab all unique subdomains, decode them and got this paragraph

In the end, it's all about flags.
Whether you win or lose doesn't matter.
{Ofc, winning is cooler
Did you find other flags?
Noboby finds other flags!
Superman is my hero.
_HERO!!!_Help me my friend, I'm lost in my own mind.
Always, always, for ever alone.
Crying until I'm dying.
Kings never die.
So do I.

every first char looks like a flag format.

Submit. and Success. :)