> For the complete documentation index, see [llms.txt](https://simon-6.gitbook.io/simoncyber/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://simon-6.gitbook.io/simoncyber/ctf-writeups/picoctf-2025/forensics/ph4nt0m-1ntrud3r-easy.md). # Ph4nt0m 1ntrud3r (Easy) This one is a straightforward Wireshark PCAP challenge.
*** Even though I've had use Wireshark plenty of times, I feel like I never actually studied the filtering commands. So let's take a break and go through a quick Wireshark lesson! ``` Protocol Filters http - HTTP traffic dns - DNS queries/responses ftp - FTP traffic smtp - Email traffic tcp - TCP packets udp - UDP packets icmp - ICMP/ping traffic HTTP http.request.method == "POST" - POST requests (often contain credentials) http.request.uri contains "flag" - URLs containing "flag" http.cookie - Packets with cookies http contains "password" - HTTP data containing "password" or replace it with anything else Filter by IP/Port ip.addr == 192.168.1.1 - Traffic to/from specific IP tcp.port == 80 - Traffic on port 80 ip.src == 10.0.0.1 && ip.dst == 10.0.0.2 - Specific source and destination File Transfers ftp-data - FTP file transfers http.content_type contains "image" - Image downloads tcp.len > 1000 - Large packets (potential file transfers) tcp.payload filters for TCP packets that contain actual data in the payload section (excludes empty packets like ACKs, SYNs, FINs). ``` There's a bit more regarding tcp stream and statistics but that should be the majority of it.
The hints give some vague comments about time. I'm too sure about how time plays but let's see. I noticed one thing of each packet was that there was a bit of encoded text in the TCP data.
Obviously I'm not going to check every single one, so let's do a bit of more filtering.
I sorted the time in ascending order, and only filtered entires that contained the base64 code. If you decode these in the order presented you finally get the flag. *** ### Tshark Although it wasn't necessary, let's learn a bit about Tshark. It's an alternative to Wireshark when manually shifting through the entries doesn't work. I saw writeups for this challenge that used this. {% embed url="" %} > **TShark** is a network protocol analyzer. It lets you capture packet data from a live network, or read packets from a previously saved capture file, either printing a decoded form of those packets to the standard output or writing the packets to a file. **TShark**'s native capture file format is **pcapng** format, which is also the format used by **Wireshark** and various other tools. ``` Useful Flags -r - Read from file -Y - Display filter -x - Show hex dump -V - Verbose (all packet details) -q - Quiet mode (for statistics) -n - Don't resolve hostnames -t ad - Absolute date/time format -e - Flag, which field to extract from field -T <> - Output as... -T text - Default text output -T json - JSON format (great for parsing) -T ek - Elasticsearch JSON -T fields - Custom field extraction, used alongside with -e tshark -r file.pcap -Y "http.request" - HTTP requests only tshark -r file.pcap -Y "http.request" - HTTP requests only tshark -r file.pcap -Y 'tcp.payload contains "password"' -x ``` If you wanted to use just tshark to solve this challenge, another writeup (40days) showed how in just one command: ``` tshark -r myNetworkTraffic.pcap -Y "tcp.len==12 || tcp.len==4" -T fields -e frame.time -e tcp.segment_data | sort -k4 | awk '{print $6}' | xxd -p -r | base64 -d ``` 1. It first reads the pcap file with -r 2. Utilizes the -Y flag to filter, only allows frames that are 12 or 4 bytes 3. Output as a custom field, chooses the time of the tcp segment (or the payload) 1. Output looks like: `Jan 15, 2025 14:30:22.123456000 PST 48656c6c6f` 4. `-k4` means "use the 4th whitespace-separated field as the sort key" I'm not sure what the person does with the -k or awk, but it's likely just isolating and separating.