ctf.nitaimaarek.com Tracks Leaderboard Log in Sign up

Tracks / Traffic Analysis / Name Dropper

Name Dropper

Easy 15 pts

A workstation that is supposedly idle. No TCP sessions the firewall would have caught — all it does is look up names. It is still exfiltrating data, one query at a time. Reassemble what left the building.

Hints

Open them in order. They nudge, they do not solve.

Hint 1

Filter dns and read the query names. Most are ordinary; a handful share a suffix that is not.

Hint 2

Those queries are numbered in their first label, and the second half of each label is hexadecimal.

Hint 3

Concatenate the hex in index order and decode as ASCII. dns.qry.name contains "exfil" isolates them.

The capture

Forged on this server. Open it in Wireshark, or run tshark -r resolve.pcap.

Download resolve.pcap

Submit the flag

You can solve it now, but to save the solve you need an account. Sign up or log in — it takes ten seconds.