Ghost in the Wire One byte per ICMP echo

forensics
flag hiCTF{1cmp_3xf1l_d3t3ct3d}

Category: network forensics · Artifact: extracted/ghost_traffic.pcap (30 packets)

Hint

"…anomalous ICMP traffic … Something is being exfiltrated through the wire…"

Solve

Follow the ICMP echo-request payloads. Packets 3-28 come from 10.13.37.1 and each carries one byte of exfiltrated data in its payload; the other ICMP traffic (192.168.1.100, which even pings server1 with 70696e672066726f6d2073657276657231 = "ping from server1") is noise.

bash 
1tshark -r ghost_traffic.pcap -Y 'icmp.type==8' -T fields -e frame.number -e ip.src -e data.data
2# frame 3 -> 68, 4 -> 69, 5 -> 43, 6 -> 54, 7 -> 46, 8 -> 7b, 9 -> 31, ...
3python3 - <<'EOF'
4import subprocess
5out = subprocess.check_output(["tshark","-r","ghost_traffic.pcap","-Y",
6        "icmp.type==8 && ip.src==10.13.37.1","-T","fields","-e","data.data"], text=True)
7print(bytes.fromhex("".join(out.split())).decode())
8EOF

Output: hiCTF{1cmp_3xf1l_d3t3ct3d} (the leading 1 is a leet "i" - the payload bytes really are 31 63 6d 70 = "1cmp").

Flag

output 
hiCTF{1cmp_3xf1l_d3t3ct3d}