Recon101

Author: 0xIDA
Platform: FlagYard · Category: forensics · Difficulty: Hard

Solvers

solve.py

Summary

PCAP of a LAN with ZeroTier noise plus two external TCP sources. The real recon is a 1 Hz SYN-retransmit sweep of port 1433 (MSSQL) from 134.119.216.167 across 32 hosts. Each contiguous retransmit burst length equals ord(character); hosts scanned twice contribute two characters in time order. Decoding all bursts yields the flag.

Challenge

According to MITRE ATT&CK framework, the first tactic is reconnaissance. ... identify the first active interactions resulted from the attacker to the network.

Files: Recon101.pcapng (~23k packets).

Analysis

Noise vs signal

Dominant traffic: ZeroTier (UDP/9993) to/from 192.168.1.108, UPnP to gateway 192.168.1.1.
External public IP via UPnP: 100.119.107.30.
TCP SYN from 12.1.194.138:4444 → 192.168.1.110:784 (260 identical packets every 5s, payload 86468d5975059c) — fixed template, not the multi-host recon.
Real active scan: 134.119.216.167 → 32× 192.168.1.0/24 hosts, port 1433 only, window 1480, pure SYN, ~1 packet/sec retransmits.

Covert channel

For each destination, group SYNs into contiguous bursts (inter-arrival ≤ ~1.5s). Burst length n encodes ASCII character chr(n).

Some hosts receive a second burst later (second pass). Chronological order of all bursts:

start (relative logic)	host	burst len	char
first	.169	70	F
	.170	108	l
	.158	97	a
	.124	103	g
	.112	89	Y
	.122	123	{
	.142	54	6
	.155	52	4
	.197	100	d
	.193	102	f
	.168	49	1
	.135	100	d
	.193 (2nd)	102	f
	.111	57	9
	…	…	…
last	.120	125	}

Full decode:

FlagY{64df1df92856eecc702aa152a4a7be0}

Methodology / tools

tshark -r Recon101.pcapng -q -z endpoints,ip
tshark -r Recon101.pcapng -Y "ip.src==134.119.216.167" -T fields -e ip.dst -e tcp.dstport
# Python + scapy: group SYNs per dst, split bursts on gap>1.5s, map len→chr, sort by burst start time

Flag

FlagY{64df1df92856eecc702aa152a4a7be0}

Live submit: success.