CovertByte

Level

hard

Type

Forensics

In the wild world of covert data transmission, people have discovered numerous ways to exfiltrate and send data using a variety of methods.

Open the PCAP file (wire.pcapng) in Wireshark or any packet analyzer; observe many DNS requests in a short time.
Notice many DNS queries have obfuscated subdomains under ransomcloud-xg48f7yx5a.com.

Extract subdomains from the PCAP using:

strings wire.pcapng | grep -oP '.+?(?=.ransomcloud-xg48f7yx5a\.com)' | tr -d ' ' > file.txt

...
1pqTWdOakFnTTJFZ09EWWdOR0lnWmpNZ01tUWdPVFlnWXpNZ056SWdPRE1nWlRF
Z05qVWdZbVFnWXpBZ01UZ2dPV1FnTlRZZ1lXRWdZalVnTnpjZ01XRWdNR01nTVR
BZ05qZ2dNRFVnTURjZ1l6QWdaRFFnTldNZ1ptWWdNREFnWm1NZ016WWdZV1lnWX
pNZ1ltWWdaamdnWWpRZ1pqZ2daVFVnTURJZ09UUWdObVVnTW1JZ01Ua2dPR0VnW
VdVZ01qVWdZbUVnWWpnZ1lqY2dZamtnTnpZZ1pUWWdNVGtnTnpNZ01UUWdOakFn
TmpVZ1lqUWdOallnTmpjZ01EVWdPREFnTUdRZ09EUWdOVFFnWVRRZ01EVWdaalV
nWldZZ01EZ2dZV01nTkRZZ056a2dOMkVnWkRBZ1lqRWdZVEVnWldVZ00ySWdabV
lnTURBZ09EVWdaR1lnWmpFZ056Y2daakFnTXpZZ05qWWdObVVnTWpVZ04yTWdaa
k1nTTJVZ1pUQWdZV01nWXpFZ09EWWdaRGdnTkRjZ09EZ2dNR0lnTVRrZ05qTWdZ
bUVnT1dVZ01qY2dabVlnWkRrPQ==

Extract printable strings, isolate subdomains before the main domain, remove spaces, and save to file.txt.

Upload file.txt to CyberChef

Decode the file contents twice with Base64 decoding.
Convert the decoded output from hex to binary.
Checking the results, we can see that there is a JFIF header, which may indicate the picture is corrupted due to incorrect magic bytes.
Save the binary output as a .jpg file; observe it appears corrupted.

Upload the corrupted JPEG file to Jens Duttke HexEd.it - Browser-based Online and Offline Hex Editing
I'm going to search on Google for the header bytes of a JPEG file: JPG Signature Format: Documentation & Recovery Example

Replace the first 16 bytes (JPEG header) with, This fixes the JPEG magic header.

FF D8 FF E0 00 10 4A 46 49 46 00 01 01 01 00 48

Save the changes and download the repaired JPEG.
Open the repaired JPEG image.
Read the displayed flag

Flag: CTF{Cr4ck_the_C0d3_And_5ee_The_Truth_B3hind_T1m3_4nD_Sp4c3_999}