Follow the Sequence (net)

Intro My solution of a Network challenge Follow the Sequence on the CTF site 247CTF.com. Instructions We are trying to improve resource utilisation by spreading data across several subflows. We needed to install a new kernel module, but the speed upgrade is worth it! Can you combine requests and recover the flag? Exploit # 1. Pull raw MPTCP data sequence numbers and payloads from each capture for f in chall-i1.pcap chall-i2.pcap chall-i3.pcap; do tshark -r "$f" -Y 'tcp.len > 0 && mptcp.dss.dsn' \ -o mptcp.relative_sequence_numbers:FALSE \ -T fields -e mptcp.dss.dsn -e tcp.payload done > segments.txt # 2. Sort by sequence number, drop duplicates, turn hex back into bytes sort -n -u -k1,1 segments.txt | cut -f2 | xxd -r -p > stream.bin # 3. Check the start (should be "HTTP/1.1 200 OK") head -c 300 stream.bin # 4. Strip the HTTP header and unzip off=$(grep -obUaP '\r\n\r\n' stream.bin | head -1 | cut -d: -f1) tail -c +$((off + 5)) stream.bin > out.zip unzip out.zip -d out # 5. List files…

Commenting on Bubbles has been removed. Why? If you want to talk about this post, write to the author, use the comments on their blog if it has them, or reply with a "RE:" post on your own blog. Suggestions? feedback@bubbles.town