Мим

Platform: duckerz | Category: Forensics | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-01-09 | Status: Solved Techniques: http_object_extraction, pcap_analysis, traffic_inspection

Summary

Task: MITM attack pcap file with captured traffic. Solution: Extract HTTP objects using tshark, find image file containing the flag as visible text.

Мим — duckerz CTF

Description

"Я провёл атаку mitm на кого-то, помоги найти важные файлы."

Files: mim.pcapng — network traffic dump

Analysis

The task name "Мим" (Mim) is a reference to MITM (Man-in-the-Middle) attack. We are given a pcap file with captured traffic.

Step 1: Protocol Analysis

 bash read-only • copy allowed Copy
tshark -r mim.pcapng -q -z io,phs

Discovered protocols:

• HTTP — unencrypted web traffic (main interest)
• TLS — encrypted traffic
• XMPP — messaging protocol

Step 2: Investigating HTTP Requests

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

 bash read-only • copy allowed Copy
tshark -r mim.pcapng -Y "http.request" -T fields -e frame.number -e http.request.method -e http.host -e http.request.uri

Found an interesting request:

GET s3.bucket.serv /barabulka.jpg

Someone was downloading an image from an S3-like storage.

Step 3: Extracting HTTP Objects

 bash read-only • copy allowed Copy
tshark -r mim.pcapng --export-objects "http,./extracted"

Extracted files:

Step 4: Image Analysis

 bash read-only • copy allowed Copy
file extracted/barabulka.jpg
# JPEG image data, JFIF standard 1.01, baseline, precision 8, 939x79

exiftool extracted/barabulka.jpg
# Image Width: 939
# Image Height: 79

The size 939x79 is a wide banner. Opening the image reveals the flag as text on the picture.

Solution

 bash read-only • copy allowed Copy
#!/bin/bash
# Complete solution for Mim task

# 1. Download pcap
wget https://download.tasks.duckerz.ru/Mim/mim.pcapng

# 2. View HTTP requests
tshark -r mim.pcapng -Y "http.request" -T fields \
    -e http.host -e http.request.uri
‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

# 3. Extract all HTTP objects
mkdir -p extracted
tshark -r mim.pcapng --export-objects "http,./extracted"

# 4. Find the image
ls -la extracted/
file extracted/*.jpg

# 5. Open the image and read the flag
open extracted/barabulka.jpg  # macOS
# or: xdg-open extracted/barabulka.jpg  # Linux

Useful tshark Commands

 bash read-only • copy allowed Copy
# Protocol statistics
tshark -r file.pcapng -q -z io,phs

# List HTTP requests
tshark -r file.pcapng -Y "http.request" -T fields \
    -e frame.number -e http.request.method -e http.host -e http.request.uri
‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

# Extract HTTP objects
tshark -r file.pcapng --export-objects "http,./output_dir"

# Extract SMB objects
tshark -r file.pcapng --export-objects "smb,./output_dir"

# Extract FTP objects
tshark -r file.pcapng --export-objects "ftp-data,./output_dir"

# Filter by host
tshark -r file.pcapng -Y "http.host contains 'example'"

Notes

• barabulka (барабулька) is a fish, possibly a reference to "fishing" (phishing)
• Files we2 and we2(1) are side data, do not contain the flag
• MITM attack allows intercepting unencrypted HTTP traffic ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍