Сверхсекретный Шпион

Platform: duckerz | Category: Forensics | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-01-09 | Status: Solved Techniques: byte_manipulation, packet_ordering, port_steganography

Summary

Task: Analyze pcap with suspicious UDP traffic to find hidden spy data. Solution: Port-based steganography — data encoded in destination port low bytes, sequence in source ports, decode with formula 256 - (dst_port & 0xFF).

Сверхсекретный Шпион — duckerz CTF

Description

Как же мы упустили данный трафик?! Мы точно уверены, данные шпиона переданны в нём, но где они их спрятали. Ваша задача выяснить, что передал шпион!

File: DeepIpSpy.pcap

Analysis

Initial Inspection

 bash read-only • copy allowed Copy
file DeepIpSpy.pcap
# pcap capture file, microsecond ts (little-endian) - version 2.4 (Raw IPv4, capture length 65535)

tshark -r DeepIpSpy.pcap

Found 32 UDP packets from 192.168.1.1 to 192.168.1.2 with zero payload (Len=0).

Pattern Discovery

Interesting patterns in port numbers:

• Source ports: 30000-30031 (sequence numbers in format 300XX)
• Destination ports: various values around 32600-32720 ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Example packets:

Seq 0:  src=30000, dst=32700
Seq 1:  src=30001, dst=32683
Seq 2:  src=30002, dst=32701
...

Hypothesis

The task name "DeepIpSpy" hints at data hidden in IP/UDP headers. This is a classic covert channel — a hidden data transmission channel through protocol metadata.

Finding the Decoding Formula

Attempted approaches:

• dst - 32600 → garbage
• low_byte XOR 0xFF → encoded string
• XOR with various keys → partial results

Working formula: char = 256 - (dst_port & 0xFF) ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Solution

 python read-only • copy allowed Copy
#!/usr/bin/env python3
"""
Сверхсекретный Шпион — duckerz CTF
Port-based steganography decoder

Data is hidden in the low byte of destination port:
- Source port 300XX determines character order (XX = sequence)
- Destination port contains encoded character: 256 - low_byte = ASCII
"""

import subprocess

def decode_port_stego(pcap_file):
    # Extract ports from pcap
    result = subprocess.run(
        ['tshark', '-r', pcap_file, '-T', 'fields', 
         '-e', 'udp.srcport', '-e', 'udp.dstport'],
        capture_output=True, text=True
    )
    
    packets = []
    for line in result.stdout.strip().split('\n'):
        src, dst = line.split('\t')
        seq = int(src) - 30000  # Extract sequence number
        packets.append((seq, int(dst)))
    
    # Sort by sequence number
    packets.sort()
    
    # Decode: 256 - low byte of destination port
    chars = [256 - (dst & 0xFF) for seq, dst in packets]
    flag = ''.join(chr(c) for c in chars)
    
    return flag
‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

if __name__ == "__main__":
    flag = decode_port_stego("DeepIpSpy.pcap")
    print(f"Flag: {flag}")

Decoding Verification

Seq 0: dst=32700, low=0xbc=188, 256-188=68='D'
Seq 1: dst=32683, low=0xab=171, 256-171=85='U'
Seq 2: dst=32701, low=0xbd=189, 256-189=67='C'
Seq 3: dst=32693, low=0xb5=181, 256-181=75='K'
Seq 4: dst=32699, low=0xbb=187, 256-187=69='E'
Seq 5: dst=32686, low=0xae=174, 256-174=82='R'
Seq 6: dst=32678, low=0xa6=166, 256-166=90='Z'
Seq 7: dst=32645, low=0x85=133, 256-133=123='{'
...

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Theory: Port-based Steganography

How It Works

Data is transmitted not in the packet payload, but in header fields:

• Source port: character sequence number
• Destination port: encoded character

Advantages for Attacker

• Traffic looks like normal UDP packets
• No suspicious payload
• Hard to detect without deep analysis

Detection Methods

• Port distribution analysis
• Pattern search in sequences
• Zero-payload packets — red flag

Alternative Hiding Places in IP/UDP