Синий иней (Blue Frost)

Platform: duckerz | Category: Forensics | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2026-01-09 | Status: Solved Techniques: NA

Summary

Task: Analyze Bluetooth pcapng dump with audio streaming interference. Solution: Extract hidden data from OBEX file transfer packets among L2CAP audio traffic, decode BOM-separated numbers and XOR decrypt to reveal flag.

Синий иней (Blue Frost) — duckerz CTF

Metadata

Description

"Я заметил, что музыка передаётся с помехами по наушникам. Выясни в чём дело."

Files: blue_frost.pcapng

Analysis

Initial Inspection

The task name "Синий иней" (Blue Frost) contains a hint — "синий" (blue) hints at Bluetooth. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Protocol analysis in the dump:

 bash read-only • copy allowed Copy
tshark -r blue_frost.pcapng -T fields -e frame.protocols | sort | uniq -c

Discovered protocols:

• HCI — Host Controller Interface (Bluetooth)
• L2CAP — Logical Link Control and Adaptation Protocol (audio streaming)
• OBEX — Object Exchange (file transfer)
• SDP — Service Discovery Protocol

Searching for Hidden Data

The main traffic is L2CAP for audio transmission. However, OBEX packets were found among it, indicating file transfer.

 bash read-only • copy allowed Copy
tshark -r blue_frost.pcapng -Y "obex" -T fields -e frame.number -e obex.opcode

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Found 8 OBEX packets, including a PUT operation (frame 2617).

Data Extraction

Viewing the OBEX PUT packet contents:

 bash read-only • copy allowed Copy
tshark -r blue_frost.pcapng -Y "obex.opcode == 0x02" -x

In the packet body (232 bytes), data was found starting at offset 0x24:

39 30 ef bb bf 37 35 ef bb bf 39 33 ef bb bf 38 35...

Data structure:

• ASCII codes of numbers (e.g., 39 30 = "90")
• Separator: UTF-8 BOM marker (\xef\xbb\xbf)

Parsing Numbers

Extracted numbers after removing BOM separators:

 python read-only • copy allowed Copy
numbers = [90, 75, 93, 85, 91, 76, 68, 101, 124, 114, 107, 45, 
           106, 46, 46, 106, 42, 65, 47, 43, 65, 42, 114, 109, 
           46, 65, 127, 112, 65, 113, 110, 44, 119, 46, 112, 99]

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Solution

The numbers clearly represent encrypted ASCII codes. Given the expected flag format DUCKERZ{, we try XOR:

 python read-only • copy allowed Copy
#!/usr/bin/env python3
"""
Синий иней (Blue Frost) — duckerz CTF
Forensics / Easy / 200 pts

Extracting flag from OBEX traffic in Bluetooth dump
"""

numbers = [
    90, 75, 93, 85, 91, 76, 68, 101, 124, 114, 107, 45,
    106, 46, 46, 106, 42, 65, 47, 43, 65, 42, 114, 109,
    46, 65, 127, 112, 65, 113, 110, 44, 119, 46, 112, 99
]

# Finding XOR key
# D = 68, first number = 90
# 90 XOR key = 68 => key = 90 XOR 68 = 30
key = 30
‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

flag = ''.join(chr(n ^ key) for n in numbers)
print(flag)

Tools

• tshark — pcapng analysis
• Python — XOR decryption
• xxd — hex analysis

Tags

bluetooth obex pcap xor forensics traffic-analysis ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍