Kapten Strang

Platform: undutmaning | Category: Forensics | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2026-03-21 | Status: Solved Techniques: binary_extraction_from_pcap, exif_metadata_analysis, password_recovery_from_traffic, tcp_stream_reconstruction

Summary

Task: PCAP file with captured submarine communication containing remote shell session. Solution: Reconstruct TCP stream to find RAR password in command, extract binary data, recover flag from PNG EXIF metadata.

Kapten Strang — Undutmaning

Description

Med andan i halsen kommer CASCADAs hydrofonexpert Sune Sonarsson, och hack i häl på honom radiooperatören Henrik Hertz, inspringande till Harriet. Sune har upptäckt vad han tror är en ubåt som närmar sig CASCADA och Henrik fyller upphetsat i att han har lyckas snappa upp kommunikation från den misstänkta ubåten. Han har sparat dataströmmen i en pcapfil, som han inte riktigt lyckats tolka.

Harriet frågar omedelbart om de tror att det är räddningen som kommer, men Sune har tydliga farhågor. Han tyckte sig känna igen ljudbilden tillhörande den ökände Kapten Sigvard "Sumpråttan" Strängs ubåt, USS Titan. Kaptenen är känd som bathypelagets förskräckelse och djupens gissel. Det är inte en räddingsexpedition!

Kan du hjälpa dem att analysera inspelningen och förhoppningsvis stilla deras oro? ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

English summary: CASCADA's hydrophone expert detected a submarine approaching, and the radio operator captured its communication in a PCAP file. The submarine is suspected to be the infamous Captain Strang's USS Titan. Goal is to analyze the captured network traffic and find what they're up to.

Analysis

Initial PCAP Analysis

The PCAP file (770KB) contains a single TCP conversation on port 8080 between 192.168.0.9 and 10.2.0.2, lasting 83 seconds with 57 packets.

 bash read-only • copy allowed Copy
tshark -r KaptenStrang.pcap -z conv,tcp

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

TCP Stream Reconstruction

Using tshark -z follow,tcp,ascii,0 reveals a command-line remote shell session:

1. ls ** - Lists files:

   • solitaire
   • FROM_HQ/PRIO_UPPDRAG_HK.txt
   • TO_HQ/OPTI_CAM_01_OCRSCAN_000001.png

2. cat FROM_HQ/PRIO_UPPDRAG_HK.txt - Reads a top-secret Swedish military order for USS Titan submarine (reconnaissance mission)

3. rar a -pqazxswedc123 exfil.rar TO_HQ FROM_HQ - Creates password-protected RAR archive

   • Password visible in command: qazxswedc123 ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

4. md5sum exfil.rar - Hash: 464e63529654bb705fd60841021abce5

5. download exfil.rar - Exfiltrates the archive (binary data follows)

The key vulnerability is that the attacker used the RAR password directly in the command line, which was captured in the network traffic.

Solution

Step 1: Extract RAR from TCP Stream

 python read-only • copy allowed Copy
#!/usr/bin/env python3
import subprocess
import hashlib

# Get raw TCP stream data
result = subprocess.run(
    ['tshark', '-r', 'KaptenStrang.pcap', '-z', 'follow,tcp,raw,0', '-q'],
    capture_output=True, text=True
)
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Parse the follow output - extract client data after "download" command
lines = result.stdout.split('\n')
client_data = b''
in_data = False

for line in lines:
    if line.strip().startswith('==='):
        continue
    # Client data lines start with tab (server) or no tab (client)
    # After download command, collect all subsequent client chunks
    if 'download' in line.lower():
        in_data = True
        continue
    if in_data and line and not line.startswith('\t'):
        try:
            client_data += bytes.fromhex(line.strip())
        except:
            pass
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Write RAR file
with open('exfil.rar', 'wb') as f:
    f.write(client_data)

# Verify MD5
print(f"MD5: {hashlib.md5(client_data).hexdigest()}")
# Expected: 464e63529654bb705fd60841021abce5

Step 2: Extract RAR with Captured Password

 python read-only • copy allowed Copy
#!/usr/bin/env python3
import rarfile

# Password was visible in the captured command:
# rar a -pqazxswedc123 exfil.rar TO_HQ FROM_HQ
password = "qazxswedc123"

with rarfile.RarFile('exfil.rar') as rf:
    rf.extractall(pwd=password)

Extracted files:

• TO_HQ/OPTI_CAM_01_OCRSCAN_000001.png (766,805 bytes)
• FROM_HQ/PRIO_UPPDRAG_HK.txt (1,700 bytes) ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 3: Analyze Extracted Files

 bash read-only • copy allowed Copy
exiftool TO_HQ/OPTI_CAM_01_OCRSCAN_000001.png

Output reveals a custom EXIF field:

Optics pov frame                : undut{REDACTED}

The image shows a periscope view of a military base with rocky coastline, soldiers, and a flag - fitting the submarine reconnaissance theme. The flag is hidden in the EXIF metadata under a custom field name "Optics pov frame" (periscope optics point-of-view frame). ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍