Офисный Хакер (Office Hacker)

Platform: duckerz | Category: Forensics | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2026-01-09 | Status: Solved Techniques: pcap_structure_analysis, offset_extraction, string_search, hex_analysis

Summary

Files: office_hacker.pcapng (1MB)

Офисный Хакер (Office Hacker) - Duckerz CTF

Description

Мы обнаружили утечку информации в нашем офисе, но странного трафика обнаружено не было. Как им удалось слить информацию?

(Translation: "We discovered an information leak in our office, but no strange traffic was detected. How did they manage to leak the information?")

Files: office_hacker.pcapng (1MB)

Analysis

Initial Inspection

 bash read-only • copy allowed Copy
# Packet statistics
tshark -r office_hacker.pcapng -q -z io,stat,0

# Protocols
tshark -r office_hacker.pcapng -q -z conv,tcp

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Pcap contents:

• 958 packets total
• 295 DNS queries to random 10-character .ru domains
• 663 TCP packets with HTTP/IPP traffic
• 1 HTTP POST request to /ipp/print on port 8000 (chunked transfer encoding)

Red Herring

DNS queries look like classic DNS exfiltration:

abcdefghij.ru
klmnopqrst.ru
...

But the flag is not there! This is a distraction.

Key Discovery

The flag is hidden using steganography in the pcap file structure itself!

Flag parts are embedded at specific offsets in the file, appearing at TCP packet boundaries. Each part is 4 characters followed by )5 (timestamp bytes from pcap structure). ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Solution

Finding Flag Parts

 bash read-only • copy allowed Copy
# Find flag parts in pcap
strings -t x office_hacker.pcapng | grep ")5$"

Found Parts

Verification

 bash read-only • copy allowed Copy
# Check specific offset
xxd -s 0x5c0e -l 10 office_hacker.pcapng
‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

# View TCP stream
tshark -r office_hacker.pcapng -q -z "follow,tcp,ascii,0"

Assembling the Flag

 python read-only • copy allowed Copy
#!/usr/bin/env python3
"""
Office Hacker - Flag extraction from pcap structure
"""

parts = [
    (0x417c, "DUCK"),
    (0x41d8, "ERZ{"),
    (0x4302, "h1dd"),
    (0x435c, "3n_d"),
    (0x440f, "474_"),
    (0x4a0f, "1n_p"),
    (0x500f, "r1n7"),
    (0x560f, "3r_p"),
    (0x5c0e, "r070"),
    (0x620f, "c0l}")
]

flag = ''.join(part for _, part in parts)
print(f"Flag: {flag}")
# DUCKERZ{REDACTED}

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Flag Decoding

REDACTED = "hidden data in printer protocol"

This references the data exfiltration method via IPP (Internet Printing Protocol), which was not detected as "strange traffic" - the hint from the task description.

Lessons

1. Don't get distracted by obvious red herrings - DNS exfiltration was bait
2. Flag can be in pcap structure, not in protocol data
3. Always verify ALL flag parts - missing r070 gave pc0l instead of pr070c0l
4. Task name and description contain hints - "printer protocol" is directly stated in the flag
5. strings command with hex offset - powerful tool for finding hidden data ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Useful Commands

 bash read-only • copy allowed Copy
# Search strings with hex offsets
strings -t x file.pcapng | grep "pattern"

# View hex at specific offset
xxd -s 0xOFFSET -l LENGTH file.pcapng

# Protocol statistics in pcap
tshark -r file.pcapng -q -z io,phs

# Follow TCP stream
tshark -r file.pcapng -q -z "follow,tcp,ascii,STREAM_NUMBER"

# Export HTTP objects
tshark -r file.pcapng --export-objects http,./output_dir

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍