Loud Packets

Platform: CUSTOM | Category: Forensics | Type: Challenge | Difficulty: Easy-medium | OS: N/A | **Author: XESXOR Techniques: custom_protocol_parsing, packet_reordering_by_sequence_number, pcap_analysis, spectrogram_steganography, wav_reconstruction

Summary

Walkthrough of the CUSTOM Forensics Loud Packets. Task: pcap with Bluetooth audio packets (custom BTAV protocol over UDP) arriving in shuffled order, plus noise decoy packets. Solution: filter BTAV packets, reorder by 4-byte sequence number, concaten

Description

I was transferring a file with very sensitive info over bluetooth, but someone got ahold of the packets...

Given: chall.pcap (314 KB) — a network capture containing Bluetooth audio data encapsulated in custom UDP packets. The goal is to reconstruct the original audio and extract the hidden flag.

Analysis

PCAP Structure

The capture contains 509 UDP packets with no native Bluetooth/OBEX protocols — all traffic is eth:ip:udp:data:

• 459 BTAV packets: 192.168.1.100 → 192.168.1.200 (port 50000→62000), each 650 bytes total (608 bytes UDP payload)
• 50 noise packets: random 10.0.0.x → 10.0.1.x addresses with varying data sizes — decoys that don't contribute to the solution

 bash read-only • copy allowed Copy
tshark -r chall.pcap -q -z io,phs
# Shows: eth:ip:udp:data (508 packets) + one ayiya packet

BTAV Packet Format

Each BTAV packet's 608-byte UDP payload has a fixed structure:

Critical discovery: sequence numbers range from 0 to 458 (all 459 values present, all unique), but they arrive in shuffled order. The packets must be sorted by sequence number to reconstruct the original file.

Reconstructed Audio

Sorting by sequence number and concatenating the 600-byte payloads produces a valid WAV file:

• Format: RIFF PCM
• Channels: 1 (mono)
• Sample rate: 44100 Hz
• Bits per sample: 16
• Total size: ~275 KB (459 × 600 = 275,400 bytes)

The WAV header (RIFF....WAVEfmt ) appears at the start of the reassembled data (sequence number 0).

Solution

Step 1: Extract and reassemble BTAV packets

Filter only the BTAV packets (from 192.168.1.100), parse the sequence number from bytes 4–7, sort, and concatenate the audio payloads:

 python read-only • copy allowed Copy
#!/usr/bin/env python3
import subprocess

# Extract raw UDP payloads from BTAV source
result = subprocess.run(
    ['tshark', '-r', 'chall.pcap', '-Y', 'ip.src == 192.168.1.100',
     '-T', 'fields', '-e', 'data'],
    capture_output=True, text=True
)

packets = []
for line in result.stdout.strip().split('\n'):
    if not line:
        continue
    data = bytes.fromhex(line.strip())
    magic = data[0:4]  # b'BTAV'
    seq = int.from_bytes(data[4:8], 'big')  # sequence number
    payload = data[8:]  # 600 bytes of audio
    packets.append((seq, payload))

# Sort by sequence number and write WAV
packets.sort(key=lambda x: x[0])
audio = b''.join(p[1] for p in packets)

with open('audio.wav', 'wb') as f:
    f.write(audio)

print(f"Reassembled {len(packets)} packets, {len(audio)} bytes")
# Output: Reassembled 459 packets, 275400 bytes

Step 2: Generate spectrogram to reveal the flag

The flag is hidden as text drawn in the spectrogram of the audio file, visible in the 1–4 kHz frequency band. This is a classic audio steganography technique where text is embedded as frequency patterns.

 bash read-only • copy allowed Copy
sox audio.wav -n spectrogram -o spectrogram.png

The spectrogram clearly shows the text: tjctf{REDACTED}

The challenge title "loud-packets" is a direct pun — the flag is literally "loud" (visible as sound energy in the frequency spectrum).

Key Takeaways / Lessons

• Mastering custom_protocol_parsing, packet_reordering_by_sequence_number, pcap_analysis, spectrogram_steganography, wav_reconstruction was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-05-16 • CUSTOM • Loud Packets • Difficulty: Easy-medium