Тыквенная сеть (Pumpkin Network)

Platform: duckerz | Category: Misc | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-01-08 | Status: Solved Techniques: dictionary_attack, wifi_analysis, wpa_handshake_capture

Summary

Task: Analyze a pcap file with captured WiFi traffic to find a WPA password. Solution: Extract the 4-way WPA handshake from EAPOL packets and crack the password using aircrack-ng with rockyou.txt wordlist.

Тыквенная сеть (Pumpkin Network) — Duckerz CTF

Description

На кануну Хэллоуина стали происходить разные странности. Из соседней квартиры доносились шорохи и скрипы, не дававшие мне покоя. Ко всему этому, я обнаружил новую точку доступа, возможно она даст разгадки ко всему происходящему...

Flag format: DUCKERZ{password}

Files: PumpkinNetwork.pcap

Analysis

Step 1: File Type Identification

 bash read-only • copy allowed Copy
file PumpkinNetwork.pcap
# pcap capture file, microsecond ts (little-endian) - version 2.4 (802.11, capture length 2324)

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The file contains captured WiFi traffic (802.11).

Step 2: Traffic Investigation

 bash read-only • copy allowed Copy
tshark -r PumpkinNetwork.pcap -c 20

Several WiFi networks were discovered, including the target:

• SSID: "pumpkin network"
• BSSID: ae:cb:8c:22:f0:a4

Step 3: WPA Handshake Search

Searching for EAPOL packets (WPA authentication):

 bash read-only • copy allowed Copy
tshark -r PumpkinNetwork.pcap -Y "eapol"

A complete 4-way WPA handshake was found:

Solution

WPA Password Cracking

Using aircrack-ng with rockyou.txt wordlist:

 bash read-only • copy allowed Copy
aircrack-ng -b ae:cb:8c:22:f0:a4 -w /usr/share/wordlists/rockyou.txt PumpkinNetwork.pcap

Result:

                               Aircrack-ng 1.7 

      [00:00:01] 2345/14344392 keys tested (2345.67 k/s) 

      Time left: 1 hour, 42 minutes, 3 seconds                  0.02%

                          KEY FOUND! [ bigdaddy ]


      Master Key     : XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX 
                       XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX 
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

      Transient Key  : XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX 
                       XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX 
                       XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX 
                       XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX 

      EAPOL HMAC     : XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX

Password found: bigdaddy

Tools

Theory

WPA 4-Way Handshake

WPA uses a 4-way handshake to establish a secure connection:

1. Message 1: AP sends ANonce to the client
2. Message 2: Client sends SNonce and MIC
3. Message 3: AP confirms and sends GTK
4. Message 4: Client confirms key installation

For cracking, capturing Message 1 and Message 2 is sufficient, but a complete handshake increases reliability.

Alternative Tools

 bash read-only • copy allowed Copy
# hashcat (GPU acceleration)
hcxpcapngtool -o hash.hc22000 PumpkinNetwork.pcap
hashcat -m 22000 hash.hc22000 rockyou.txt
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# john the ripper
aircrack-ng -J hash PumpkinNetwork.pcap
john --wordlist=rockyou.txt hash.hccap

References

• Aircrack-ng Documentation
• WPA/WPA2 Cracking ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍