# private-coms

| Info     | Details             |
| -------- | ------------------- |
| Category | Forensics / Network |

## Challenge Overview

> Here we need to analyze a `.pcap` file.\
> It's not that easy because the capture has **14k packets**, and we should check only the things that matter.

I analyzed it and discovered a `URB_BULK out` packet with `122944 Bytes`, which is **a lot for a simple packet,** so it's sus.

<figure><img src="https://3350216265-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8aLNxke1qPtepwlrf6VI%2Fuploads%2FhcqIqKVdc5yI4qshoCUB%2FScreenshot_1.png?alt=media&#x26;token=99252e3e-5abc-45d3-b35e-7abf59afbb2f" alt=""><figcaption></figcaption></figure>

We also could've guessed it using the following Wireshark display filter:

```
frame contains "ID3"
```

`ID3` is the standard header for an `.mp3` file, visible in **HEX View**.

Copying the **HEX Dump** and going to **CyberChef**, we get an actual `.mp3` file.

<figure><img src="https://3350216265-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8aLNxke1qPtepwlrf6VI%2Fuploads%2FlxAFp8ruxdbvBgUNVcaP%2FScreenshot_2.png?alt=media&#x26;token=ed5a0540-b51c-4782-aef8-ccb4bd7ae2e8" alt=""><figcaption></figcaption></figure>

Then, going to a **speech-to-text tool online** or simply listening to the message in the audio, we get the **flag**.

***

## Final Flag

`ctf{13ce08ba071d475d51694c2e60719a1faaa7e13614e5fb9ac43927f43adcb1b}`

***

## Alternative

I guess that's not an intended approach, but we could simply run:

```bash
binwalk private-coms.pcap
```

This shows we've got an `.mp3` file embedded.\
We can extract it using:

```bash
dd if=private-coms.pcap of=extracted.mp3 bs=1 skip=1261028
```

<figure><img src="https://3350216265-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8aLNxke1qPtepwlrf6VI%2Fuploads%2FxEtuqCKPNmFW2EnYl5Bc%2Fimage.png?alt=media&#x26;token=b4281fa5-e53c-49a6-9fbd-367b1039c904" alt=""><figcaption></figcaption></figure>
