# t3am\_vi3w3r

| Field      | Value               |
| ---------- | ------------------- |
| Category   | Network / Forensics |
| Difficulty | **Easy**            |

### Challenge Overview

We've got hint right in the name of the challenge (**t3am\_vi3w3r**).

I opened **Wireshark** then looked into **Statistics -> Protocol Hierarchy**.

<figure><img src="https://3350216265-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8aLNxke1qPtepwlrf6VI%2Fuploads%2FgHSQU0Z5LXLSobsHF5YY%2Fprotocol%20hierarchy.png?alt=media&#x26;token=47af24e5-5729-49a6-93f8-3e6f903e36f1" alt=""><figcaption><p>protocol hierarchy</p></figcaption></figure>

There, **VNC (Virtual Network Computing)** catched my eyes as it is a well-known protocol which allows to remote-control a computers, like **RDP**.

### Exploitation

I used **"vnc"** as a filter then simply followed a **TCP Stream** and copy all the **ASCII Content** and paste it in notepad (or any editor).

Because **VNC uses the RFB protocol** and transmits **binary framebuffer updates**, non-printable bytes appear as dots in the ASCII view. Then got the flag with **simple duplication encoding**.

**DDCCTTFF{{.....}}**

### Final Payload

We can basically decode it by typing each **letter** once, or with **python**:

```python
flag = "DDCCTTFF{{....}}"
flag[::2]
```

*made by k0d*
