The Nixu Challenge - 2019 - Exfiltration Writeup
------------------------------------------------

As described in the briefing, browsing would be a pain without this protocol, so it must be DNS. DNS exfiltration was a thing just a while back, so let's take a look at it.

Open exfiltration.pcap in WireShark

Filter: dns && ip.src == 10.0.2.15 && dns.qry.name contains ".malicious.pw"

Now mark (ctrl+m) the first and the last packet, then export the packet dissection: first to last marked, packet summary line -> packet.data

Remove everything unnessessary:

cat packet.data | sed -e 's/^.* TXT //g' -e 's/^.* MX //g' -e 's/^.* CNAME //g' -e 's/\.malicious\.pw.*$//g' > packet_data

By examining the packet_data, it seems that there's first a 18 character checksum or something in the beginning of each packet, so let's remove it:

cat packet_data | cut -c 19- | sed -e 's/\.//g' >> data_filtered

So most definitely the data's hex, and converting it to ascii reveals a hint that in the data there's a PNG at some point.

PNG-file starts with the decimal signature 137 80 78 71 13 10 26 10, which in hex translates to 89 50 4E 47  0D 0A 1A 0A. And will you look at that, in the hex data there's a line starting with 0000550c8002000389504e470d0a1a0a

Remove the garbage (0000550c80020003).

PNG file's eof is IEND, in hex that's 49 45 4e 44. Examine the end of data:

49454e44ae426082

Remove the garbage (ae426082) and save that content to "data".

Convert to oneliner:

ARR=($(cat data));for row in "${ARR[@]}"; do printf $row >> oneliner; done;

Then convert that to PNG:

cat oneliner | xxd -r -p - > flag.png

Now view the PNG:

NIXU{just_another_tunneling_technique}