BucketCTF 2023 - Clock
Table of Contents
BucketCTF 2023 - This article is part of a series.
Clock #
Description #
One of my cybersecurity professors, Dr. Timely, randomly sent my this file and said if I can decode the message he will give me an A in the class. Can you help me out?
https://storage.ebucket.dev/clocks_medium.pcap
TL;DR #
In the PCAP file, we have a lot of ICMP requests without any data. We can notice however that they are sent at very precise delays from each other, either 1 second interval or 5 seconds.
Having only 2 states, we can imagine binary. Morse code could also have been a possibility if a third state was present.
Solution #
With thsark I get the different deltas between the requests with a field.
I put them in cyberchef to keep only the number of seconds that I want to parse.
Then i replaced 0.1 with 0 and 0.5 with 1 (i had luck it could have been the other way around).
And finally I decode the binary in my recipe to get the flag.
Flag #
bucket{look_at_the_times_sometimes}