Clear it in 3 steps
-
Start the environment
-
Investigate the target
-
Submit the flag
All challenges
In progress
Network Analysis - TCP Retransmission Covert Channel
Mission
capture.pcap contains TCP retransmissions with duplicate sequence numbers. Extract retransmissions whose payload changed, XOR the two one-byte payloads for each duplicated sequence, and concatenate results in sequence-number order to recover the flag.
Hints
Hint 1 Show
Parse Ethernet, IPv4 and TCP headers to obtain TCP seq and payload offsets
Hint 2 Show
Only sequence numbers seen twice are real; unique sequence numbers are decoys
Hint 3 Show
XOR each pair of one-byte payloads and concatenate in ascending seq order