Wireshark doo dooo do doo... picoCTF 2021 Solution

Description

1. Step 1Find the right TCP stream

   Observation

   The capture holds multiple TCP streams across hundreds of packets. Wireshark's display filters and Follow TCP Stream isolate and reassemble the one conversation carrying the flag.

   Open shark1.pcapng in Wireshark. Filter to narrow the search before scrolling: by DNS hostname (dns.qry.name contains '...'), by HTTP host, or by raw text content. Then sort streams by length and follow the longest.

   bash

   wireshark shark1.pcapng

   Copied!

   bash

   # In the filter bar, try one of:

   Copied!

   bash

   #   dns.qry.name contains 'example'

   Copied!

   bash

   #   tcp contains 'flag'

   Copied!

   bash

   #   http

   Copied!

   What didn't work first

   Tried: Scroll through packets one by one looking for readable text instead of using a display filter

   The capture holds hundreds of packets across several streams, and scrolling by hand gives fragmented per-packet payloads rather than reassembled application data. Follow TCP Stream, from the right-click menu on a packet in the relevant stream, concatenates both directions so the ROT13 sentence appears as one readable block.

   Tried: Use the filter 'tcp contains "picoCTF"' to find the flag directly

   The flag inside the stream is ROT13-encoded, so the literal bytes 'picoCTF' do not appear anywhere in the capture. The filter matches zero packets and looks like an empty pcap. Filtering for the encoded prefix 'cvpbPGS' or the surrounding phrase 'Gur synt' works because those bytes are present verbatim on the wire.

   Learn more

   Wireshark is the standard packet analyzer. A .pcapng file stores captured packets with metadata. Right-click any packet and choose Follow > TCP Stream to reassemble the bidirectional conversation.

   How to identify stream 5 specifically. Streams are numbered from 0 in order of first appearance. To pick the right one without checking each by hand:

   • Statistics > Conversations > TCP sorts by bytes per stream. The longest few are usually the interesting ones.
   • Filter with tcp.stream eq 5 once you suspect a number, or filter by content first (tcp contains "Gur synt") and read which stream the matched packet belongs to.
   • tshark can dump every stream programmatically: for i in $(seq 0 20); do tshark -r shark1.pcapng -q -z follow,tcp,ascii,$i; done.

   See Wireshark for CTF for the full filter cheat sheet.

2. Step 2Decode the ROT13-encoded flag

   Observation

   The reassembled stream reads 'Gur synt vf cvpbPGS{...}', with every word looking like shifted English and the prefix matching picoCTF shifted by 13. That is ROT13, so run tr over the whole sentence.

   The TCP stream contains: 'Gur synt vf cvpbPGS{c33xno00_1_f33_h_qrnqorrs}'. Apply ROT13 to the letters; digits and underscores pass through unchanged. The decoded sentence reads: 'The flag is picoCTF{p33kab00_1_s33_u_...}'.

   bash

   echo "Gur synt vf cvpbPGS{c33xno00_1_f33_h_qrnqorrs}" | tr 'A-Za-z' 'N-ZA-Mn-za-m'

   Copied!

   Expected output

   The flag is picoCTF{p33kab00_1_s33_u_...}

   What didn't work first

   Tried: Apply ROT13 only to the inner flag token 'c33xno00_1_f33_h_qrnqorrs' and ignore the surrounding sentence

   Running tr on just the braces-wrapped portion decodes the flag body correctly, but skipping the surrounding phrase means you have to infer manually that the output is the flag. Including the full sentence 'Gur synt vf cvpbPGS{...}' in the tr command produces 'The flag is picoCTF{...}' which removes all ambiguity about what you are reading.

   Tried: Use an online ROT13 tool but paste the text with the Wireshark newline artifacts left in

   Wireshark's Follow TCP Stream window sometimes appends direction markers or line breaks mid-token when you copy raw text. Pasting those artifacts into an online tool decodes the letters correctly but leaves stray characters around digits, making the flag look malformed. The tr shell command processes stdin byte-for-byte and is unaffected by surrounding whitespace, giving the cleanest output.

   Learn more

   Worked example. ROT13 shifts each letter by 13 positions, wrapping within case. Non-letters (digits, punctuation, underscores) pass through untouched. So c33xno00 decodes letter-by-letter:

   c -> p   (c is the 3rd letter, 3+13 = 16 -> 16th letter = p)
   3 -> 3   (digit, unchanged)
   3 -> 3
   x -> k
   n -> a
   o -> b
   0 -> 0   (digit, unchanged)
   0 -> 0

   So c33xno00 decodes to p33kab00. The tr 'A-Za-z' 'N-ZA-Mn-za-m' pattern handles only alphabetic characters, which is exactly the right semantics: digits and underscores stay put.

Flag

Following individual TCP streams isolates one connection's application-layer data. Here the flag was ROT13-encoded within the stream.