Packets Primer picoCTF 2022 Solution

Description

1. Step 1Use strings

   Observation

   The challenge gives a raw PCAP and says the flag was sent as plain ASCII. The payload therefore sits verbatim in the file bytes, and strings will surface it with no packet parsing at all.

   This capture isn't even obfuscated. Running strings prints the readable ASCII inside the file, including the flag.

   What didn't work first

   Tried: Open the PCAP in Wireshark and search for the flag string using Edit > Find Packet with the string 'picoCTF'.

   Wireshark's string search looks for contiguous byte sequences, but the payload carries a space between every character, so the literal picoCTF never appears in the capture and the search returns nothing. Searching for the spaced form, or letting strings print the whole run and stripping the spaces afterwards, is what actually matches.

   Tried: Run 'file network-dump.flag.pcap' or 'xxd network-dump.flag.pcap | head' to inspect the file format before extracting anything.

   These commands confirm a valid PCAP and show the libpcap magic bytes without surfacing the payload. xxd prints hex beside ASCII, so short printable runs get broken up by the packet metadata between them. strings is built to pull ASCII runs out of binary files and gets there in one step.

   Learn more

   PCAP (Packet CAPture) files store raw network traffic recorded by tools like Wireshark, tcpdump, or tshark. The format stores each packet with a timestamp and the full byte content of the captured frame, including headers at every network layer (Ethernet, IP, TCP/UDP, application protocol). Any unencrypted payload transmitted over the network is present verbatim in the file.

   strings scans a binary file and outputs any sequence of printable ASCII characters that meets a minimum length threshold (4 by default). It doesn't understand packet structure - it just finds readable text wherever it appears in the raw bytes. This makes it a fast first pass for PCAP files: if anything interesting was sent in plaintext, strings will show it without needing to understand the protocol.

   The broader lesson is that any data transmitted over an unencrypted network channel is visible to any party who can capture traffic on that path - whether that's the ISP, a coffee shop router, or another host on the same network segment. This is why TLS (Transport Layer Security) is essential for any sensitive communication, and why protocols like HTTP, FTP, and Telnet have been superseded by HTTPS, SFTP, and SSH respectively.

2. Step 2Clean the output

   Observation

   The strings output shows the flag with a space between every character, because that is exactly how the sender wrote it into the TCP payload. Grep for the spaced pattern, then strip the spaces with tr, to get a contiguous flag.

   The flag sits in a single TCP segment, but the sender interleaved a space between every character before transmitting it. strings prints that payload verbatim, so the flag comes out with a space between every character. Grepping for p i c o (with spaces) matches that line, and tr -d ' ' collapses it back into the standard flag format.

   A typical head of the output looks like this, with the flag spread across a single spaced line:

   k&Nar
   n#('
   k&Na
   k&Na`
   n#('
   k&Na;
   n#('
   p i c o C T F { p 4 c k 3 7 _ 5 h 4 r k _ 0 1 b 0 . . . }
   k&Naa
   ep&Na(

   Piping through grep and tr produces the clean flag:

   $ strings network-dump.flag.pcap | grep 'p i c o' | tr -d ' '
   picoCTF{p4ck37_5h4rk_...}

   What didn't work first

   Tried: Run 'strings network-dump.flag.pcap | grep picoCTF' to find the flag in one shot.

   The literal picoCTF never appears as a contiguous run, because the payload has a space between every character, so grepping for it returns nothing. Grep the spaced pattern instead, which is how the flag actually sits on the wire.

   Tried: Skip the tr step and submit the grepped line directly, treating the spaces as part of the flag format.

   The picoCTF flag format never includes spaces - the correct token is a compact alphanumeric string like picoCTF{p4ck37_5h4rk_...}. Submitting the spaced version will be rejected by the scoring system. The tr -d ' ' step is mandatory, not cosmetic, because the spaces are padding the sender inserted and are not part of the original flag.

   Learn more

   The flag travels in a single TCP segment, but with a space inserted between every character of the payload. strings prints that run verbatim, spaces included. This is why a naive grep picoCTF finds nothing - the literal string "picoCTF" never appears as a contiguous run. Searching for 'p i c o' matches the spaced-out line, and tr -d ' ' is the required step to collapse it into a usable flag, not an optional cleanup.

   For more structured PCAP analysis, Wireshark is the industry standard. Its "Follow TCP Stream" feature (right-click any TCP packet → Follow → TCP Stream) reconstructs the full conversation in human-readable form. tshark is the command-line equivalent: tshark -r file.pcap -q -z follow,tcp,ascii,0 prints the first TCP stream as ASCII text. These tools understand protocol structure and can filter, reassemble, and decode specific sessions far more precisely than raw strings.

   This challenge is the first of several in picoCTF that involve PCAP analysis. As the challenges progress, traffic becomes encrypted, protocols become more complex, and simple strings stops being sufficient - building toward skills in protocol dissection and traffic analysis that are directly applicable to network forensics and incident response work.

Flag

Site policy redacts the trailing characters. The flag appears space-separated in the PCAP payload (a space between every character), so `tr -d ' '` is required to produce a submittable token.