we settled for #43 from 484 teams
Misc more writeups from Mystik0ri0n here
John’s Return Description you can get the challenge file here
received.pcapng
Solution summary : WPA traffic decrypting Here we have a pcapng file wirh 802.11 radiotap (wireless) traffic dump,seems it’s encrypted
…. but wait it’s a .pcapng file which aircrack-ng is unable to read it so we are forced to convert to a pcap i used this site pcapng.
Forbidden points 100
challenge description Agent Troll recieved some file but not able to read the data can you help us?
Author: White_Wolf Forbidden (link is dead but file is attached)
solution we are given a trollcats.car
$file trollcats.car trollcats.car: data on further investigation
$binwalk trollcats.car DECIMAL HEXADECIMAL DESCRIPTION -------------------------------------------------------------------------------- 50 0x32 bzip2 compressed data, block size = 900k extracting the file
$binwalk -e trollcats.car DECIMAL HEXADECIMAL DESCRIPTION -------------------------------------------------------------------------------- 50 0x32 bzip2 compressed data, block size = 900k ┌─[@parrot]─[~/Desktop/CTFs/TrollCAT/Forensics] └──╼ $cd _trollcats.