Stephen McKeon

Nitrate has a good writeup for the main flag of this challenge, which can be found here. Without repeating any details he’s already covered, let’s solve the bonus flag. [Read More]

This challenge revolves around a custom N64 game created for NSec, and is of course mushroom themed. [Read More]

The final interesting UDP stream, stream 4, is all that’s left of the Portobello challenge stream. This one actually gave me some problems - I didn’t immediately recognize the encoding scheme. In any case, let’s walk through the solution. [Read More]

Back to examining the UDP streams in the original packet capture, portobello53.pcapng. UDP stream 9 with communication between [IPV6]::23 and [IPV6]::100 has some pretty suspect keywords present in the data… [Read More]

Looking through the other interesting UDP streams from portobello53.pcapng, UDP stream 2 stood out and appeared to contain some Base64 encoded data. [Read More]

This Portobello 53 challenges revolve around DNS tunnels - primarily identifying and decoding them. For the most part, they are pretty easy to spot. DNS requires that readable characters are used, meaning arbitrary data (i.e., high entropy URLs) stand out like a sore thumb. The only subset of DNS tunnels... [Read More]