Stephen McKeon

The task seemed straightforward yet mysterious: analyze a traffic dump from a mail server suspected of leaking confidential company info. The challenge description was as follows: You suspect that someone has been emailing confidential company information. So you take a traffic dump from the mail server and then analyse it... [Read More]

Nitrate has a good writeup for the main flag of this challenge, which can be found here. Without repeating any details he’s already covered, let’s solve the bonus flag. [Read More]

This challenge revolves around a custom N64 game created for NSec, and is of course mushroom themed. [Read More]

The final interesting UDP stream, stream 4, is all that’s left of the Portobello challenge stream. This one actually gave me some problems - I didn’t immediately recognize the encoding scheme. In any case, let’s walk through the solution. [Read More]

Back to examining the UDP streams in the original packet capture, portobello53.pcapng. UDP stream 9 with communication between [IPV6]::23 and [IPV6]::100 has some pretty suspect keywords present in the data… [Read More]

Looking through the other interesting UDP streams from portobello53.pcapng, UDP stream 2 stood out and appeared to contain some Base64 encoded data. [Read More]

This Portobello 53 challenges revolve around DNS tunnels - primarily identifying and decoding them. For the most part, they are pretty easy to spot. DNS requires that readable characters are used, meaning arbitrary data (i.e., high entropy URLs) stand out like a sore thumb. The only subset of DNS tunnels... [Read More]