Roy's Randomness

Problem

Roy found some suspicious network traffic, wireshark shows so many errors with it! Can you figure out what's happening

Solution

This is a TCP covert channel, using morse code.

The PSH packets are sent at regular intervals, serving as delimiters.

On the other hand, the RST and SYN packets act as '1' and '0' bits in the message. Using the international morse code, RST -> - and SYN -> ., we can obtain the message.

Decoding from hex gives us the flag: UMDCTF-{r0y_f0und_m0r53}

import json

MORSE_CODE_DICT = { 'A':'.-', 'B':'-...',
                    'C':'-.-.', 'D':'-..', 'E':'.',
                    'F':'..-.', 'G':'--.', 'H':'....',
                    'I':'..', 'J':'.---', 'K':'-.-',
                    'L':'.-..', 'M':'--', 'N':'-.',
                    'O':'---', 'P':'.--.', 'Q':'--.-',
                    'R':'.-.', 'S':'...', 'T':'-',
                    'U':'..-', 'V':'...-', 'W':'.--',
                    'X':'-..-', 'Y':'-.--', 'Z':'--..',
                    '1':'.----', '2':'..---', '3':'...--',
                    '4':'....-', '5':'.....', '6':'-....',
                    '7':'--...', '8':'---..', '9':'----.',
                    '0':'-----', ', ':'--..--', '.':'.-.-.-',
                    '?':'..--..', '/':'-..-.', '-':'-....-',
                    '(':'-.--.', ')':'-.--.-'}

data = json.loads(open('roy.json').read())
result = ''

curr = ''
for packet in data:
    flags = packet['_source']['layers']['tcp']['tcp.flags_tree']

    if flags['tcp.flags.syn'] == '1':
        curr += 'S'

    elif flags['tcp.flags.push'] == '1':

        if not curr:
            continue

        morse_code = ''
        for char in curr:
            if char == 'R':
                morse_code += '-'
            else:
                morse_code += '.'

        print(curr, morse_code)

        for key in MORSE_CODE_DICT:
            if MORSE_CODE_DICT[key] == morse_code:
                result += key

        curr = ''

    elif flags['tcp.flags.reset'] == '1':
        curr += 'R'

print(result)