Space Noise
TCP covert channel using Morse Code

Description

We just intercepted a secret transmission from the Secret Space Agency, but the traffic looks really weird... Wireshark shows so much red! Can you help us to figure out what's going on?
The flag is in the flag format: STC{...}
Author: zeyu2001
space_noise.pcap
123KB
Binary
space_noise.pcap

Solution

We are provided with a PCAP file containing packets sent between 192.168.1.1 and 192.168.1.2.
Let's find some patterns!
First, notice that the SYN-PSH pair is sent at regular intervals. Perhaps this is a delimiter of sorts. The SYN packet is sent from 192.168.1.1 to 192.168.1.2, while the PSH packet is sent from 192.168.1.2 to 192.168.1.1.
Next, in between the SYN-PSH pairs, there are RST and URG packets. Since only two different packets are used, binary and morse code comes to mind.
Notice that there are up to 5 packets between the SYN-PSH pairs. If this was a 5-bit encoding, it wouldn't make much sense for the number of bits to vary from 1 to 5. In morse code, however, alphanumeric characters are represented by up to 5 dots and slashes.

The Protocol

This is a covert TCP channel, implemented using morse code. The protocol is as follows:
  • RST = .
  • URG = -
  • SYN = I have finished sending a character.
  • PSH = I acknowledge this character. Send the next character.
Decoding the morse code gives the flag in hex.

Solve

The following script implements the solution.
1
from Crypto.Util.number import long_to_bytes
2
from scapy.all import *
3
​
4
packets = rdpcap("space_noise.pcap")
5
​
6
FLAGS = {
7
'FIN': 0x01,
8
'SYN': 0x02,
9
'RST': 0x04,
10
'PSH': 0x08,
11
'ACK': 0x10,
12
'URG': 0x20,
13
'ECE': 0x40,
14
'CWR': 0x80
15
}
16
​
17
MORSE_CODE_DICT = { 'A':'.-', 'B':'-...',
18
'C':'-.-.', 'D':'-..', 'E':'.',
19
'F':'..-.', 'G':'--.', 'H':'....',
20
'I':'..', 'J':'.---', 'K':'-.-',
21
'L':'.-..', 'M':'--', 'N':'-.',
22
'O':'---', 'P':'.--.', 'Q':'--.-',
23
'R':'.-.', 'S':'...', 'T':'-',
24
'U':'..-', 'V':'...-', 'W':'.--',
25
'X':'-..-', 'Y':'-.--', 'Z':'--..',
26
'1':'.----', '2':'..---', '3':'...--',
27
'4':'....-', '5':'.....', '6':'-....',
28
'7':'--...', '8':'---..', '9':'----.',
29
'0':'-----', ', ':'--..--', '.':'.-.-.-',
30
'?':'..--..', '/':'-..-.', '-':'-....-',
31
'(':'-.--.', ')':'-.--.-'}
32
​
33
morse_code = ''
34
​
35
for p in packets:
36
if p['TCP'].flags == 'R':
37
morse_code += '.'
38
elif p['TCP'].flags == 'U':
39
morse_code += '-'
40
elif p['TCP'].flags == 'S':
41
morse_code += ' '
42
​
43
message = ''
44
curr = ''
45
​
46
print(morse_code)
47
​
48
for char in morse_code:
49
​
50
if char != ' ':
51
curr += char
52
​
53
else:
54
for char in MORSE_CODE_DICT:
55
if MORSE_CODE_DICT[char] == curr:
56
message += char
57
58
curr = ''
59
​
60
print(message)
61
print(long_to_bytes(int(message, 16)).decode())
Copied!
The flag is STC{I believe that this Nation should commit itself to achieving the goal, before this decade is out, of landing a man on the Moon and returning him safely to Earth.}
Last modified 5mo ago