Kittens
A Cat has 9 Lives - payatu forensics challenge 2025
chall:
In the protocol hierarchy we can see :
It is best to take a look at what all domains the user went to , we can get that via tshark
also when we take a look at export objects in wireshark we get in http:
queries.txt
looks like this
Awfully lot of sillycat domain aint it?
strategy:
The
sillycatsdomain (e.g., 3b46004bad61920021636f6d6d616e6420284445534b544f502d4d534356.4348462900.sillycats) stands out as suspicious, with long, hex-encoded subdomains, characteristic of dnscat2 exfiltration.dnscat2 Query Structure:
dnscat2 encodes data in subdomains as hex strings, often with control bytes (first 9 bytes of decoded data) for session management.
Queries like 3b46004bad61920021636f6d6d616e6420284445534b544f502d4d534356.4348462900.sillycats contain hex-encoded data (e.g., 636f6d6d616e64 decodes to command).
The sequence ends with 1d2f0266d353747265616d20636c6f73656400.sillycats, indicating the stream closure (stream closed).
Key Observations: Several queries explicitly reference flag.txt (e.g., 620e0166d31246e7ec7479706520666c61672e7478740a5041594154557b53305f5468335f6334375f357033346b537d0d0a433a5c3e.sillycats). Decoding 5041594154557b53305f5468335f6334375f357033346b537d (hex) yields `PAYATU{S0_Th3_c47_5p34kS}` , which matches the CTF flag format flag{...}. The queries show commands executed on the victim machine (e.g., whoami, systeminfo, dir, type flag.txt), suggesting the attacker used dnscat2 to run commands and exfiltrate their output, including the flag.
we can decode the qeury with the code:
Extract all sillycats subdomains, decode their hex content, and skip control bytes. Concatenate the decoded data to reconstruct the exfiltrated output. Search for flag{...} in the decoded data, as the flag is likely in the output of type flag.txt.
Last updated