---
# System prepended metadata

title: Extract stream from dns
tags: [CTF]

---

---
title: Extract stream from dns
tags: CTF
---

### Extract stream from dns
##### Decription: Whispers in conversation can lead you to where the data is hiding. Pay attention to strange numbers and fleeting names. The secret lies in the silence, but not without a trace.
![image](https://hackmd.io/_uploads/SkpaIXofgg.png)

###### follow tcp and http it is nothing moreover can't export http
```bash!
tshark -r chaos_ransom.pcap -Y "dns" -T fields -e dns.qry.name
```
##### i noted something unusual in domain name
![image](https://hackmd.io/_uploads/H1S8wQiMeg.png)

** tshark -r CTB_chaos_ransom.pcap -Y "tcp.port == 8080 || tcp.port == 8081 || tcp.port == 8082" -T fields -e tcp.stream | sort -u**
```bash!
┌──(kali㉿kali)-[~/Desktop/chall2 day2]
└─$ tshark -r chaos_ransom.pcap -Y "tcp.port == 8080  tcp.port == 8081  tcp.port == 8082" -T fields -e tcp.stream | sort -u

102
95
98
                                                                                                               
┌──(kali㉿kali)-[~/Desktop/chall2 day2]
└─$ tshark -r chaos_ransom.pcap -qz follow,tcp,ascii,95

===================================================================
Follow: tcp,ascii
Filter: tcp.stream eq 95
Node 0: 192.168.1.100:12360
Node 1: 192.168.1.101:8080
139
..VQ_UUUUU4S..UUUUUUUUUUUU_UUU<8%:'!4;!z..VQAU\U6UC\.....i.UUUzUUUGU^U<8%:'!4;!z3942{!-!T.RUTU..V]UQ...k......5Z..W.......h.{.....`f.^4
dN%
===================================================================
                                                                                                               
┌──(kali㉿kali)-[~/Desktop/chall2 day2]
└─$ tshark -r chaos_ransom.pcap -qz follow,tcp,ascii,98


===================================================================
Follow: tcp,ascii
Filter: tcp.stream eq 98
Node 0: 192.168.1.100:12361
Node 1: 192.168.1.101:8081
139
x.F....m.pd...k../..:..?...O.C.lR.8....R]...i.UUUzUUU..TWJU_UUUUU4S..UUUUUUUUUUUU_UqUUUUUUUEUUUUUUU<8%:'!4;!z_UuUUUUUTUMU.s
.H..T.s
.H..TM3
===================================================================
                                                                                                               
┌──(kali㉿kali)-[~/Desktop/chall2 day2]
└─$ tshark -r chaos_ransom.pcap -qz follow,tcp,ascii,102

===================================================================
Follow: tcp,ascii
Filter: tcp.stream eq 102
Node 0: 192.168.1.100:12362
Node 1: 192.168.1.101:8082
139
.H..TT.RUTU..V]U..PSUUUUWUWU.UUU.UUUUUUUUUUUuUUU}UUU<8%:'!4;!z3942{!-!_UuUUUUUTUMU(i.cu..T(i.cu..T..
===================================================================
```
###### we moved it into hex 
```bash!
─(kali㉿kali)-[~/Desktop/chall2 day2]
└─$ tshark -r chaos_ransom.pcap -qz follow,tcp,raw,98 > stream98.hex
                                                                                                               
┌──(kali㉿kali)-[~/Desktop/chall2 day2]
└─$ tshark -r chaos_ransom.pcap -qz follow,tcp,raw,102 > stream102.hex
┌──(kali㉿kali)-[~/Desktop/chall2 day2]
└─$ tshark -r chaos_ransom.pcap -qz follow,tcp,raw,95 > stream95.hex
```
###### next we will see hex 
https://gchq.github.io/CyberChef/#recipe=From_Hex('Auto')XOR(%7B'option':'Hex','string':'55'%7D,'Standard',false)&input=MDUxZTU2NTE1ZjU1NTU1NTU1NTUzNDUzOTcwZjU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTVmNTU1NTU1M2MzODI1M2EyNzIxMzQzYjIxN2EwNTFlNTY1MTQxNTU1YzU1MzY1NTQzNWM5NzBmYjdlNDk2NjkxODU1NTU1NTdhNTU1NTU1NDc1NTVlNTUzYzM4MjUzYTI3MjEzNDNiMjE3YTMzMzkzNDMyN2IyMTJkMjE1NGNjNTI1NTU0NTUxNDEwNTY1ZDU1NTE5ZjFkZWU2YmY2ZTM5ZWJkMWY5YjM1NWFkZGE0NTdlOTBjZWU4MzJlYzRkNDY4ODY3YmZjYjE4YjBmOTc2MDY2ZWQ1ZTM0MGE2NDRlMjU3OGRmNDZjZGQzZDkxMjZkMDY3MDY0OWQxNWZjNmJmY2UwMmZkZDFjM2FlNmFhM2ZlZTFjYjk0ZjFhNDNkODZjNTIwNzM4ZmZkZTA1MWU1MjVkYjdlNDk2NjkxODU1NTU1NTdhNTU1NTU1MDUxZTU0NTc0YTU1NWY1NTU1NTU1NTU1MzQ1Mzk3MGY1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1ZjU1NzE1NTU1NTU1NTU1NTU1NTQ1NTU1NTU1NTU1NTU1NTUzYzM4MjUzYTI3MjEzNDNiMjE3YTVmNTU3NTU1NTU1NTU1NTU1NDU1NGQ1NTExNzMwYWU4NDg4NjhlNTQxMTczMGFlODQ4ODY4ZTU0NGQzMzQ4ZTQ0ODg2OGU1NDA1MWU1NDU3NGE1NTQxNTU1YzU1MzY1NTQzNWM5NzBmYjdlNDk2NjkxODU1NTU1NTdhNTU1NTU1NDc1NTdhNTU1NTU1NTU1NTU1NTU3NTU1NTU1NTdkNTU1NTU1M2MzODI1M2EyNzIxMzQzYjIxN2EzMzM5MzQzMjdiMjEyZDIxNWY1NTc1NTU1NTU1NTU1NTU0NTU0ZDU1Mjg2OTAwNjM3NTg2OGU1NDI4NjkwMDYzNzU4NjhlNTQxM2ZmMGRlMjQ4ODY4ZTU0NTRjYzUyNTU1NDU1MTQxMDU2NWQ1NTA1MWU1MDUzNTU1NTU1NTU1NzU1NTc1NTllNTU1NTU1OTU1NTU1NTU1NTU1
###### we get file zip and crack file zip we get flag 
### flag{Y0u_Cr4ck3d_An_Encryp7ed_Ext0rt1on_mrL0n9}
