---
description: PCAP analysis
---

# The realm of Eerie Area

## Description

In this mysterious realm, a malevolent force is at play. Uncover the hidden malevolence within. Figure out the dark secrets the area holds.

Attachment: `eerie-area.pcapng`



## Solution

The challenge description does not provide any hint. My first approach for all pcap challenges is to go to `Statistics > Protocol Hierarchy` to have an overview of the challenge by looking through the protocols involved in the traffic.

<figure><img src="https://3139068166-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5otAmBnHXiDB0QXOOAMF%2Fuploads%2FXXU9YzbPlyg6s59cpW51%2Fthe-realm-of-eerie-area-1.png?alt=media&#x26;token=240463e7-9684-44b7-b239-07b2fa131759" alt=""><figcaption></figcaption></figure>

Normally, if there's text data, there might be some juicy info there. Right click `Line-based text data`, then click `Apply as Filter > Selected` to apply it as filter to view it.

<figure><img src="https://3139068166-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5otAmBnHXiDB0QXOOAMF%2Fuploads%2FKaHD0aTKILv5XyOzo5YO%2Fthe-realm-of-eerie-area-2.png?alt=media&#x26;token=ee328f89-a4d1-40d4-9d2e-1dae5afda86e" alt=""><figcaption></figcaption></figure>

It is a 404 Not found message. When I saw 404, I thought that I was in a wrong path. However, I chose to further analyze it first so that I won't miss any important thing. Right click the packet, then `Follow > TCP Stream` to view it in a better way.

<figure><img src="https://3139068166-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5otAmBnHXiDB0QXOOAMF%2Fuploads%2FNom7Vq9mzrH5eE1HXMUq%2Fthe-realm-of-eerie-area-3.png?alt=media&#x26;token=6ae1ca3f-4263-433a-ad89-79caf02cc05e" alt=""><figcaption></figcaption></figure>

Red denotes request sent by client, while blue denotes response received from server. In the first line, we can see that the client is using GET request to get something with a weird name. It looks like encoded string or cipher, so I tried to copy it and decode it.

<figure><img src="https://3139068166-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5otAmBnHXiDB0QXOOAMF%2Fuploads%2Fz2Pft3VCh5dctbm7byOG%2Fthe-realm-of-eerie-area-4.png?alt=media&#x26;token=cfee331a-aef2-4b10-9c59-939cee4c0343" alt=""><figcaption></figcaption></figure>

By using [CyberChef](https://gchq.github.io/CyberChef/), we will then get the decoded string, which appears to be a link to download another file named `boo.exe`.

<figure><img src="https://3139068166-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5otAmBnHXiDB0QXOOAMF%2Fuploads%2FAOPmIoamv7LzCPqrbnbT%2Fthe-realm-of-eerie-area-5.png?alt=media&#x26;token=01445ddb-614e-4fd7-ba6a-7da0357fe912" alt=""><figcaption></figcaption></figure>

It appears to be a gzip file instead of an exe file.

<figure><img src="https://3139068166-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5otAmBnHXiDB0QXOOAMF%2Fuploads%2FNvcdm9KxvFLYBNJQK9Cv%2Fthe-realm-of-eerie-area-6.png?alt=media&#x26;token=6450c81a-273f-470f-9fa2-cf1a4da48887" alt=""><figcaption></figcaption></figure>

Once extracted, it shows a directory with another exe file inside, and the filename seems like the flag.

<figure><img src="https://3139068166-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5otAmBnHXiDB0QXOOAMF%2Fuploads%2FMsk3QDAOqEm1Bs0aWkDY%2Fthe-realm-of-eerie-area-7.png?alt=media&#x26;token=975cfd01-2d05-4f41-8ce2-bd0b81e36b20" alt=""><figcaption></figcaption></figure>

However, it is again not an exe file, but text instead. Viewing the contents in the file reveals the real flag to us.



## Flag

`gohunikl2023{p3ek_4_&0o}`
