iHack2010 - Challenge #6

Challenge #6 is more on pcap analysis but no worries. This quite confuse or tough for someone. Simply download the pcap here. Open it with Wireshark tool. If you scroll down one by one you'll see a few conversation that mentioned to send a file. Its fairly simple to do this since this pcap does not mixes with other garbage data. If you keep focus on IP address 192.168.56.101 you'll see some base64 encoded being transfered.

Simply right click on encoded data and choose Follow TCP  Stream. You will see new window open up. Click Save As button and save it with whatever filename like anything.txt.

Then just decode it using this online tools: http://www.motobit.com/util/base64-decoder-encoder.asp and save it as anything.jpg.

Open up the picture you'll see a guy talking to you.



There is some clue on the picture beside that lets try strings em'. Inside there you can find a unicode string that might interesting.



1142241512153124434423152334444415434421153211311535114211142433

At first impression you might think it is decimal but once you try to decrypt it you'll find that it is garbage data. Lets take a look at the picture. There's might be a hint. Lets try Google Translate it from English to Malay.

You will noticed that there is two word that cannot translate properly. If you translate the 'Anesthetic' word it will come up with 'Ubat Bius' but we need the Bius word (Ubat mean Vaccine). But then search for PoKLey word on Google, you might not find any interesting. At this point I spend a lot of time to figure out. Try to combine the word that we found and you'll get 'PoKLeyBius'. There is  something here. Let use uncle Google to find out. Walla, you will see there is the answer in there. If you familiar with encode/decode thing, you will know you to find this cipher.



Using this online tools http://www.braingle.com/brainteasers/codes/polybius.php decrypt this cipher and you'll get the answer.



Enjoy.