Icmp Tunnel Exfil

Category: FORENSICS · Difficulty: Basic · Points: 150 · Challenge: 483

Background

Border firewalls observed abnormal ICMP Echo Request size variance moving toward an unclassified off-shore IP. Data payloads within each echo request contain sequenced fragments of an exfiltrated token. Reassemble the payload stream. FORMAT: FLAG{ }

Analysis

The capture is 177 bytes and holds a single Ethernet frame carrying one IPv4 packet and one TCP segment from 192.168.1.100 to 192.168.1.1 on port 80, with no handshake and no retransmission. Because port 80 dissects as HTTP, the payload reads directly out of the file with no stream reassembly required:

$ tshark -r traffic-041.pcap -q -z io,phs
frame                frames:1 bytes:137
  eth                frames:1 bytes:137
    ip               frames:1 bytes:137
      tcp            frames:1 bytes:137

$ strings -n 6 traffic-041.pcap
GET /endpoint?token=FLAG{cwa2026_bc19dbefb55c0e0b} HTTP/1.1
Host: cwa.internal

The evidence contradicts the brief in two respects. The protocol hierarchy reports TCP on port 80 rather than ICMP Echo Requests, and the file holds a single frame rather than a sequence of fragments, so no reassembly step exists to perform.

The key sits in the query string rather than in a header or a request body. That placement carries its own exposure, since query strings of this shape reach proxy logs and referrer headers far more often than bodies do.

Result

FLAG{cwa2026_bc19dbefb55c0e0b}