Upload files to "/"

manifest.yml

@@ -0,0 +1,11 @@
+slug: master_of_sea
+title: "Master of Sea"
+description: "New iOS malware just dropped! Santa's office was under attack, turns out most of Elfs use iPhones that were infected. Can you analyze the network traffic and find out what data the malware is exfiltrating?"
+category: "networking"
+points: 500
+is_visible: true
+complexity: 5
+attachments:
+  - "public/dump.pcapng"
+  - "public/wall.jpg"
+flag_plaintext: "CTF{s34sh3ll_1s_n0t_th4t_d4ng3r0us}"

replace.py

@@ -0,0 +1,86 @@
+#!/usr/bin/env python3
+from scapy.all import rdpcap, wrpcap, Raw, IP, IPv6, TCP, UDP
+import argparse
+
+SEARCH = b"EntySec"
+REPLACE = b"CTF"
+
+def patch_packet(pkt):
+    """
+    If the packet Raw payload contains 'EntySec', replace it with 'CTF'
+    and clear checksums/lengths for recalculation.
+    Returns (pkt, modified: bool).
+    """
+    if Raw not in pkt:
+        return pkt, False
+
+    raw = pkt[Raw]
+    data = raw.load
+
+    if SEARCH not in data:
+        return pkt, False
+
+    new_data = data.replace(SEARCH, REPLACE)
+
+    # If somehow nothing changed, mark as not modified
+    if new_data == data:
+        return pkt, False
+
+    raw.load = new_data
+
+    # Clear checksums/lengths so Scapy recalculates them on write
+    if IP in pkt:
+        ip = pkt[IP]
+        if hasattr(ip, "len"):
+            del ip.len
+        if hasattr(ip, "chksum"):
+            del ip.chksum
+
+    if IPv6 in pkt:
+        ipv6 = pkt[IPv6]
+        if hasattr(ipv6, "plen"):
+            del ipv6.plen
+
+    if TCP in pkt:
+        tcp = pkt[TCP]
+        if hasattr(tcp, "chksum"):
+            del tcp.chksum
+
+    if UDP in pkt:
+        udp = pkt[UDP]
+        if hasattr(udp, "len"):
+            del udp.len
+        if hasattr(udp, "chksum"):
+            del udp.chksum
+
+    return pkt, True
+
+def main():
+    parser = argparse.ArgumentParser(
+        description="Replace 'EntySec' with 'flag' in PCAP payloads"
+    )
+    parser.add_argument("input", help="Input pcap/pcapng file")
+    parser.add_argument("output", help="Output pcap/pcapng file")
+    args = parser.parse_args()
+
+    print(f"[+] Reading packets from {args.input} ...")
+    pkts = rdpcap(args.input)
+
+    new_pkts = []
+    modified_count = 0
+
+    for idx, pkt in enumerate(pkts):
+        new_pkt, modified = patch_packet(pkt)
+        if modified:
+            modified_count += 1
+            # Optional debug:
+            # print(f"[+] Modified packet #{idx}")
+        new_pkts.append(new_pkt)
+
+    print(f"[+] Modified {modified_count} packet(s)")
+    print(f"[+] Writing patched capture to {args.output} ...")
+    wrpcap(args.output, new_pkts)
+    print("[+] Done.")
+
+if __name__ == "__main__":
+    main()