Description#

A network packet capture file containing hidden encrypted data.

Analysis#

First, examine the pcap file to find any interesting data:

strings kabelhiu.pcapng | grep -iE "[a-zA-Z0-9+/=]{20,}"

This reveals a Base64 encoded string in the packet data:

VmxSQ1QxWkdSalpUVkVwc1RWWktkbFJXYUU5YWF6RlpWRzFhV21Gc1JYaFVWRVUwVFdzMVIwOUVSazVXZWtZeldXdFNUMDlSUFQwPQ==

Solution#

The hint “2x2=4” tells us there are 4 layers of Base64 encoding.

# Layer 1
echo "VmxSQ1QxWkdSalpUVkVwc1RWWktkbFJXYUU5YWF6RlpWRzFhV21Gc1JYaFVWRVUwVFdzMVIwOUVSazVXZWtZeldXdFNUMDlSUFQwPQ==" | base64 -d
# Output: VlRCT1ZGRjZTVEpsTVZKdlRWaE9aazFZVG1aWmFsRXhUVEU0TWs1R09ERk5WekYzWWtST09RPT0=

# Layer 2
echo "VlRCT1ZGRjZTVEpsTVZKdlRWaE9aazFZVG1aWmFsRXhUVEU0TWs1R09ERk5WekYzWWtST09RPT0=" | base64 -d
# Output: VTBOVFF6STJlMVJvTVhOZk1YTmZZalExTTE4Mk5GODFNVzF3YkROOQ==

# Layer 3
echo "VTBOVFF6STJlMVJvTVhOZk1YTmZZalExTTE4Mk5GODFNVzF3YkROOQ==" | base64 -d
# Output: U0NTQzI2e1RoMXNfMXNfYjQ1M182NF81MW1wbDN9

# Layer 4
echo "U0NTQzI2e1RoMXNfMXNfYjQ1M182NF81MW1wbDN9" | base64 -d
# Output: SCSC26{Th1s_1s_b453_64_51mpl3}

One-liner solution:

echo "VmxSQ1QxWkdSalpUVkVwc1RWWktkbFJXYUU5YWF6RlpWRzFhV21Gc1JYaFVWRVUwVFdzMVIwOUVSazVXZWtZeldXdFNUMDlSUFQwPQ==" | base64 -d | base64 -d | base64 -d | base64 -d