Sopromed: Metro — avitoctf

Description

A student captured the traffic of Professor Barsukov repeatedly attempting to log into the university LMS over open metro Wi-Fi while carriage movement caused typing errors. Given PCAP sopromed_capture.pcap and live LMS instance, recover access to the professor account.

The capture contains many failed login attempts made over plaintext HTTP. The goal is to reconstruct the intended password from the professor's independent typing errors, authenticate normally, and inspect the teacher dashboard.

PCAP Triage

First, preserve the artifact identity and inspect its basic structure:

shasum -a 256 sopromed_capture.pcap
capinfos -c sopromed_capture.pcap
tshark -r sopromed_capture.pcap -q -z io,phs

The SHA-256 is:

46b6970704f7082559b4242a7d0ecb9bba71c2b4464285d8ef03ea2bc8d43432

The capture has 960 Ethernet packets and contains HTTP carrying JSON. Filtering on the login route isolates the relevant requests:

tshark -r sopromed_capture.pcap \
  -Y 'http.request.method == "POST" && http.request.uri == "/api/auth/login"' \
  -T fields -e http.file_data > login_bodies.txt

There are 96 request bodies. Every body names prof_barsukov, and every supplied password is exactly 19 characters long. Wireshark versions commonly render the byte-valued http.file_data field as hexadecimal, so the solver below handles both hexadecimal and directly rendered JSON.

The corresponding evidence rules out session replay:

tshark -r sopromed_capture.pcap -Y 'http.response.code == 401' \
  -T fields -e frame.number -e http.response.code

tshark -r sopromed_capture.pcap -Y 'http.cookie || http.set_cookie' \
  -T fields -e http.cookie -e http.set_cookie

All 96 captured login responses have status 401, while the cookie filter returns no requests or responses. There is therefore no authenticated session in the PCAP to reuse.

Analysis

The narrative says carriage movement caused typing errors. This suggests that each observed 19-character password is a noisy version of one fixed intended password. Because all attempts have equal length, align them by character position.

...