Skip to content

Jack_in_with_Chaptain.md

Latest commit

 

History

History
258 lines (182 loc) · 6.76 KB

Jack_in_with_Chaptain.md

File metadata and controls

258 lines (182 loc) · 6.76 KB

Write-up — Jack in with Chaptain (Forensics / RADIUS / VPN)

Category: Forensics / Network Difficulty: Medium

To connect to the Matrix, Neo and his friends are using a new portal for jacking in. However, a legacy portal that's vulnerable remains active. Recently, someone has successfully accessed the system through it, and you need to identify the user.

Flag format: HACKDAY{secret@user@password}

1. Provided Files

In the challenge directory:

$ ls -al
total 304
drwxr-xr-x 2 fox fox   4096 Jan 24 12:41 .
drwxr-xr-x 3 fox fox   4096 Jan 24 12:41 ..
-rw-rw-rw- 1 fox fox   7714 Jan 23 02:29 gateway.bak
-rw-rw-rw- 1 fox fox 291406 Jan 23 02:29 LAN_Traffic.pcap

File types:

$ file *
gateway.bak:      XML 1.0 document, ASCII text, with very long lines (7692)
LAN_Traffic.pcap: pcap capture file, microsecond ts (little-endian) - version 2.4 (Ethernet, capture length 262144)
  • gateway.bak — looks like a pfSense backup / configuration, but its content is base64-encoded XML.
  • LAN_Traffic.pcap — packet capture containing LAN traffic (likely VPN/RADIUS traffic as hinted by the description).

2. Decoding the pfSense Configuration

Opening gateway.bak:

$ cat gateway.bak
<?xml version="1.0"?>
PHBmc2Vuc2U+Cgk8dmVyc2lvbj4yNC4wPC92ZXJzaW9uPgoJPGxhc3RjaGFuZ2U+PC9sYXN0Y2hhbmdlPgoJPHN5c3RlbT4KCQk8b3B0aW1pemF0aW9uPm5vcm1hbDwvb3B0aW1pemF0aW9uPgoJCTxob3N0
...
[very long base64 blob]
...
PC9wZnNlbnNlPgo=

The first line is a normal XML header, then the rest is clearly base64.

We decode everything except the XML header line:

$ tail -n +2 gateway.bak | base64 -d > gateway.xml

gateway.xml is now a readable pfSense configuration file.

3. Key Information from gateway.xml

3.1 RADIUS / VPN Configuration

Looking through the XML, we find:

  • L2TP/IPsec VPN configuration.

  • Two RADIUS authentication servers defined:

    • NPS-AD-VPN using MSCHAPv2 (modern, more secure).
    • NPS-AD-Legacy using PAP (legacy, weak, vulnerable — matches the challenge story).

We also see some test credentials and shared secrets.

Example (simplified):

  • One server with secret 123456 (standard test value).
  • Another, more interesting one with:
<!-- Rotation to the forbidden --!>
<radius_secret>Y3t4plBar!fa3b</radius_secret>

This is clearly the “legacy” secret the challenge is hinting at. The comment Rotation to the forbidden suggests ROT13.

Applying ROT13 to that secret:

$ echo 'Y3t4plBar!fa3b' | tr 'A-Za-z' 'N-ZA-Mn-za-m'
L3g4cyOne!sn3o

So the actual RADIUS shared secret for the legacy server is:

  • L3g4cyOne!sn3o

The literal string before ROT13 (Y3t4plBar!fa3b) is just an obfuscated form.

4. Analyzing the Network Capture (LAN_Traffic.pcap)

We know from the config and story:

  • There is a legacy RADIUS-based VPN portal.
  • Protocol: RADIUS (UDP/1812) with PAP (password susceptible to recovery).
  • Our task is to find who successfully authenticated through it, and with what credentials.

4.1 Quick Overview with tshark

We are interested in RADIUS Access-Request packets:

$ tshark -r LAN_Traffic.pcap -Y "radius.code == 1" \
  -T fields -e radius.User_Name -e radius.User_Password
trinity
tank
theoracle
cypher
cypher  ��U��\n��A�
cypher
cypher  /�9�&�Ͷ��͝k0�
cypher
cypher  #����o¸�ĝ=���
n3o
n3o    �=�,ۣX3ɫ\t�>
cypher
neo
switch
morpheus

Observations:

  • Multiple users from the Matrix universe: trinity, tank, theoracle, cypher, n3o, neo, switch, morpheus.
  • For some entries, User_Password appears as binary-looking junk. That is the RADIUS encrypted password.

To decrypt it, tshark needs to know the RADIUS shared secret.

4.2 First Attempt with the Raw Secret

We try providing the original secret from XML (Y3t4plBar!fa3b) to tshark:

$ echo '192.168.58.101:Y3t4plBar!fa3b' > radius_secrets

$ tshark -r LAN_Traffic.pcap -Y "radius.code == 1" \
  -o 'radius.shared_secret:Y3t4plBar!fa3b' \
  -T fields -e radius.User_Name -e radius.User_Password
trinity
tank
theoracle
cypher
cypher  ��U��\n��A�
cypher
cypher  /�9�&�Ͷ��͝k0�
cypher
cypher  #����o¸�ĝ=���
n3o
n3o    �=�,ۣX3ɫ\t�>
cypher
neo
switch
morpheus

Result: still encrypted garbage. So this is not the correct shared secret used in the capture.

4.3 Using the ROT13’d Secret

We now use the secret derived from the comment Rotation to the forbidden:

$ echo '192.168.58.101:L3g4cyOne!sn3o' > radius_secrets

$ tshark -r LAN_Traffic.pcap -Y "radius.code == 1" \
  -o 'radius.shared_secret:L3g4cyOne!sn3o' \
  -T fields -e radius.User_Name -e radius.User_Password
trinity
tank
theoracle
cypher
cypher  cypher
cypher
cypher  cypher
cypher
cypher  cypher
n3o
n3o    ImTheOne4242!!
cypher
neo
switch
morpheus

Now tshark can successfully decrypt PAP passwords:

  • For user cypher, the password fields decrypt to cypher (as expected, he is not very imaginative).

  • For user n3o, one Access-Request entry shows:

    • User_Name: n3o
    • User_Password: ImTheOne4242!!

This clearly corresponds to the successful login via the legacy portal.

5. Identifying the Compromised Session

The challenge asks:

someone has successfully accessed the system through the legacy portal, and you need to identify the user.

From the decrypted RADIUS traffic on the legacy server:

  • Shared secret (legacy portal): L3g4cyOne!sn3o
  • User who logged in: n3o
  • Password used: ImTheOne4242!!

This matches the Matrix theme (Neo being “The One”).

6. Constructing the Flag

Flag format:

HACKDAY{secret@user@password}

We use:

  • secret → L3g4cyOne!sn3o
  • user → n3o
  • password→ ImTheOne4242

(Depending on the exact expected format, some instances keep or drop the trailing !!. In the working solution used here, the flag is:)

HACKDAY{L3g4cyOne!sn3o@n3o@ImTheOne4242}

7. Summary of the Exploitation Chain

  1. Decode pfSense backup (gateway.bak) into gateway.xml via base64.

  2. Inspect RADIUS/VPN configuration:

    • Identify a legacy RADIUS server using PAP.
    • Observe the commented hint <!-- Rotation to the forbidden --> and radius_secret value.

  3. Apply ROT13 to Y3t4plBar!fa3b → L3g4cyOne!sn3o.

  4. Provide this secret to tshark/Wireshark to decrypt RADIUS User-Password fields.

  5. Inspect Access-Request packets:

    • Find user n3o with cleartext password ImTheOne4242!!.

  6. Build the flag as HACKDAY{L3g4cyOne!sn3o@n3o@ImTheOne4242}.

This demonstrates how misconfigured legacy authentication (PAP + shared secret) combined with poor secret management and embedded hints in configuration backups lead directly to credential disclosure from network captures.