CCT2019

---

Lab Info

Detail	Info
Room	CCT2019
Platform	TryHackMe
Difficulty	Insane / Extremely Hard
Type	CTF / Multi-Task Digital Forensics, Steganography, Cryptography, and Reverse Engineering
Knowledge Required	PCAP Analysis, USB Traffic Extraction, Steganography, Classical Ciphers, Basic Reverse Engineering, Scripting

Tools Used

• Wireshark / Tshark — PCAP and USB traffic analysis

• binwalk — Detecting and carving embedded files out of images and captures

• CyberChef — Hex-to-binary conversion, general decode/transform work

• exiftool / steghide — Metadata and steganographic extraction from images

• cnetcat — Decrypting and relaying a captured encrypted network stream

• cryptii.com — Enigma machine emulation for the historical-cipher stage

• Python — Scripting the final numeric/modulo-based decode

First Impressions

This is not a machine to root — it's a legacy assessment repackaged as a room, and it shows: four largely independent tasks, each one its own small rabbit hole of forensics, steganography, or cryptography, with almost no connective narrative between them. It's on TryHackMe's own "extremely hard" list for a reason, not because any single step is conceptually advanced, but because the room demands patience across a genuinely long chain of "extract → try as password → extract again" loops, several deliberate rabbit holes, and at least one puzzle that requires recognizing a very specific 1990s pop-culture reference to find the right password. Worth treating this less like a room to "solve" quickly and more like a scavenger hunt where the reward is the process itself.

Task 1 — USB Capture → Nested PCAP → IRC Credentials → Encrypted Stream → Flag

The provided artifact is a .pcapng file. Opening it in Wireshark shows USB Request Block (URB) traffic rather than normal network packets — data exchanged over a USB connection, captured at the protocol level.

tshark -r pcap2.pcapng -T fields -e usb.capdata > out

That pulls the raw USB payload out as hex text. Feeding it through CyberChef's "From Hex" operation converts it back into binary — which turns out to be a second, nested .pcapng file hidden inside the USB transfer of the first.

Analyzing that second capture (regular network traffic this time) turns up several threads at once — some of which are deliberate distractions:

• An HTTP request referencing a fotoforensics.com analysis link. Chasing it down to the original image is a legitimate find, but a dead end — a rabbit hole built into the room rather than a real lead.

• IRC traffic carrying a recovered username/nickname pair and password.

• Unanswered ICMP traffic that, on closer inspection, contains an actual conversation between two people discussing a password reference — and, notably, a mention of transferring a file over port 4444, encrypted with cryptcat.

Following that lead specifically: extracting the port-4444 stream from the capture and feeding it into cryptcat with the password recovered from the ICMP conversation decrypts it into a usable file:

cryptcat -vv -k <recovered_password> -l -p 4444 > decrypted_file

Reverse-engineering the decrypted file shows it attempts a DNS lookup for a custom hostname. Adding that hostname to /etc/hosts pointed at localhost, then standing up a listener on the IRC port it expects:

nc -lvnp 6667

Running the file causes it to connect back, and the resulting IRC-style traffic hands over the task's flag directly in the exchange.

Task 2 — A .NET Logic Puzzle

A different kind of challenge entirely — no forensics here, just reading decompiled .NET source and solving the condition it gates the flag behind. The relevant if statement requires four numbers whose sum equals 711 and whose product equals 7,110,000 simultaneously. Solved with straightforward algebra (factoring the target product to narrow the plausible value range, then checking combinations against the sum constraint) rather than any tool — a reminder that not every task in a room like this is a "run a tool" exercise.

Task 3 — Layered Steganography and an Enigma Machine

Starting from a provided image, binwalk confirms there's more embedded inside it than meets the eye. exiftool on the same image turns up Morse code hidden in the description metadata field — decoding it produces a short phrase that turns out to be the password for a ZIP archive binwalk had already flagged as embedded.

Extracting that ZIP produces a taunting in-character note (styled after The Matrix's Morpheus) which contains a second password, plus a hint that there's more still hidden in the original image via steghide:

steghide -extract -sf <original_image>

That pulls out a further archive containing cipher.txt and config.txt. Getting into that archive first requires a third password — recovered this time from analyzing the image's luminescence/brightness gradient directly (an unusual, very manual steganography technique rather than a standard tool run).

Once inside, cipher.txt holds ciphertext and config.txt holds rotor/plugboard settings for a historical cipher machine. Cross-referencing the configuration format against cryptii.com's emulator options identifies the specific variant in play — an Enigma M4 ("Shark"), the four-rotor U-boat variant. Plugging the settings from config.txt into the emulator decodes the ciphertext into the final password needed for the task's last archive.

Task 4 — Three Chained Classical/Custom Ciphers

The last task is explicitly three sequential sub-puzzles, each pairing a clue file with an encoded one:

1. Keyboard layout substitution — the ciphertext isn't a traditional cipher at all, but text typed on one keyboard layout and read back on another (e.g., QWERTY vs a different regional layout), requiring conversion between the two to recover the plaintext.

2. OSINT-derived key + rail fence cipher — the clue points toward a specific YouTube video; something referenced in or around that video supplies the decryption key, which then unlocks text encoded with a classical rail fence cipher.

3. Custom numeric/modulo encoding — the final file encodes its message as a sequence of single digits (0–6). Recovering the plaintext requires writing a small script to reverse the transform: applying a modulo operation to reconstruct binary values from the digit sequence, then converting that binary back to ASCII to reveal the final flag.

Flag Summary

Task	Core Technique
Task 1	Nested PCAP extraction (USB → hex → second capture) → ICMP conversation → cryptcat-decrypted payload → IRC-triggered flag
Task 2	Algebraic solving of a .NET conditional (sum/product constraint on four unknowns)
Task 3	Layered steganography (Morse-in-EXIF → steghide → luminescence analysis) culminating in an Enigma M4 decode
Task 4	Three chained puzzles: keyboard-layout substitution, OSINT-sourced rail fence key, custom modulo/binary decode

(Specific passwords, hex blobs, and flag values are per-artifact and are not reproduced here — each task's actual files should be downloaded fresh from your own room instance.)

Key Takeaways

1. Not everything nested inside a file is meant to lead somewhere. Task 1's fotoforensics.com lead was a legitimate discovery that turned out to be a deliberate rabbit hole — recognizing when a thread has stopped producing new information is as important a skill as finding the thread in the first place.

2. Multi-protocol traffic in a single capture is worth reviewing methodically rather than all at once. HTTP, IRC, and ICMP each held a different piece of the puzzle in Task 1 — jumping straight to the "interesting-looking" protocol and stopping there would have missed the actual solution path in the ICMP conversation.

3. Steganography rooms tend to layer techniques rather than using one. Task 3 alone combined EXIF metadata, a Morse-coded hint, steghide's LSB-style extraction, and a manual brightness-gradient read — worth checking an image against multiple stego techniques before concluding there's nothing left to find.

4. Not every "hard" step is a tool-driven one. Task 2's entire solution was pen-and-paper algebra against decompiled source — a good reminder that reverse engineering sometimes means reading logic carefully, not running a decompiler and hoping the answer falls out.

5. Classical and constructed ciphers (rail fence, keyboard substitution, custom modulo encodings) still show up in modern CTFs specifically to test whether foundational cryptography concepts are solid, independent of any tool — worth keeping a mental library of classical cipher shapes so an unfamiliar-looking ciphertext can at least be categorized correctly before reaching for a specific tool.

6. A room like this rewards logging every password and intermediate artifact as you go, since later stages frequently reuse or build on something extracted several steps earlier rather than being fully self-contained.

Day 27 of 30 ✅ — See You Tomorrow