Sensor Confession: ICS Telemetry Protocol Exfiltration

In “Sensor Confession,” participants are thrown into a network forensics scenario involving anomalous traffic originating from industrial control sensors. The challenge required filtering through the noise of a massive PCAP file to find the specific protocol abuse used by the attacker to leak data.

Stage 1: PCAP Triage & Protocol Analysis

Using Wireshark and tshark, we filtered out standard TCP handshakes and focused on non-zero urgent pointer fields originating from the sensor subnet. The attacker exploited the TCP Urgent PointerA field in the TCP header historically intended to prioritize data, rarely used today, making it suited for covert data exfiltration. field, typically unused in modern networks, to leak the flag byte-by-byte across consecutive packets.

$ tshark -r capture.pcap -Y "ip.src == 10.0.5.55 && tcp.urgent_pointer > 0" -T fields -e tcp.urgent_pointer | head -n 8

# Output (Hexadecimal values of ASCII chars):
41 // 'A'
53 // 'S'
43 // 'C'
57 // 'W'
47 // 'G'
7b // '{'
74 // 't'
33 // '3'

import pyshark

# Extract TCP urgent pointer bytes across the sensor conversation
cap = pyshark.FileCapture('sensor_dump.pcap', display_filter='ip.src == 10.0.5.55 && tcp.urgent_pointer > 0')

flag_chars = []
for pkt in cap:
    try:
        urg_val = int(pkt.tcp.urgent_pointer)
        flag_chars.append(chr(urg_val))
    except AttributeError:
        continue

flag = ''.join(flag_chars)
print("[+] Reconstructed Sensor Flag:", flag)

Constructing the Final Flag

The flag wasn't sitting in plain text in a single packet. It was fragmented across thousands of packets and smuggled within the TCP urgent pointer field. By extracting this specific field across the entire conversation stream, we rebuilt the original binary payload.