Kerberos Tgs Dump

Category: FORENSICS · Difficulty: Medium · Points: 300 · Challenge: 489

Background

Domain telemetry alerted on anomalous Ticket Granting Service requests utilizing degraded encryption ciphers. The intercepted authentication handshake contains an encrypted service ticket payload. Recover the plain authorization token. FORMAT: FLAG{ }

Analysis

The capture is 177 bytes and holds a single Ethernet frame carrying one IPv4 packet and one TCP segment from 192.168.1.100 to 192.168.1.1 on port 80, with no handshake and no retransmission. Because port 80 dissects as HTTP, the payload reads directly out of the file with no stream reassembly required:

$ tshark -r traffic-047.pcap -q -z io,phs
frame                frames:1 bytes:137
  eth                frames:1 bytes:137
    ip               frames:1 bytes:137
      tcp            frames:1 bytes:137

$ strings -n 6 traffic-047.pcap
GET /endpoint?token=FLAG{cwa2026_daf641c7a9313fe7} HTTP/1.1
Host: cwa.internal

The evidence contradicts the brief. There is no Kerberos exchange on the wire, only one HTTP request, and no ASN.1 DER structure or encrypted ticket blob is present, so no RC4 or DES decryption step applies.

The key sits in the query string rather than in a header or a request body. That placement carries its own exposure, since query strings of this shape reach proxy logs and referrer headers far more often than bodies do.

Result

FLAG{cwa2026_daf641c7a9313fe7}