spirit - Minecraft pcap forensics
spirit — Minecraft PCAP forensics CTF i made this challenge for the ITC CTF 2026. Flag ITC{ANTI_ENS_LIVES_ON!} (case insensitive ig) Capture protocol 772, offline-mode (online-mode=false), login name vanir flag = block geometry, NOT text. 208 Use Item On (0x3f) packets, client->server placed blocks at y=70, band z=-253..-249, X 96..199 art reads ROTATED 180 from map orientation (north-up/east-right shows it inverted) s2c stream has 24 capture gaps (~37KB) — Block Update path unreliable, use c2s c2s stream frames 100% cleanly — this is the intended solve Decoys (intentionally greppable) ITC{never_easy} (sign) ITC{fake_flag} (sign) base64 SVRDe3N0b3BfZ3JlcHBpbmdfYnVkZHl9 -> ITC{stop_grepping_buddy} (book) real flag must NOT appear in strings — verified Solve the player is given a pcap of traffic generated by a player client to a minecraft server (ran on my vps) description: ...