https://vanirrr.tech/tags/pcap/Recent content in Pcap on vanir's blogHugoen-usSat, 01 Aug 2026 11:12:45 +0100https://vanirrr.tech/writeups/spirit/Sat, 01 Aug 2026 11:12:45 +0100https://vanirrr.tech/writeups/spirit/<h1 id="spirit--minecraft-pcap-forensics-ctf">spirit — Minecraft PCAP forensics CTF</h1> <p>i made this challenge for the ITC CTF 2026.</p> <h2 id="flag">Flag</h2> <p>ITC{ANTI_ENS_LIVES_ON!} (case insensitive ig)</p> <h2 id="capture">Capture</h2> <ul> <li>protocol 772, offline-mode (<code>online-mode=false</code>), login name <code>vanir</code></li> <li>flag = block geometry, NOT text. 208 Use Item On (0x3f) packets, client-&gt;server</li> <li>placed blocks at y=70, band z=-253..-249, X 96..199</li> <li>art reads ROTATED 180 from map orientation (north-up/east-right shows it inverted)</li> <li>s2c stream has 24 capture gaps (~37KB) — Block Update path unreliable, use c2s</li> <li>c2s stream frames 100% cleanly — this is the intended solve</li> </ul> <h2 id="decoys-intentionally-greppable">Decoys (intentionally greppable)</h2> <ul> <li><code>ITC{never_easy}</code> (sign)</li> <li><code>ITC{fake_flag}</code> (sign)</li> <li>base64 <code>SVRDe3N0b3BfZ3JlcHBpbmdfYnVkZHl9</code> -&gt; <code>ITC{stop_grepping_buddy}</code> (book)</li> <li>real flag must NOT appear in <code>strings</code> — verified</li> </ul> <h2 id="solve">Solve</h2> <p>the player is given a pcap of traffic generated by a player client to a minecraft server (ran on my vps)<br> description:</p>