Challenge: Double Fried · CTF: GPN CTF 2026 · Category: Miscellaneous · Difficulty: Easy

Summary

A .pcap of RFC 5424 syslog messages leaks a flag one character per packet, but the characters arrive out of order. The packets’ Message ID field holds the true sequence — sort by it and the flag falls out. The “double-fried” theme (reverse/transposition cipher) is a red herring.

Solution

Step 1: Identify the per-character syslog stream

kitchen_log.pcap is 115 UDP syslog packets. 96 of them each carry a single flag character, but in capture order they are scrambled (GNPTC{FN0tN 1Ec ,Yuo4...). Tempting cipher ideas (pair-swap, reverse, columnar transposition) all dead-end — pair-swapping even produces the GPNCTF{ prefix but the phase is inconsistent across the string.

Dumping one packet’s full structure reveals the real ordering key:

1
2
3

Syslog message: USER.INFO: 1 2023-11-15T00:00:42.403Z kitchen-01 kitchen 1337 R0016 - G
    Message ID: R0016
    Message: G

Each char packet has a Message ID (R0016, R0017, …). Capture order is shuffled; the msgid is the intended sequence.

Step 2: Reassemble by Message ID

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

#!/usr/bin/env python3
import subprocess

PCAP = "kitchen_log.pcap"
out = subprocess.run(
    ["tshark", "-r", PCAP, "-T", "fields", "-e", "syslog.msgid", "-e", "syslog.msg"],
    capture_output=True, text=True,
).stdout.splitlines()

# Keep only the single-character payloads; they carry the flag.
pairs = []
for line in out:
    parts = line.split("\t")
    if len(parts) == 2 and len(parts[1]) == 1:
        pairs.append((parts[0], parts[1]))

# The Message ID (R0016, R0017, ...) is the true sequence.
pairs.sort(key=lambda p: p[0])
text = "".join(c for _, c in pairs)

start = text.index("GPNCTF{")
end = text.index("}", start) + 1
print("FLAG:", text[start:end])

Output:

1
2

N0t  4lm0st but n0t qu1t3. H1nt: 1t 15 m3 :)GPNCTF{N1cE, You f0UNd 0ut WHO did N07 8EL0nG theRE}
FLAG: GPNCTF{N1cE, You f0UNd 0ut WHO did N07 8EL0nG theRE}

A troll line (N0t 4lm0st but n0t qu1t3. H1nt: 1t 15 m3 :)) is interleaved and sorts ahead due to msgid wraparound — the actual flag is the GPNCTF{...} part.

Flag

1

GPNCTF{N1cE, You f0UNd 0ut WHO did N07 8EL0nG theRE}