CSA CTF 2019 - Kimi No Na Wa

The attached file is pcap file, and it is the packets of any suspicious communication.

I focused about , there are lots of DNS queries.

So I suspected DNS tunneling.

By using wireshark, filter the packets by this criteria : dns && ip.dst==192.168.196.1

-> I found there are too many DNS queries which inquiring about "xxxxxxxxx.evil.corp".

I saved this result to text file, and the trim the sub-domain part of the string,

then I got following result.(It seems base64 encoded string.)

QXQgdGhlIG5leHQgc3RvcCwgSSBzcHJpbnQgb2ZmIHRoZSB0cmFpbiBhbmQgc3RhcnQgcnVubmluZyB3aWxkbHkgYXJvdW5kIHRoZSBzdHJlZXRzLCBzZWFyY2hpbmcgZm9yIGhlci4gSSBrbm93IHRoYXQgc2hlIGlzIHNlYXJjaGluZyBmb3IgbWUgcmlnaHQgbm93IGluIHRoZSBzYW1lIHdheS4KQ1NBQ1RGewpXZSBoYWQgbWV0IGJlZm9yZS4gT3IgbWF5YmUgdGhhdCB3YXMganVzdCBhIGZlZWxpbmcuIEp1c3QgYSBkcmVhbS4gQSBkZWx1c2lvbiBmcm9tIGEgcGFzdCBsaWZlLiBCdXQgc3RpbGwsIHdlIGhhZCB3YW50ZWQgdG8gYmUgdG9nZXRoZXIgZm9yIGp1c3QgYSBsaXR0bGUgbG9uZ2VyLiBXZSB3YW50IHRvIGJlIHRvZ2V0aGVyIGZvciBqdXN0IGEgbGl0dGxlIGxvbmdlci4KUzBycnlfCkFzIEkgc3ByaW50IHVwIGEgaGlsbHkgcm9hZCwgSSB3b25kZXIuIFdoeSBhbSBJIHJ1bm5pbmc/IFdoeSBhbSBJIGxvb2tpbmcgZm9yIGhpbT8gU29tZXdoZXJlIGRlZXAgZG93biwgSSBwcm9iYWJseSBhbHJlYWR5IGtub3cgdGhlIGFuc3dlcnMgdG8gdGhvc2UgcXVlc3Rpb25zLiBNeSBtaW5kIGRvZXNu4oCZdCByZW1lbWJlciB0aGVtLCBidXQgbXkgYm9keSBkb2VzLiBJIHR1cm4gb3V0IG9mIGEgdGhpbiBhbGxleSBhbmQgdGhlIHJvYWQgYWJydXB0bHkgZW5kcy4gQSBzdGFpcmNhc2UuIEkgd2FsayB1cCB0byB0aGUgZWRnZSBhbmQgbG9vayBkb3duLiBIZSBpcyB0aGVyZS4KZjByXwpGaWdodGluZyBiYWNrIHRoZSB1cmdlIHRvIGJ1cnN0IG91dCBydW5uaW5nLCBJIHNsb3dseSBtYWtlIG15IHdheSB1cCB0aGUgc3RhaXJzLiBBIHdpbmQgYmxvd3MgYnksIGNhcnJ5aW5nIHRoZSBzY2VudCBvZiBmbG93ZXJzIGFuZCBwdWZmaW5nIHVwIG15IHN1aXQuIFNoZSBpcyBzdGFuZGluZyBhdCB0aGUgdG9wLiBVbmFibGUgdG8gbG9vayBhdCBoZXIgZGlyZWN0bHksIEkgdHVybiBteSBoZWFkIGp1c3QgY2xvc2UgZW5vdWdoIHNvIHRoYXQgaGVyIHByZXNlbmNlIHJlZ2lzdGVycyBpbiBteSBwZXJpcGhlcmFsIHZpc2lvbi4gVGhhdCBwcmVzZW5jZSBiZWdpbnMgdG8gd2FsayBkb3duIHRoZSBzdGFpcnMuIEhlciBmb290c3RlcHMgcmluZyB0aHJvdWdob3V0IHRoZSBzcHJpbmcgYWlyLiBNeSBoZWFydCBkYW5jZXMgd2lsZGx5IHdpdGhpbiBteSByaWJjYWdlLgpzcDBsMW5nIV8KV2Ugc2xvd2x5IGRyYXcgY2xvc2VyIHRvIGVhY2ggb3RoZXIsIG91ciBleWVzIGNhc3QgZG93bi4gSGUgc2F5cyBub3RoaW5nLCBhbmQgSSB0b28gZmFpbCB0byBmaW5kIGFueSB3b3Jkcy4gU3RpbGwgcmVtYWluaW5nIHNpbGVudCwgd2UgcGFzcyBlYWNoIG90aGVyLiBJbiB0aGF0IG1vbWVudCwgbXkgZW50aXJlIGJvZHkgYWNoZXMgYXMgaWYgc29tZW9uZSBoYWQgcmVhY2hlZCBpbiBhbmQgZ3JhYmJlZCBteSBoZWFydC4gVGhpcyBpcyBub3QgcmlnaHQsIEkgdGhpbmsgc3Ryb25nbHkuIFRoZXJlIGlzIG5vIHdheSB0aGF0IHdlIGFyZSBzdHJhbmdlcnMuIFRoYXQgd291bGQgZ28gYWdhaW5zdCBhbGwgdGhlIGxhd3Mgb2YgdGhlIHVuaXZlcnNlIGFuZCBvZiBsaWZlLgoxZl95MHVfaDR2ZV9uMHQsXwpTbyBJIHR1cm4gYXJvdW5kLiBXaXRoIHRoZSBleGFjdCBzYW1lIHNwZWVkLCBzaGUgdG9vIHR1cm5zIGFyb3VuZCBhbmQgbG9va3MgYXQgbWUuIFNoZSBpcyBzdGFuZGluZyBvbiB0aGUgc3RhaXJzLCBleWVzIG9wZW4gd2lkZSwgdGhlIGNpdHkgb2YgVG9reW8gYmVoaW5kIGhlciBiYWNrLiBJIG5vdGljZSB0aGF0IGhlciBoYWlyIGlzIHRpZWQgd2l0aCBhIHN0cmluZyB0aGUgY29sb3Igb2Ygc3Vuc2V0LiBNeSBlbnRpcmUgYm9keSBzaGFrZXMuCmcwXwpXZSBtZXQuIFdlIGZpbmFsbHkgbWV0LiBCeSB0aGUgdGltZSBJIHRoaW5rIHRoYXQgSeKAmW0gYWJvdXQgdG8gY3J5LCB0ZWFycyBoYXZlIGFscmVhZHkgc3RhcnRlZCBmYWxsaW5nLiBIZSBzZWVzIHRoYXQgYW5kIHNtaWxlcy4gSSByZXR1cm4gdGhlIHNtaWxlIGFzIEkgd2VlcCwgYW5kIHRha2UgYSBkZWVwIGJyZWF0aCBvZiB0aGUgZnJlc2ggc3ByaW5nIGFpci4KdzR0Y2hfMXQhfQpBbmQgdGhlbiwgYXQgdGhlIHNhbWUgdGltZSwgd2Ugb3BlbiBvdXIgbW91dGhzLCBoYXJtb25pemluZyBvdXIgdm9pY2VzIGxpa2UgY2hpbGRyZW4gZG9pbmcgYSBjaGVlci4KCuKAnFlvdXIgbmFtZT/igJ0K

After decode it, I got the sentence which contains the flag.

*************************************************************

At the next stop, I sprint off the train and start running wildly around the streets, searching for her. I know that she is searching for me right now in the same way.
CSACTF{
We had met before. Or maybe that was just a feeling. Just a dream. A delusion from a past life. But still, we had wanted to be together for just a little longer. We want to be together for just a little longer.
S0rry_
As I sprint up a hilly road, I wonder. Why am I running? Why am I looking for him? Somewhere deep down, I probably already know the answers to those questions. My mind doesn’t remember them, but my body does. I turn out of a thin alley and the road abruptly ends. A staircase. I walk up to the edge and look down. He is there.
f0r_
Fighting back the urge to burst out running, I slowly make my way up the stairs. A wind blows by, carrying the scent of flowers and puffing up my suit. She is standing at the top. Unable to look at her directly, I turn my head just close enough so that her presence registers in my peripheral vision. That presence begins to walk down the stairs. Her footsteps ring throughout the spring air. My heart dances wildly within my ribcage.
sp0l1ng!_
We slowly draw closer to each other, our eyes cast down. He says nothing, and I too fail to find any words. Still remaining silent, we pass each other. In that moment, my entire body aches as if someone had reached in and grabbed my heart. This is not right, I think strongly. There is no way that we are strangers. That would go against all the laws of the universe and of life.
1f_y0u_h4ve_n0t,_
So I turn around. With the exact same speed, she too turns around and looks at me. She is standing on the stairs, eyes open wide, the city of Tokyo behind her back. I notice that her hair is tied with a string the color of sunset. My entire body shakes.
g0_
We met. We finally met. By the time I think that I’m about to cry, tears have already started falling. He sees that and smiles. I return the smile as I weep, and take a deep breath of the fresh spring air.
w4tch_1t!}
And then, at the same time, we open our mouths, harmonizing our voices like children doing a cheer.

“Your name?”

  *******************************************************

The flag is : CSACTF{S0rry_f0r_sp0l1ng!_1f_y0u_h4ve_n0t,_g0_w4tch_1t!}