PI 1: Magic in the air

Open the pcap, add data to the columns by clicking on the packet bytes and right click > Apply to column where it it highlights. Remove the other columns then go to File > Export Packet > Dissections > As CSV. Remove the odd data such as Value, the white space and the odd data parts. Remove the speech marks with 'sed -i 's/"//g' . Then run this script on it

The output will have the number.

Flag: rgbCTF{+46736727859}

Download Run zsteg

Flag: rgbCTF{y0u_c4n_d0wnl04d_th1s}

Run the file on a sstv program such as Robot36 on Android.

Flag: rgbctf{s10w_2c4n_1s_7h3_W4V3}

First things first, we saved the phone number, and saw if it synced with any social medias. It gave an instagram (https://www.instagram.com/donnylockheart9/?hl=en). The first thing to do: check the highlights. The highlights reveal to us a few things, his full name and his city.

He also left a boarding pass on there, with him flying into Amsterdam on Friday 17th, at 1:45 pm. Using my aviation nerd skills, I searched up flights arriving into schipol at 1.45 pm, and i got the flight number.

Slapping together everything in a flag form, we get

Flag: rgbCTF{donovanlockheart:birmingham:gb:kl1426}

This is the url needed to solve the challenge:

rgbCTF{bird}