The Searcher

Instructions

Solution

https://metaproblems.com/2bbaba9a4c07fd6e69cd31f0bd5b5312/the_searcher.pcapng

Downloaded pcap, opened in wireshark.

Ok, this is the same C2 as in the Pattern of Life challenge. I can see GETs and POSTs to /en-us/test.html. I guess I'll just google that then. I copied out Covenant and that was the flag!

Flag:

MetaCTF{Covenant}

Next: I want my files back!