← All writeups

Network

Magic Packet Ride

Event: CDDC 2026 Category: Network / Forensics Flag: CDDC2026{@_wh0le_n3w_world}

Challenge

While investigating the Rift, Defender discovered a record of communication between "Aladdin" and "Genie".

Find the pattern of the summoning spell used by Aladdin in the PCAP, then connect to Genie's new hideout (cddc2026-challs-alb-2050157501.ap-southeast-1.elb.amazonaws.com:31337) and obtain Genie's Response.

  • A message cannot be delivered to Genie over UDP.
  • Genie only responds to HTTP POST requests.
  • The spell must be placed in the body exactly as it is, without any error.
  • A reply will be given by Genie only to the one who knows the true Code.

Provided file: cave.pcap.

TL;DR

The "spell" is not just a string — it is a full ICMP Echo Request packet with non-standard code = 1, carrying the payload GENI5 + 4 bytes + Ma9icLAMP + message.

To talk to Genie's new hideout you take the entire raw ICMP packet bytes (type/code/checksum/id/seq/data) and POST them as the HTTP request body.

Recon — PCAP analysis

The capture is ~17.8k packets, mostly noise (mDNS, SSDP, fake HTTP, fake auth flows). Two facts stand out:

  1. ICMP type/code distribution is unusual:

    (type=8, code=0): 610   <- normal echo-request
(type=8, code=1): 222   <- non-standard code
(type=8, code=2):   3   <- non-standard code
(type=0, code=0):   7   <- echo-reply (only 7!)

    Code 1 and code 2 are not valid for ICMP echo. That's a signal.

  2. Pairing each echo-reply with its echo-request (matching id+seq) gives the seven conversations Aladdin had with Genie:

    REQ  GENI5 ff ff ff ff Ma9icLAMP ff*20
REPL "The ancient spell... After all this time. Welcome back, master."

REQ  GENI5 d1 89 59 95 Ma9icLAMP GENIE!! I finally found you!
REPL "Aladdin! My best friend! I thought you'd never come back!"

REQ  GENI5 73 bf a3 a3 Ma9icLAMP I missed you so much. Are you okay?
REPL "I'm okay now that you're here. But things are changing..."

... (and so on — Genie warns he's moving to a new realm) ...

REPL "I still listen the same way. Wrap your spell just as before
      and knock on my new door."
REPL "I'll be waiting for you, always. Find me, Aladdin."

    Every request that earned a reply has ICMP code = 1. The three packets with code = 2 (e.g. "GENIE! GENIE! Let me in!") were ignored even though the data payload looked correct. That confirms: the "true Code" Headquarters referenced is the ICMP Code field, set to 1.

Spell payload structure

+--------+---------+-----------+-----------+
| GENI5  | 4 bytes | Ma9icLAMP | message...|
+--------+---------+-----------+-----------+

The 4 middle bytes look like a per-message nonce/signature, but the very first "ancient spell" packet (the test ping) used ff ff ff ff for those bytes and ff for the entire message — and it worked. So either the field is not strictly validated, or ff ff ff ff is a known "test" value the server accepts. Either way, that exact packet is a known-good spell we can replay.

Pivot — talking to the new hideout

Initial probes:

GET  /        -> 200 "ready"
POST /        with random body  -> 400
POST /lamp    with random body  -> 400
POST /<anything> with a "spell-shaped" body (just GENI5...Ma9icLAMP + text)
                                -> 404

So the server parses the body. Sending only the payload string is not enough — it returns 404 ("not found", here meaning "no spell matched").

Genie's hint is the key: "I still listen the same way. Wrap your spell just as before." "Same way" = ICMP. The body must be the complete raw ICMP echo packet, header included, not just the data portion.

Reconstruct the exact bytes of packet #6306 from the PCAP:

ICMP header
  type    = 0x08
  code    = 0x01          <- the "true Code"
  cksum   = 0x41b0        (computed)
  id      = 0xcd5a
  seq     = 0xb9e9
ICMP data
  "GENI5" + 0xffffffff + "Ma9icLAMP" + 0xff * 20

Hex:

0801 41b0 cd5a b9e9
47 45 4e 49 35 ff ff ff ff 4d 61 39 69 63 4c 41 4d 50
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff

Exploit

import socket, struct

HOST = "cddc2026-challs-alb-2050157501.ap-southeast-1.elb.amazonaws.com"
PORT = 31337

def icmp_cksum(data: bytes) -> int:
    s = 0
    for i in range(0, len(data) - 1, 2):
        s += (data[i] << 8) | data[i + 1]
    if len(data) % 2:
        s += data[-1] << 8
    while s >> 16:
        s = (s & 0xffff) + (s >> 16)
    return (~s) & 0xffff

payload = b"GENI5" + b"\xff" * 4 + b"Ma9icLAMP" + b"\xff" * 20
header  = struct.pack("!BBHHH", 8, 1, 0, 0xcd5a, 0xb9e9)
cksum   = icmp_cksum(header + payload)
packet  = struct.pack("!BBHHH", 8, 1, cksum, 0xcd5a, 0xb9e9) + payload

req = (
    f"POST / HTTP/1.1\r\n"
    f"Host: {HOST}:{PORT}\r\n"
    f"Content-Length: {len(packet)}\r\n"
    f"Connection: close\r\n\r\n"
).encode() + packet

s = socket.create_connection((HOST, PORT), timeout=15)
s.sendall(req)
print(s.recv(4096).decode(errors="replace"))

Response:

HTTP/1.1 200 OK
Content-Length: 27
Content-Type: application/octet-stream

CDDC2026{@_wh0le_n3w_world}

Flag

CDDC2026{@_wh0le_n3w_world}

Key takeaways