Home Comm
Topics User
FORUM F
BLOG B

H4ck3r.me

#1 Website For Linux Tutorials

Operation Clean Stream

Scenario You have intercepted a raw telemetry log from a rogue IoT device. The payload is hidden within lines tagged as MSG_ID.

? Have doubts? Ask clearly on the Forum.
Ask Question

Task

  1. Filter lines with MSG_ID.
  2. Extract the 4th column (payload).
  3. Remove adjacent duplicates.
  4. Concatenate and decode the Base64 string.
[INFO] init connection
[DATA] MSG_ID 101 Q1RGe
[DATA] MSG_ID 101 Q1RGe
[WARN] high latency detected
[DATA] MSG_ID 102 3c3Ry
[DATA] MSG_ID 102 3c3Ry
[DATA] MSG_ID 102 3c3Ry
[INFO] retrying packet
[DATA] MSG_ID 103 ZWFtX
[DATA] MSG_ID 104 2xhYl
[DATA] MSG_ID 104 2xhYl
[ERR ] connection flap
[DATA] MSG_ID 105 9raW5
[DATA] MSG_ID 105 9raW5
[DATA] MSG_ID 106 nfQo=
[INFO] stream closed
1

One-Liner Solution

grep "MSG_ID" stream.log | awk '{print $4}' | uniq | tr -d '\n' | base64 -d

Step-by-Step Explanation

  1. grep "MSG_ID" stream.log: Filters the log to show only the lines containing our hidden data.
  2. awk '{print $4}': Grabs the 4th column of text (the Base64 piece).
  3. uniq: Removes the adjacent duplicate lines caused by the network "bursts". (Note: Do not use sort | uniq or you will scramble the message order!).
  4. tr -d '\n': Deletes the newlines to create one long Base64 string.
  5. base64 -d: Decodes the final string to reveal the flag.

Leave a Comment