KubSTU CTF 2026 Spring — Silence in Verona#

A network-forensics challenge that hides a master recovery key across a Packet Tracer topology. Three fragments, "3 in 1" — port logic, workstation logs, and visual artifacts of the topology — and one file, 3 in 1 .pkt.

• Event: KubSTU CTF 2026 Spring
• Category: Network
• Artifact: 3 in 1 .pkt (1.48 MB)
• Flag format: KubSTU{...}

1. The file is not a packet capture#

.pkt looks like "packet", so the first instinct is tcpdump -r:

tcpdump -r "3 in 1 .pkt" -c 1

tcpdump: unknown file format

No pcap/pcapng magic at any offset, no zip/gzip/xz/zstd signature, and file just says data. Measuring it:

import math
from collections import Counter
d = open("3 in 1 .pkt","rb").read()
c = Counter(d); n = len(d)
H = -sum(v/n*math.log2(v/n) for v in c.values())
print("bytes:", n, "distinct:", len(c), "entropy:", round(H,3))

bytes: 1482220  distinct: 256  entropy: 7.999

All 256 byte values, entropy 7.999, zero autocorrelation — the body is encrypted or obfuscated, and there is no container signature at all.

That is exactly the fingerprint of a modern Cisco Packet Tracer file. Since PT 5.3.3 the .pkt/.pka container has no magic header and is stored encrypted: the internal XML topology is compressed with Qt qCompress, wrapped in two custom obfuscation layers and then encrypted with Twofish‑128 in EAX mode using hard‑coded key and IV (0x89 * 16 and 0x10 * 16). The challenge narrative — "visual artifacts of the topology", "port logic" — confirms the file is a Packet Tracer lab.

2. Decrypting the container offline#

The pipeline is fully reversible without Packet Tracer. securedypkt implements it in pure Python:

python3 -m venv ptvenv
./ptvenv/bin/pip install securedypkt
 
./ptvenv/bin/python -c \
  "import securedypkt; open('cap.xml','wb').write(securedypkt.decrypt_file('3 in 1 .pkt'))"

The EAX authentication tag verifies (no tampering), and we get the plain XML Packet Tracer stores internally:

<PACKETTRACER5>
 <VERSION>8.2.1.0118</VERSION>
 ...

A 3.4 MB topology document: devices, IOS configs, and — crucially — the emulated file systems of every PC.

3. Auditing the workstations#

The narrative says the key is split into three fragments. Reading the embedded file systems pulls them out one by one:

• Port logic — network_security_audit_2026.txt:

  TextCopy

  [2026-03-10 09:15] Applying Port Security policy on Access_Switch_1.
  [2026-03-10 09:30] Detected unauthorized MAC on Fa0/2. Port shutdown triggered.
  [2026-03-10 10:45] SSH session established from 172.16.10.10 to CORE_ROOT.
  [2026-03-10 11:20] VLAN 666 isolation test - SUCCESS.

• System logs / notes — hardware_repair_log_room2.txt, DnD_notes.txt, Note.txt, vpn_connection_reset_notes.txt. Mostly flavor, plus a vpn:// config blob and a nod to a "Hunter's Adventure" soundtrack in the DnD notes.

• Visual artifacts — a base64 PNG (capybaras_tears.png) and a Unicode braille ASCII‑art picture inside The GOAT(CapybaraMayCry).txt.

None of these is the payload. Step one of the intended path is simply to search all text files; buried on one workstation's c: drive is Borring novel .txt.

4. The payload — a "boring novel"#

Borring novel .txt is not prose. It is a program in SPL — the Shakespeare Programming Language:

The  Romeo's adventure.
 
Romeo, a man.
Juliet, a woman.
 
Act I: The Output.
Scene I: Display.
 
[Enter Romeo and Juliet]
 
Romeo:
You are as sweet as the sum of a sweet sweet sweet sweet sweet sweet flower and the sum of a sweet sweet flower and the sum of a sweet flower and a flower.
Speak your mind!
...
[Exeunt]

SPL programs read as bad Shakespeare: Romeo and Juliet are integer variables, nouns like "sweet"/"flower" encode numeric constants, sum of X and Y adds, and Speak your mind! outputs the current value as a character. The whole 11 KB file is a long sequence of arithmetic + Speak your mind! — i.e. a character-by-character string print.

5. Running it#

Any SPL interpreter works. Using the shakespearelang package:

./ptvenv/bin/pip install shakespearelang
./ptvenv/bin/python -c \
  "from shakespearelang import Shakespeare; Shakespeare(open('borring.spl').read()).run()"

Good job bookworm, here's your reward
Mellin_The_Hunter

The recovered master key is Mellin_The_Hunter.

6. Flag#

KubSTU{Mellin_The_Hunter}

The "three fragments" are misdirection in the story: the audit is real (port security, logs, images), but the master key is a single SPL program hidden as a text file on a workstation. Decrypt the Packet Tracer container, find the "boring novel", run the Shakespeare, and the key falls out.