The Challenge
A network capture contains the flag encoded as a sequence of 0x-prefixed hex values. Sometimes flags are hidden in custom protocols or unusual packet fields — here it is literally in the packet data as a hex string once you strip the 0x prefixes.
Approach
Remove the 0x prefix from each byte representation by replacing "0x" with "", then call bytes.fromhex on the resulting clean hex string.
Solution
|
|
replace("0x", "") strips all the 0x prefixes at once, leaving a single clean hex string. bytes.fromhex decodes it to raw bytes. .decode() interprets those bytes as ASCII.
What I Learned
Finding hex-encoded data in captures is often just a matter of noticing the 0x pattern and running the three-step clean/decode/print pipeline. The replace("0x", "") trick works on concatenated prefixed hex sequences regardless of length.