Dérive aérienne

Here is my solution for the easy networking challenge Dérive aérienne as part of the 2026 edition of the Shutlock CTF held online by the French special intelligence service (DGSI) and EPITA.

---

A drone entered a restricted area without prior authorization. Hopefully, a network flow was captured during the flight and is provided under drone.pcap.

Overview

All packets are UDP from and towards port 14550. Speedguide¹ references this port as being used for MAVLink ground station protocol whose documentation is available at mavlink.io.

Decoding packets

I was able to find a LUA plugin on Github at dagar/mavlink_common.lua. After copying the file to the appropriate folder and reloading the plugins (Analyse > Reload Lua Plugins), I noticed 2 distinct packet types :

• HEARTBEAT
• GLOBAL_POSITION_INT

This last packet type hold valuable data to describe the position of the drone :

Visualizing the flight

Based on the latitudes and longitudes sent by the drone, I wrote a basic Python script using Pyplot that runs over a CSV data export from Wireshark :

import pandas as pd
import matplotlib.pyplot as plt

with open("lat_lon.csv", "r") as fi:
    df = pd.read_csv(fi)

plt.plot(df.get("lon (int32)"), df.get("lat (int32)"))
plt.show()

This produced the following graph representing the flag :

🚩 Flag

SHLK{L3_C13L_35T_4_N0U5}

1. Port 14550 (tcp/udp) :: SpeedGuide ↩︎