> For the complete documentation index, see [llms.txt](https://eephillip.gitbook.io/zw2020-ctf-writeup/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://eephillip.gitbook.io/zw2020-ctf-writeup/writeup/backdoored-source.md).

# Backdoored Source

{% hint style="info" %}
So find the bug in the zeek source version release/2.0. They provide a tampered zip file of the source.
{% endhint %}

Zeek repo lives here <https://github.com/zeek/zeek>

The original source tag here <https://github.com/zeek/zeek/releases/tag/v2.0>

![](/files/-MJgbVW7TLdxx6V_lc8r)

Clone that tag down. I used [beyond compare](http://scootersoftware.com/) to do a folder diff on the sourcetree. Uh oh whats up with that file I wonder.

![](/files/-MJgbmv6phrLG5riJwh2)

![](/files/-MJgc5KUaqeTn1SqnMI-)

{% hint style="success" %}
The Solution

```
scripts/base/protocols/conn/main.bro
```

{% endhint %}