#!/usr/bin/env python
# Hack.lu 2010 CTF - Challenge #9 "Bottle"
# Extract GSM audio from RTP packets
# -- StalkR
from scapy.all import *

A = []
for p in rdpcap("extracted.cap"):
  if UDP in p and p[UDP].sport==5000:
    # we see in Wireshark that GSM audio starts at offset 12 of UDP payload
    A += [str(p[UDP].payload)[12:]]

open("audio.gsm","w").write("".join(A))
# Then: sox -t gsm audio.gsm audio.wav