> For the complete documentation index, see [llms.txt](https://sayonara.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://sayonara.gitbook.io/writeups/ctf/ensa-sics-ctf-2023/forensics-challenges/th3_uncr4ck4ble_p-usdusdw0rd.md).

# Th3\_Uncr4ck4ble\_P@$$w0rd

## <mark style="color:red;">Downloading Challenge Files</mark>

here is the executable file to download

{% file src="/files/kvN4siPJyGk9iy25kCmi" %}

in this challenge we have a zip file that is protected by a password which exist in the pcap file&#x20;

let's use wireshark to analyze the traffic and try to find the password

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2F8qZbKWBc0ObX6m8OunCm%2Fimage.png?alt=media&amp;token=11e5e309-4eb6-4fb3-84fb-9f403a000697" alt=""><figcaption></figcaption></figure></div>

after analyzing the traffic we see that a file called flag.txt is transferd through the ftp protocol

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2Fj8V3NSRAe7ExBJHTTKuC%2Fimage.png?alt=media&amp;token=4424471a-0322-412a-904e-a8ae5b36654e" alt=""><figcaption></figcaption></figure></div>

let's extract this file since it's captured by wireshark

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2Fxbpe0DFUD04xkcTNhSNi%2Fimage.png?alt=media&amp;token=cc80ec0e-44c9-4350-a931-b6897b200ec5" alt=""><figcaption></figcaption></figure></div>

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2F4ja0RxbJsbQrf3lVXlyZ%2Fimage.png?alt=media&amp;token=e4f38f4e-fd50-4616-8ed6-4166857c0a8b" alt=""><figcaption></figcaption></figure></div>

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FSsJ9B3LkWYCsNHak4CAG%2Fimage.png?alt=media&amp;token=86ddfef9-aafe-4487-8ca5-d392a8e0c3f4" alt=""><figcaption></figcaption></figure></div>

and now let's check if we have extracted the file successfully

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FDjvaygh1yGNxDigpTzXf%2Fimage.png?alt=media&amp;token=188bca63-9f83-4957-a309-7d4af0573951" alt=""><figcaption></figcaption></figure></div>

this is not the flag this is a rabbit hole let's go back to the wireshark and concentrate more and filter the traffic based on the ftp protocol&#x20;

and this is the password&#x20;

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FyhpR8WbmpKtXBbTFDgeq%2Fimage.png?alt=media&amp;token=6f55b2e0-a498-49aa-82ac-0f93f4dc2210" alt=""><figcaption></figcaption></figure></div>

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2Fyw5rG6ir9JPZOpD8Rqdf%2Fimage.png?alt=media&amp;token=9b7c9533-b3ef-4a86-b30e-b2a4d975b823" alt=""><figcaption></figcaption></figure></div>

now let's open the png image inside the flag directory but it's corrupted

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FFWCDgqvmpLV4lKQMXdmS%2Fimage.png?alt=media&amp;token=bbab177b-4272-466b-9d9d-2622d47ead5c" alt=""><figcaption></figcaption></figure></div>

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FOeUItiQf1EP2bBNvYaFj%2Fimage.png?alt=media&amp;token=70f373c3-6c25-41d1-bbd5-981c6f982682" alt=""><figcaption></figcaption></figure></div>

before trying to fix the corrupted png image let's extract the strings inside the png image&#x20;

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2F3IVX8TS5BktNKjW6uTaZ%2Fimage.png?alt=media&amp;token=71d3105f-2e59-4d5c-878f-aec645232e10" alt=""><figcaption></figcaption></figure></div>

## <mark style="color:red;">Flag</mark>

**DEFENSYS{"SH4rk\_H4s\_B33n\_Def34t3d\_SUcc3ssFu11Y"}**

Greetings from[ <mark style="color:blue;">**Sayonara**</mark>](https://github.com/ismail-arame/)