Breach Traffic

Overview

A PCAP containing an FTP session. Credentials are visible in cleartext and unlock the encrypted zip from the PCAP.

Solution

Open in Wireshark and filter to FTP traffic:

tcp.port == 21

Follow the TCP stream on port 21. The authentication sequence is fully visible:

220 DEADROP-FTP-01 FTP server ready.
USER analyst07
331 Password required for analyst07.
PASS Wr3n$ong2024
230 User analyst07 logged in.

Credentials: analyst07 / Wr3n$ong2024

The data connection on port 54321 transfers a file named ops_brief_enc.zip. Export it from the PCAP (follow that TCP stream, save as raw bytes).

Decrypt with the FTP password:

unzip -P 'Wr3n$ong2024' ops_brief_encrypted.zip
cat ops_brief.txt

The document is an internal operations brief. The flag is at the bottom.

Flag: DEADROP{ftp_in_2024_unforgivable}

Key Takeaway

FTP sends credentials in cleartext. Any passive observer on the network captures them trivially. The flag text says it all.