DEV Community

CTFDojo
CTFDojo

Posted on Originally published at ctfdojo.com

PicoCTF TFTP Writeup — Recover a File from a Wireshark Capture

#ctf #security #forensics

The capture contains a file transfer over the TFTP protocol (Trivial File Transfer Protocol). Wireshark can automatically reconstruct and export this file via its "Export Objects" menu, revealing the flag in the extracted file's content.

  • Platform: picoGym
  • Category: Forensics
  • Points: 150 pts
  • Difficulty: Beginner
  • Tools: Wiresharktsharkfile

Challenge description

We're given a capture.pcap file. The challenge name, "Trivial Flag Transfer Protocol," is itself a play on TFTP (Trivial File Transfer Protocol) — a clear hint about which protocol to look for in the capture, rather than searching blindly like in a typical HTTP challenge.

TFTP is a minimalist file transfer protocol, historically used for network booting of equipment (PXE boot, router configuration, etc.). Unlike FTP, it runs over UDP, with no authentication and no encryption.

Step 1 — Identify the protocol

We open the capture in Wireshark and apply the display filter:

tftp
Enter fullscreen mode Exit fullscreen mode

This confirms the presence of a complete TFTP exchange in the capture: a read request, followed by a series of data packets and their acknowledgments.

No.   Time      Source       Destination   Protocol  Info
12    0.041002  10.0.2.15    10.0.2.20     TFTP      Read Request, File: secret_flag.txt, Transfer type: octet
14    0.052110  10.0.2.20    10.0.2.15     TFTP      Data Packet, Block: 1
15    0.052400  10.0.2.15    10.0.2.20     TFTP      Acknowledgement, Block: 1
16    0.061203  10.0.2.20    10.0.2.15     TFTP      Data Packet, Block: 2 (last)
Enter fullscreen mode Exit fullscreen mode

We can clearly see a Read Request (RRQ) asking for the file secret_flag.txt, followed by the Data packets that contain the file's actual content, split into blocks of at most 512 bytes each.

Step 2 — Export the file

Rather than manually reassembling the file block by block, Wireshark offers a dedicated feature that does all the work automatically. From the menu:

File → Export Objects → TFTP
Enter fullscreen mode Exit fullscreen mode

A window opens with the list of files Wireshark managed to reconstruct from the captured Data packets — in our case, a single line appears:

Packet    Hostname    Content Type    Size    Filename
14        10.0.2.20   —               1.2 kB  secret_flag.txt
Enter fullscreen mode Exit fullscreen mode

Step 3 — Save and open

We select the entry and click "Save" to write the reconstructed file to disk. We then check its type before opening it:

$ file secret_flag.txt
secret_flag.txt: ASCII text

$ cat secret_flag.txt
Enter fullscreen mode Exit fullscreen mode

Step 4 — Spot the flag

The extracted file's content shows the flag directly in plaintext:

picoCTF{***}
Enter fullscreen mode Exit fullscreen mode

A command-line alternative, without going through the GUI, using tshark:

$ tshark -r capture.pcap --export-objects tftp,out_dir
$ ls out_dir/
secret_flag.txt
$ cat out_dir/secret_flag.txt
Enter fullscreen mode Exit fullscreen mode

The --export-objects tftp,out_dir command reproduces exactly the GUI's "Export Objects" menu behavior, but in a single line, which is handy for automating the analysis of multiple captures.

🚩 picoCTF{ flag intentionally hidden }

The flag is deliberately hidden — follow the method, you've earned it. 💪

Key takeaways

  • TFTP is a file transfer protocol with no authentication or encryption — historically used for network booting, it should never carry sensitive data over an untrusted network
  • Wireshark's "Export Objects" feature works for several protocols (HTTP, TFTP, SMB, DICOM...) and saves you from rebuilding a file by hand block by block
  • tshark reproduces these same exports from the command line, which is valuable for scripting the analysis of multiple captures

Originally published on CTFdojo — join the CTFdojo Discord to discuss writeups and get notified about new ones.

Top comments (0)