Data extraction - ROOT-ME CTF

Ciphernom@d04

2 min read

·

May 25, 2026

--

Listen

Share

We were given a Wireshark capture file containing traffic from three protocols: FTP, SMB, and NFS. The goal was to find three flags hidden across files transferred over these protocols.

Flag 1 & 2 — FTP and SMB (Easy)

The first thing I always do with a pcap is File → Export Objects in Wireshark.

• FTP export → got cat.jpg, cat2.png, cookie.txt
• Opened cat2.png directly → Flag 2 was visible in the image
• SMB export → got books.pdf, congradulation.odt, maybe.tar.gz
• Opened books.pdf → Flag 1 was inside

Flag 3 — NFS (The Tricky One)

Dead ends first

With two flags found I started digging through everything else:

• cat.jpg — tried steganography tools, binwalk, strings. Nothing.
• congradulation.odt — ran binwalk on it, which revealed a 4D.zip inside. Got excited but the zip was broken/corrupted. After repairing it and extracting, I found a thumbnails folder containing an image that just said "NOT THIS TIME!"
• Checked maybe.tar.gz and cookie.txt. Nothing useful.

The breakthrough

I went back to the challenge description and noticed it explicitly mentioned three protocols: FTP, SMB, and NFS. I had only looked at two. That was the hint.

Back in Wireshark, I filtered for NFS traffic:

nfs

Going through the packets one by one, I spotted holidays.mp4 referenced in a READDIR reply — a file being transferred over NFS that wasn't exported by Wireshark's built-in export (Wireshark doesn't support NFS object export).

Extracting the MP4

Searched Google for an NFS extractor tool and found:

NFSExtractor by Rysess — extracts NFS files from Wireshark pcap captures

Ran it on Kali:

python3 NFSExtractor.py -i capture.pcapng

Hit a pyshark version compatibility error (elastic-mapping not supported). Fixed it by:

• Tweaking the script using

The script output 8 files — 7 were .trashinfo metadata files (Linux trash can entries) and one was the MP4 we needed. Renamed it:

bash

mv unknown_0x00000051 holidays.mp4

Getting the flag

Opened holidays.mp4 in Windows Media Player — error, wouldn't play.

Opened in VLC — played fine. The video showed someone typing in a text editor, slowly revealing:

Press enter or click to view image in full size

Key Lessons

• Always check the challenge description — the three protocols were listed explicitly. Once I noticed NFS I knew where to look.
• Dead ends are part of the process — the fake flag in congradulation.odt was a deliberate rabbit hole designed to waste time.