Name Calling

Platform: bluehensctf | Category: Forensics | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-04-21 | Status: Solved Techniques: exif_metadata_extraction, hex_decoding, http_object_export, zip_password_cracking

Summary

Task: PCAP file with HTTP traffic containing hidden files. Solution: Export HTTP objects, extract hex-encoded password from EXIF metadata, decrypt ZIP to get flag.

Name Calling — BlueHens CTF 2026

Description

Analyze the provided PCAP file to recover the flag.

Given a network capture file yousaidwhat.pcapng, find the hidden flag.

Analysis

The PCAP contains HTTP traffic with multiple downloadable objects. Exporting HTTP objects reveals several files including images and a password-protected ZIP archive.

Key files recovered:

• chicken.jpg — contains EXIF metadata with a hex-encoded string
• whoareyoucalling.zip — password-protected archive
• Various decoy files ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The chicken.jpg image has a Copyright EXIF field containing the hex string 6e6f626f64792063616c6c73206d6520636869636b656e21.

Solution

1. Open the PCAP in Wireshark and export HTTP objects (File → Export Objects → HTTP)

2. Examine the EXIF metadata of chicken.jpg:

 bash read-only • copy allowed Copy
exiftool chicken.jpg | grep Copyright
# Copyright: 6e6f626f64792063616c6c73206d6520636869636b656e21

1. Decode the hex string:

 python read-only • copy allowed Copy
>>> bytes.fromhex("6e6f626f64792063616c6c73206d6520636869636b656e21").decode()
'nobody calls me chicken!'

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

1. Use the decoded password to extract the ZIP:

 bash read-only • copy allowed Copy
unzip -P "nobody calls me chicken!" whoareyoucalling.zip

1. Read the extracted file:

 bash read-only • copy allowed Copy
cat whoareyoucalling.txt
# UDCTF{REDACTED}

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍