Trivial Flag Transfer Protocol picoCTF 2021 Solution

Description

1. Step 1Export all TFTP objects from the capture
   Open tftp.pcapng in Wireshark, then File > Export Objects > TFTP. You'll recover instructions.txt, plan, picture1.bmp, picture2.bmp, picture3.bmp, and program.deb.
   bash

   wireshark tftp.pcapng

   Copied!
   Learn more

   TFTP packet primer. TFTP runs over UDP/69 with a tiny opcode-driven format:

   • 1 = RRQ (read request): opcode | filename\0 | mode\0
   • 2 = WRQ (write request): same shape as RRQ
   • 3 = DATA: opcode | block# | up to 512 bytes
   • 4 = ACK: opcode | block#
   • 5 = ERROR: opcode | errcode | message\0

   Filename and mode in RRQ/WRQ are NUL-terminated ASCII strings. Because everything is plaintext, Wireshark's Export Objects walks the DATA blocks and reassembles complete files. See Wireshark for CTF for the broader protocol-analysis playbook.

2. Step 2Decode the text files with ROT13
   instructions.txt and plan are ROT13. Decode them to learn the steg tool (steghide) and the passphrase. Look for the passphrase on a clearly-marked line: often the last line of the file or a label like 'password:' or 'passphrase:'.
   bash

   tr 'A-Za-z' 'N-ZA-Mn-za-m' < instructions.txt

   Copied!

   bash

   tr 'A-Za-z' 'N-ZA-Mn-za-m' < plan

   Copied!
3. Step 3Extract the hidden data from picture3.bmp
   Use steghide on picture3.bmp with the recovered passphrase (DUEDILIGENCE in the canonical solve). The output file contains the flag.
   bash

   steghide extract -sf picture3.bmp -p DUEDILIGENCE

   Copied!

   bash

   cat flag.txt

   Copied!
   Learn more

   Steghide hides data inside image and audio carriers by tweaking pixel/sample values; the payload is encrypted with a passphrase. -sf selects the stego file and -p passes the passphrase. See steganography tools for the broader toolkit (zsteg for PNG LSB, binwalk for embedded archives, stegsolve for visual bit planes).

   This challenge chains TFTP recovery, ROT13 decoding, and steghide extraction. Each clue is hidden in the previous step's output, a common multi-stage pattern in forensics CTFs.

Flag

TFTP transfers files without encryption: export all objects from the capture, decode the ROT13 instructions to recover the steghide passphrase, and pull the flag out of picture3.bmp.