> For the complete documentation index, see [llms.txt](https://encient.gitbook.io/ctf-writeups-and-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://encient.gitbook.io/ctf-writeups-and-notes/ctf-writeup/gctf-2023/wireshark-2.md). # Wireshark #2 Export HTTP object ## Description I remember there is a compressed file. Please find it and expose the secret! Same challenge file as Wireshark #1. ## Solution Challenge description mentioned file, so we can try to search for objects in the export section.

`File` -> `Export Objects` -> `HTTP` We chose to export HTTP objects as we can see that there are HTTP protocols in the packets. You can always choose other protocols to see whether there are any other objects transferred. However, the most common one is HTTP.

Given hint is compressed file, we know that we need to focus on the zip file. We can then choose the `secret.zip` file and save it.

However, the zip file is not able to be extracted or unzipped as it is corrupted. It is shown that the end-of-central-directory is not found.

After some research, we found the signature of the corrupted part. ``` hexedit secret.zip ```

Edit the corrupted part with the correct signature and the zip file will be fixed.

However, the zip file requires a password. The string in `secret.txt` did not work out for it. Therefore, we thought of bruteforcing the password. ``` zip2john secret.zip > secret.hash ``` Use `zip2john` to generate hash for the zip file. ``` john --wordlist=/usr/share/wordlists/rockyou.txt secret.hash ``` Then, use John the Ripper tool to bruteforce the password using `rockyou.txt` wordlist.

The zip file password will be cracked successfully and the password is `batman`.

Upon submitting the correct password, it will give us a file named “flag”. View it and get the flag. ## Flag GCTF2023{C0rrupted\_Z1p\_f1l3s}