Stolen Mount Walkthrough

Challenge Statement#

Solution#

We have a .pcapng which shows us the packets transmitted when the NFS server was infiltrated.
We can use the filter nfs.data.

We then follow the TCP Stream to view the contents of the packet. We find that there is a md5 hash of an “Archive” Password.

We can use any tool to crack the md5 hash and get the password. I’ve used this site.

To retrieve the “Archive” file, we can change the data type to RAW and save it as a zip file.
Then, we just have to unzip the file and enter the password that we had retrieved.

We get a QR code, which gives us the flag when scanned.

Adapted from harishkannan05/THM-HackfinityBattle-Writeup under MIT.