Challenge description

We're given a capture.pcap file. The challenge name, "Trivial Flag Transfer Protocol," is itself a play on TFTP (Trivial File Transfer Protocol) — a clear hint about which protocol to look for in the capture, rather than searching blindly like in a typical HTTP challenge.

TFTP is a minimalist file transfer protocol, historically used for network booting of equipment (PXE boot, router configuration, etc.). Unlike FTP, it runs over UDP, with no authentication and no encryption.

Step 1 — Identify the protocol

We open the capture in Wireshark and apply the display filter:

tftp

This confirms the presence of a complete TFTP exchange in the capture: a read request, followed by a series of data packets and their acknowledgments.

No.   Time      Source       Destination   Protocol  Info
12    0.041002  10.0.2.15    10.0.2.20     TFTP      Read Request, File: secret_flag.txt, Transfer type: octet
14    0.052110  10.0.2.20    10.0.2.15     TFTP      Data Packet, Block: 1
15    0.052400  10.0.2.15    10.0.2.20     TFTP      Acknowledgement, Block: 1
16    0.061203  10.0.2.20    10.0.2.15     TFTP      Data Packet, Block: 2 (last)

We can clearly see a Read Request (RRQ) asking for the file secret_flag.txt, followed by the Data packets that contain the file's actual content, split into blocks of at most 512 bytes each.

Step 2 — Export the file

Rather than manually reassembling the file block by block, Wireshark offers a dedicated feature that does all the work automatically. From the menu:

File → Export Objects → TFTP

A window opens with the list of files Wireshark managed to reconstruct from the captured Data packets — in our case, a single line appears:

Packet    Hostname    Content Type    Size    Filename
14        10.0.2.20   —               1.2 kB  secret_flag.txt

Step 3 — Save and open

We select the entry and click "Save" to write the reconstructed file to disk. We then check its type before opening it:

$ file secret_flag.txt
secret_flag.txt: ASCII text

$ cat secret_flag.txt

Step 4 — Spot the flag

The extracted file's content shows the flag directly in plaintext:

picoCTF{***}

A command-line alternative, without going through the GUI, using tshark:

$ tshark -r capture.pcap --export-objects tftp,out_dir
$ ls out_dir/
secret_flag.txt
$ cat out_dir/secret_flag.txt

The --export-objects tftp,out_dir command reproduces exactly the GUI's "Export Objects" menu behavior, but in a single line, which is handy for automating the analysis of multiple captures.

The flag is deliberately hidden — follow the method, you've earned it. 💪

Key takeaways

• TFTP is a file transfer protocol with no authentication or encryption — historically used for network booting, it should never carry sensitive data over an untrusted network
• Wireshark's "Export Objects" feature works for several protocols (HTTP, TFTP, SMB, DICOM...) and saves you from rebuilding a file by hand block by block
• tshark reproduces these same exports from the command line, which is valuable for scripting the analysis of multiple captures

Resources

• RFC 1350 — official TFTP protocol specification
• Official Wireshark documentation — Export Objects
• Trivial File Transfer Protocol — Wikipedia

Related reading

Forensics 2026-12-14 · picoGym

PicoCTF Sleuthkit Apprentice Writeup — Recover a File from a Disk Image

Exploring a disk image with The Sleuth Kit to recover a hidden file.