Advent of CTF 2025: Day 2 - The First Strike

Day 2 of Advent of CTF 2025 takes us into the world of network forensics, where we investigate a successful brute-force attack against an FTP service by the notorious Krampus Syndicate.

Challenge Overview

Category: Network Forensics
Difficulty: Beginner-Intermediate
Tools Used: Wireshark
Flag Format: csd{username_password}

Challenge Description

Our monitoring systems detected a series of repeating authentication failures against the FTP service. The traffic pattern matched known Krampus Syndicate infrastructure, indicating the beginning of intrusion attempts. After a sustained burst of password guessing, one request finally succeeded.

Mission: Examine the logs or packet capture, identify which account was compromised, and determine the password used during the successful login.

Understanding FTP Authentication

Before diving into the analysis, it’s important to understand how FTP authentication works:

• Port 21: FTP control channel (commands and responses)
• Response Code 230: “User logged in, proceed” - indicates successful authentication
• Response Code 530: “Not logged in” - indicates failed authentication

Solution Walkthrough

Step 1: Analyzing the Packet Capture

When investigating FTP brute-force attacks, we need to focus on successful authentication attempts rather than the numerous failed ones.

Step 2: Filtering for Successful Logins

The key insight is to filter for FTP response code 230, which indicates successful authentication:

Wireshark Filter: ftp.response.code == 230

This filter helps us cut through the noise of failed attempts and focus on the successful login.

Step 3: Extracting Credentials

From the filtered results, we can identify:

• Username: Elf67
• Password: snowball

The successful authentication shows these credentials were used to gain unauthorized access to the FTP service.

Key Learning Points

This challenge demonstrates several important forensic concepts:

Network Traffic Analysis

• Understanding protocol-specific response codes
• Filtering large datasets for relevant information
• Correlating failed and successful authentication attempts

Attack Pattern Recognition

• Brute-force attack signatures in network traffic
• Identifying successful compromise within attack noise
• Timeline analysis of intrusion attempts

FTP Security Implications

• Clear-text credential transmission in FTP
• Importance of strong password policies
• Need for intrusion detection systems

Defensive Recommendations

Based on this analysis, several security improvements could prevent similar attacks:

1. Account Lockout Policies: Implement automatic lockouts after failed attempts
2. Strong Password Requirements: Enforce complex passwords that resist brute-force
3. Network Monitoring: Deploy systems to detect brute-force patterns
4. Secure Protocols: Consider SFTP or FTPS instead of plain FTP
5. Access Controls: Limit FTP access to necessary users and networks

Tools and Techniques

Wireshark was essential for this investigation:

• Protocol-aware filtering capabilities
• Clear visualization of network conversations
• Ability to reconstruct attack timelines
• Support for various network protocols

Flag

After identifying the compromised credentials from the successful FTP login:

Answer: csd{Elf67_snowball}

Conclusion

Day 2 showcases the importance of network forensics in incident response. By understanding protocol behaviors and using appropriate filtering techniques, we can quickly identify successful attacks within large volumes of network traffic.

This type of analysis is crucial for real-world incident response, where security teams must rapidly identify compromised accounts and assess the scope of breaches.

---

This writeup is part of my Advent of CTF 2025 series. Each challenge builds upon fundamental cybersecurity skills essential for both CTF competitions and professional security work.