ctf.nitaimaarek.com Learn Leaderboard Log in Sign up

Read the FTP banner

Apprentice 10 pts

Goal: Connect to the FTP control port and read the access token in the server's greeting.

Capture it yourself — real FTP needs a terminal

Start Wireshark on your active interface with filter tcp.port == 2121 (or sudo tcpdump -i any -w cap.pcap port 2121).
Run this against the real FTP server on this box:

nc ctf.nitaimaarek.com 2121

Stop the capture and Follow → TCP Stream. The server's 220 greeting line carries an access token — that's the answer. (Ctrl-C to quit.)

No nc? On Linux/macOS try ncat, or bash: exec 3<>/dev/tcp/ctf.nitaimaarek.com/2121. The exchange is plaintext, so it's fully readable in your capture — that's the whole point.

Hints

Open in order — they nudge, not solve.

Hint 1

Capture with tcp.port == 2121, then connect: nc ctf.nitaimaarek.com 2121.

Hint 2

The very first line the server sends is a 220 greeting — it's in your terminal and in your capture.

Hint 3

That greeting contains an FTP-BANNER-… access token — that's the answer.

← Roadmap Skip for now →