# Backup (misc)Writeup by: [xlr8or](https://ctftime.org/team/235001)
As part of this challenge a `pcap` file was provided, that can be inspected by wireshark.Immediately it can be noticed that there are some `telnet` packets in the capture, this is always interesting, since telnet is not encrypted by default.
The telnet capture reveals the username and password that was used for authentication:```Login incorrect1337router login: rroooott
Password: sup3rs3cur3```
From this it can be noted that the **root** use authenticated with password **sup3rs3cur3**.Further it can be seen that an ftp server is started during the telnet session:```<< Welcome to 1337router! >>Last login: Wed Jan 25 17:00:37 UTC 2023 from 192.168.56.3 on pts/2.[?2004h.]0;root@1337router: ~.root@1337router:~# aaccttiivvaattee__ffttpp
.[?2004l.ftp server activated.[?2004h.]0;root@1337router: ~.root@1337router:~# ..[?2004l.logout```
Therefore the capture file can be checked for FTP packets:
```220 Welcome to 1337 FTP service.USER anonymous331 Please specify the password.PASS xxx230 Login successful.SYST215 UNIX Type: L8PORT 192,168,56,3,188,253200 PORT command successful. Consider using PASV.LIST150 Here comes the directory listing.226 Directory send OK.TYPE I200 Switching to Binary mode.PORT 192,168,56,3,213,243200 PORT command successful. Consider using PASV.RETR backup.zip150 Opening BINARY mode data connection for backup.zip (411 bytes).226 Transfer complete.QUIT221 Goodbye.```
At the bottom of the commands we see that the client requests binary mode and then a transfer of `backup.zip`. We can use wireshark to extract this zip file, by going into `File > Export Objects > FTP-DATA` and exporting the only available option in the dialog.
This will export `backup.zip` for us, and the same password that was used for the authentication of the root user can be used to extract `secrets.json` from this zip file.
And the flag is contained in `secrets.json`