Tags: forensics wireshark 

Rating:


## Secret Document

***Secret document is material that FIB deems to be sensitive information and must be protected. (.docx included)***

after downloading ***Classified.docx***

***file CLassified.docx*** returns that in real this is 3,1M pcapng capture file

![](https://i.ibb.co/thcwXNN/Secret-Document1.png)

after quick analysis of protocols I have extracted data transfered by ftp protocol

![](https://i.ibb.co/wpfp00w/Secretdocument2.png)

![](https://i.ibb.co/GdY697R/Secret-DOcument3.png)

flag is ***SBCTF{Cl4ssified_information}***

Original writeup (https://github.com/eroloo/ctf/tree/main/Loki2021CTF/SecretDocument).