# Luciafer's Fatal Error
 

## Details
>Luciafer, consummate hacker, got cocky and careless. She made a fatal mistake, and in doing so, gave control of her computer to... someone. She ran a program on her computer that she shouldn't have.
>
> What is the md5sum of the program? Submit the flag as: `flag{MD5}`.
>
> Use the PCAP from Monstrum ex Machina
---


Removing the `FTP` filter and looking at the packets which follow, we can ssee the folloowing in the `TCP stream`


This appears to be launching a shell.

As before if we then re-filter by `ftp-data`, select the packet relating to `secret-decoder.bin` and extract and save it from the `TCP Stream`.


Now that we have a copy of the file on our local machine we can run;

```bash
❯ md5sum secret-decoder.bin
42e419a6391ca79dc44d7dcef1efc83b secret-decoder.bin
```

## flag{42e419a6391ca79dc44d7dcef1efc83b}

Original writeup (https://github.com/CTSecUK/DEADFACE_CTF_2021/edit/main/Write-ups/Traffic%20Analysis/Luciafer's%20Fatal%20Error%20(50%20Points).md).