Clear it in 3 steps
Start the environment
Investigate the target
Submit the flag

Analyze traffic intercepted on public Wi-Fi where someone logged in over plain HTTP. Download the packet capture (traffic.pcap), find the HTTP POST login request, and extract the password. The password is the flag.
Use the Wireshark display filter http.request.method == "POST" to isolate the login request
Right-click the POST packet and choose Follow -> TCP Stream to read the full HTTP request
tshark -r traffic.pcap -Y 'http.request.method=="POST"' -T fields -e http.file_data prints the POST body