Clear it in 3 steps
-
Start the environment
-
Investigate the target
-
Submit the flag
An anonymous FTP session was captured in clear text. Download the packet capture (traffic.pcap), follow the FTP data transfer, and extract the flag contained in the retrieved file.
FTP is clear text; use the ftp filter to see the control channel (USER/PASS/RETR)
The retrieved file body is in the data channel; use Follow -> TCP Stream
tshark -r traffic.pcap -q -z follow,tcp,ascii,1 dumps the data channel contents