Clear it in 3 steps
-
Start the environment
-
Investigate the target
-
Submit the flag
A device speaking SNMPv2c with a weak community string (public) was captured returning a GetResponse. Download the packet capture (traffic.pcap), analyze the SNMP (UDP/161) varbinds, and recover the flag from the vendor OID's value.
SNMP is UDP/161 with ASN.1 BER; tshark dissects the varbinds automatically
The sysDescr/sysName/sysLocation values are legitimate decoys
The OCTET STRING value of the vendor OID 1.3.6.1.4.1.9999.1.1 is the flag