Description#

We are given a packet capture (.pcapng). The flag is hidden somewhere inside the captured network traffic.

Analysis#

A common first step in forensics PCAP challenges is to extract printable strings and look for familiar flag patterns.

Even without Wireshark/tshark, we can still carve out the contents using strings and grep.

Solution#

Extract strings and search for the flag format:

strings sharkk.pcapng | grep -oE 'scsc26\{[^}]+\}'

Output:

scsc26{t4p1_b0on9}

If you want a bit more context, you can print nearby lines:

strings -n 6 sharkk.pcapng | grep -n "flag.txt" -n
strings -n 6 sharkk.pcapng | grep -n "scsc26" -n

From the surrounding control-channel text, the capture includes an FTP transfer for flag.txt, and the flag appears directly in the payload.