Release the Crackin'!

Challenge:

Luciafer cracked a password belonging to the victim. Submit the flag as: flag{password}.

Use the PCAP from LYTTON LABS 01 - Monstrum ex Machina.

Solution:

Using the credentials tool in Wireshark (Tools->Credentials) we observe a large list of FTP sessions:

We then use the Zeek logs generated during the Monstrum ex Machina challenge to review FTP sessions:

$ cat ftp.log | zeek-cut user password | sort -u
cgeschickter	darkangel

The accepted flag was, flag{darkangel}