The challenge description was: well seriously, why not?
Let's download the pcap file and analyze the traffic to find out where is our flag in Wireshark. I usually start by looking at the conversations and try to find something odd or interesting:
In the TCP conversations tab, we can see a lot of bandwidth consumption between A to B. Let's click on Follow Stream to analyze and try finding our flag:
Do you notice something interesting in the Stream Content? No need to even try and look into the 12092 bytes of data. We can see it at the beginning, flag.png. All we have to do is use the Save As button and try extracting our data from it.
mrt:~/csaw/why_not_sftp$ ls total 20 drwxr-xr-x 2 mrt mrt 4096 Sep 21 19:12 . drwxr-xr-x 10 mrt mrt 4096 Sep 21 19:12 .. -rw-r--r-- 1 mrt mrt 12092 Sep 19 19:32 traffic.dmp mrt:~/csaw/why_not_sftp$ file traffic.dmp traffic.dmp: Zip archive data, at least v2.0 to extract
The stream content is a Zip archive, let's unzip it and find out if our file flag.png is in there:
mrt:~/csaw/why_not_sftp$ unzip traffic.dmp Archive: traffic.dmp inflating: flag.png mrt:~/csaw/why_not_sftp$ ls total 36 drwxr-xr-x 2 mrt mrt 4096 Sep 21 19:12 . drwxr-xr-x 10 mrt mrt 4096 Sep 21 19:12 .. -rw-r--r-- 1 mrt mrt 12970 Sep 13 13:17 flag.png -rw-r--r-- 1 mrt mrt 12092 Sep 19 19:32 traffic.dmp
Now open the file flag.png with an image viewer. The flag is written on it.
We got our flag: 91e02cd2b8621d0c05197f645668c5c4