Overview
After obtaining the reverse shell, we look around the file system and find a .pcap traffic log file.
Reconnaissance
We transfer the pcap file to our host machine and inspect it using Wireshark. Filtering by various protocols shows an unusual volume of ICMP echo requests/replies.
Exploitation Strategy
Analyzing the data section of the ICMP packets, we notice binary data chunks. Reassembling the hex bytes of the ICMP payloads reveals an embedded image file. Deep inside the packets we locate a plaintext password: vK9#mX7w!Qz$2n.
Solution Code
# Wireshark filter:
icmp
# Extract hex payloads and reassemble them. The leaked password is:
vK9#mX7w!Qz$2nFlag
vK9#mX7w!Qz$2n