It is pretty easy to find the flag with *Wireshark* by reading tcp streams in **Analyze->Streams**, but we can do the same with *tshark*, the cli version:
```console[user@host Eavesdrop]$ tshark -r capture.flag.pcap -q -z conv,tcp================================================================================TCP ConversationsFilter:<No Filter>                                                           |       <-      | |       ->      | |     Total     |    Relative    |   Duration   |                                                           | Frames  Bytes | | Frames  Bytes | | Frames  Bytes |      Start     |              |10.0.2.15:57876            <-> 10.0.2.4:9001                   17 1 330bytes      18 1 411bytes      35 2 741bytes    15,175413000       224,240210.0.2.15:43928            <-> 35.224.170.84:80                 5 442bytes        5 377bytes       10 819bytes    165,383043000         0,562310.0.2.15:56370            <-> 10.0.2.4:9002                    4 272bytes        4 320bytes        8 592bytes    205,301478000        11,8833================================================================================```
There are three conversations to read, so lets read them:
```consoleuser@host Eavesdrop]$ tshark -r capture.flag.pcap -q -z follow,tcp,ascii,0
===================================================================Follow: tcp,asciiFilter: tcp.stream eq 0Node 0: 10.0.2.15:57876Node 1: 10.0.2.4:9001        41Hey, how do you decrypt this file again?
16You're serious?
        18Yeah, I'm serious
83*sigh* openssl des3 -d -salt -in file.des3 -out file.txt -k supersecretpassword123
        19Ok, great, thanks.
47Let's use Discord next time, it's more secure.
        51C'mon, no one knows we use this program like this!
10Whatever.
        5Hey.
6Yeah?
        41Could you transfer the file to me again?
25Oh great. Ok, over 9002?
        17Yeah, listening.
8Sent it
        8Got it.
20You're unbelievable
===================================================================```
```console[user@host Eavesdrop]$ tshark -r capture.flag.pcap -q -z follow,tcp,ascii,1
===================================================================Follow: tcp,asciiFilter: tcp.stream eq 1Node 0: 10.0.2.15:43928Node 1: 35.224.170.84:8087GET / HTTP/1.1Host: connectivity-check.ubuntu.comAccept: */*Connection: close
        148HTTP/1.1 204 No ContentDate: Mon, 04 Oct 2021 18:08:52 GMTServer: Apache/2.4.18 (Ubuntu)X-NetworkManager-Status: onlineConnection: close
===================================================================```
```console[user@host Eavesdrop]$ tshark -r capture.flag.pcap -q -z follow,tcp,ascii,2
===================================================================Follow: tcp,asciiFilter: tcp.stream eq 2Node 0: 10.0.2.15:56370Node 1: 10.0.2.4:900248Salted__............=a.....Z..........F8..v.<8EY===================================================================```
We can skip the second one, because it does not contain anything interesting. The first one shows us a literal conversation with a cool command and credentials included. The third is a secret to decrypt.
So we have to save the secret properly, because the **ascii** output of thark is replacing non-printable characters with dots. We will use the **raw** option with some pipes to remove obsolete text and transform the message to real raw data:
```console[user@host Eavesdrop]$ tshark -r capture.flag.pcap -q -z follow,tcp,raw,2 | tail -n +7 | head -n 1 | xxd -r -p > secret ```
Last step, decryption:
```console[user@host Eavesdrop]$ openssl des3 -d -salt -in secret  -k supersecretpassword123*** WARNING : deprecated key derivation used.Using -iter or -pbkdf2 would be better.picoCTF{nc_73115_411_5786acc3}[user@host Eavesdrop]$ ```