TL;DR: Get TACAS+ encryption key by cracking Cisco type 7 password from R1config file obtained from TFTP file transfer. Flag is username of user authenticating.

Original writeup (https://github.com/quintuplecs/writeups/blob/master/RattataTACACS.md).