Rating: 2.0

Analyzing the pcap we saw something strange in the ICMP packets and after examine the “type” of them we realized there was a GIF header, so we extracted all the ICMP types with “ip.src =” and obtained a GIF file with the flag “flag{we_ride_at_midnight}”

tshark -r data.pcap -Y 'icmp and !(ip.src== and ip.src== and ip.src==' -x | grep "0020" | cut -d" " -f5 | sed ':a;N;$!ba;s/\n//g' | xxd -r -p > output.gif

Note: The extraction can also be made with "scapy".

By @fikih888