Challenge

A host with the old finger service (port 79) open.

Approach

finger reports who is logged in and will happily describe a named user. Querying the host showed a single account, marco:

$ finger @10.100.50.64
Login     Name       Tty      Idle  Login Time   Office     Office Phone
marco     marco     *tty1       59  Sep 22 10:09

To be sure there was nothing else, I enumerated users against port 79 and confirmed marco was the only non-system account in the list:

Finger user enumeration listing system accounts plus the user marco

Solution

Finger returns a user’s .plan file. Asking for marco directly prints it, and the plan held the flag:

$ echo "marco" | nc -vn 10.100.50.64 79
Login: marco                            Name: marco
Directory: /home/marco                  Shell: /bin/bash
On since Fri Sep 22 10:09 (EDT) on tty1   59 minutes 58 seconds idle
Plan:
flag: Pl4nn1ngF0r4Pl4n

Flag

Pl4nn1ngF0r4Pl4n