At the defcon ctf in 2016(?) One of the teams used a Wireshark 0day to pwn another team and see/use all of their flags.