📑 Challenge Overview
A short capture from the VERA hotel guest network was logged before the connection dropped. Small packets are suspiciously being sent at regular intervals. Someone is smuggling out sensitive data disguised inside ordinary HTTP traffic.
Objectives:
Analyze the provided traffic.pcapng capture file.
Identify the covert communication channel used for data exfiltration.
Extract and reassemble the exfiltrated keystrokes/data.
Decrypt the recovered data and retrieve the flag.
🛠️ Step 1: Initial Setup & Extraction
Start by extracting the challenge zip file on your Kali Linux environment:
Unzip the challenge archive
unzip packed-light-forensics-1784224937659.zip
Navigate to the directory and inspect files
cd packed-light/
ls -la
Step 2: Traffic Analysis using TShark
Inspect the packet capture (traffic.pcapng) for HTTP requests directed to port 8080. We notice traffic featuring a custom User-Agent (ByteLotusClient) along with a suspicious cookie named hotel_sess_state.
Use tshark to filter the HTTP requests and inspect the cookie values:
tshark -r traffic.pcapng -Y “http.request && tcp.port == 8080” -T fields -e http.cookie
Observation: The requests contain Base64-encoded strings inside hotel_sess_state=... cookies. These represent exfiltrated character values (keystrokes) sent sequentially.
🐍 Step 3: Python Automation & Decryption Script
To handle packet parsing, deduplication, Base64 decoding, and XOR decryption, we write a Python script using scapy:
nano extract_clean.py
Python Script (extract_clean.py):
import base64
from scapy.all import rdpcap, Raw, TCP
Load the pcap file
packets = rdpcap(“traffic.pcapng”)
extracted = []
for pkt in packets:
if pkt.haslayer(TCP) and pkt[TCP].dport == 8080 and pkt.haslayer(Raw):
payload = bytes(pkt[Raw].load)
if b”hotel_sess_state=” in payload and b”ByteLotusClient” in payload:
try:
cookie = payload.split(b”hotel_sess_state=”)[1].split(b”\r\n”)[0].split(b”;”)[0].decode(“utf-8”)
extracted.append(cookie)
except Exception:
pass
Decrypt using XOR with key byte ‘H’
flag = “”.join(chr(base64.b64decode(c)[0] ^ ord(“H”)) for c in extracted)
print(“\n[+] The Flag:”)
print(flag)
🚩 Step 4: Execution & Retrieving the Flag
Run the script in your terminal:
python3 extract_clean.py
[+] The Flag:
THM{V3r4_1s_w4tch1ng_0veR_you}
🏁 Conclusion
Final Flag: THM{V3r4_1s_w4tch1ng_0veR_you}
Key Takeaways:
Data exfiltration techniques often hide within benign-looking HTTP headers and Cookie fields.
Analyzing request signatures (like custom User-Agents) quickly isolates suspicious packets.
Scripting with Scapy allows seamless parsing and automated decryption of custom network traffic.
Top comments (0)