Interstellar C2 - HackTheBox Challenge Writeup

Challenge Information

Challenge Description

We noticed some interesting traffic coming from outer space. An unknown group is using a Command and Control server. After an exhaustive investigation, we discovered they had infected multiple scientists from Pandora’s private research lab. Valuable research is at risk. Can you find out how the server works and retrieve what was stolen?

Solution Overview

This forensics challenge requires analyzing suspicious network traffic and C2 (Command and Control) communications to understand the attack methodology and extract stolen data from a compromised research facility.

Key Steps

1. Initial Analysis

Begin by examining the provided forensic artifacts for network traffic indicators:

# List available challenge files and artifacts
ls -la

# Check for packet captures or traffic logs
file *

2. Network Traffic Examination

Analyze the C2 communication patterns:

# If packet capture is provided
tcpdump -r traffic.pcap -A | grep -i command
wireshark traffic.pcap

# Search for suspicious domains or IPs
strings traffic.pcap | grep -E "^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$"

3. C2 Protocol Analysis

Identify the command structure and communication method:

# Extract HTTP requests and responses
tcpdump -r traffic.pcap -A | grep -E "GET|POST|HTTP"

# Look for encoded payloads
strings traffic.pcap | grep -i base64 | base64 -d

4. Data Exfiltration Tracking

Follow the data flow to identify what was stolen:

# Search for data patterns in traffic
strings traffic.pcap | grep -i "research\|data\|password"

# Extract binary data segments
tcpdump -r traffic.pcap -w filtered.pcap 'tcp port 80 or tcp port 443'

5. Payload Reconstruction

Reassemble stolen data from C2 communications:

# Use Wireshark or tshark to extract objects
tshark -r traffic.pcap -x | grep -A 10 "stolen"

# Decode extracted payloads
echo "encoded_data" | base64 -d > recovered_data
file recovered_data

Tools Used

• tcpdump - Network packet capture analysis
• Wireshark/tshark - Protocol analysis and traffic inspection
• strings - Binary data extraction
• base64 - Payload encoding/decoding
• file - Data type identification

Key Learnings

1. C2 Traffic Patterns: Command and Control servers often use common protocols (HTTP/HTTPS) disguised as legitimate traffic. Look for unusual patterns in User-Agent strings, request timing, and response structures.

2. Data Exfiltration Indicators: Monitor for:

   • Abnormally large data transfers
   • Repeated connections to suspicious IPs
   • Encoded or encrypted payloads
   • DNS tunneling attempts

3. Forensic Approach: When analyzing C2 communications:

   • Map the command vocabulary
   • Identify authentication mechanisms
   • Track data transformation (encoding, compression, encryption)
   • Reconstruct the full attack timeline

4. Protocol Analysis: Understanding how the C2 server encodes commands and responses is crucial for:

   • Extracting stolen data
   • Identifying compromised systems
   • Determining attack scope

Flag

HTB{<redacted>}

Note: This writeup is based on the challenge framework. For complete exploitation steps and the actual flag, refer to the official HackTheBox solution or attempt the challenge directly on the platform.