Keep Tryin’ - HackTheBox Challenge Writeup

Challenge Information

Description

This packet capture analysis challenge presents suspicious network traffic that requires investigation and forensic analysis to uncover hidden data or malicious activity.

Initial Reconnaissance

The challenge provides a packet capture file (PCAP) containing network traffic that appears suspicious. The goal is to analyze this traffic to identify anomalies, extract data, or uncover the flag hidden within the network communications.

Solution Approach

Step 1: Load and Inspect the PCAP File

Begin by opening the packet capture file with Wireshark or analyzing it with command-line tools:

# View basic packet information
tcpdump -r traffic.pcap -c 20

# Or use Wireshark for GUI analysis
wireshark traffic.pcap

Step 2: Identify Suspicious Traffic Patterns

Look for:

• Unusual port usage
• Repeated connection attempts
• Data exfiltration patterns
• Protocol anomalies
• DNS queries with suspicious domains

# Filter for specific protocols
tcpdump -r traffic.pcap -i 'tcp port 80 or tcp port 443'

# Extract DNS queries
tcpdump -r traffic.pcap -i 'udp port 53' -A

Step 3: Extract Payloads and Data

Extract data streams from suspicious connections:

# Use tshark to export objects
tshark -r traffic.pcap --export-objects http,./extracted/

# Follow TCP streams
# In Wireshark: Right-click packet > Follow > TCP Stream

Step 4: Analyze Extracted Content

Examine extracted files and data for:

• Encoded/encrypted payloads
• Hidden text or metadata
• Suspicious commands
• Exfiltrated information

# Check file types and contents
file extracted/*
strings extracted/* | grep -i flag

Flag

HTB{<redacted>}

Tools Used

• Wireshark — GUI-based packet analysis and traffic inspection
• tcpdump — Command-line packet capture and filtering
• tshark — Wireshark’s command-line companion for automated analysis
• strings — Extract printable strings from binary data

Key Learnings

1. Packet Analysis Fundamentals — Understanding how to navigate PCAP files and filter traffic is essential for forensic investigations
2. Protocol Understanding — Knowledge of TCP/IP, DNS, HTTP, and other protocols helps identify anomalous behavior
3. Data Extraction — Network forensics often requires extracting and reconstructing data from packet payloads
4. Systematic Approach — Following a methodical process (capture → filter → extract → analyze) ensures no evidence is missed
5. Tool Proficiency — Mastery of Wireshark and command-line tools significantly speeds up analysis