Phreaky - HackTheBox Challenge Writeup

Challenge Information

Description

In the shadowed realm where the Phreaks hold sway, a mole lurks within leading them astray. Sending keys to the Talents, so sly and so slick, a network packet capture must reveal the trick. Through data and bytes, the sleuth seeks the sign, decrypting messages, crossing the line. The traitor unveiled, with nowhere to hide, betrayal confirmed, they’d no longer abide.

This challenge presents a forensic investigation scenario involving:

• Network traffic analysis from a packet capture file
• Identification of a mole within an organization
• Message decryption and data exfiltration detection
• Uncovering hidden communications and betrayal

Solution Overview

The challenge requires analyzing network traffic to identify suspicious communications and decrypt hidden messages that reveal the identity of the traitor within the organization.

Key Steps

1. Obtain and Examine the Packet Capture

Begin by extracting and analyzing the provided .pcap or .pcapng file:

# List available files in the challenge directory
ls -la

# Open the packet capture with Wireshark for GUI analysis
wireshark capture.pcap

# Or use command-line tools for analysis
tcpdump -r capture.pcap -v

2. Filter and Identify Suspicious Traffic

Look for unusual network patterns, particularly focusing on:

# Extract DNS queries to identify C2 communications
tcpdump -r capture.pcap -A 'udp port 53' | grep -i phreaky

# Look for HTTP/HTTPS traffic with exfiltration patterns
tcpdump -r capture.pcap -A 'tcp port 80 or tcp port 443'

# Identify potential encoded or encrypted payloads
strings capture.pcap | grep -i key

3. Decrypt Communications

Analyze extracted data for encryption keys and decrypt messages:

# Extract potential encryption keys from packets
strings capture.pcap | grep -E "^[A-Za-z0-9+/=]{32,}$"

# Use openssl or similar tools to decrypt found messages
echo "encrypted_data" | openssl enc -d -aes-256-cbc -K "key_hex" -iv "iv_hex" -a

4. Identify the Mole

Cross-reference decrypted communications with user identities and network sources to determine which individual is exfiltrating data to external parties.

Tools Used

• Wireshark — GUI-based packet capture analysis
• tcpdump — Command-line packet capture inspection
• strings — Extract readable strings from binary data
• OpenSSL — Encryption/decryption operations
• grep/sed/awk — Text processing and pattern matching

Key Learnings

1. Packet Analysis Fundamentals — Understanding how to filter and examine network traffic reveals hidden communications
2. Encryption Recognition — Identifying encryption algorithms and key material within captured packets
3. Data Exfiltration Patterns — Recognizing suspicious outbound connections and unusual data transfers
4. Credential Identification — Network captures may contain plaintext or weakly encrypted credentials
5. Timeline Reconstruction — Packet timestamps help establish the sequence and scope of malicious activity

Note: This writeup is based on challenge metadata. The actual solution implementation would depend on the specific contents of the provided packet capture file and encryption methods used within the challenge.