Masks Off

hackthebox

Task: a single PCAP capturing a custom C2 implant (ic2kp) download, an encrypted reverse-shell session, and a multipart exfiltration of a password-protected Firefox profile zip. Solution: reverse the stripped ELF to recover its software AES-128-CBC + HMAC-SHA1 protocol, decrypt the C2 session with continuous CBC chaining to recover the zip password, then firefox_decrypt the key4.db/logins.json to read the attacker's stored C2 panel credential, which is the flag.

pcap network_forensics aes_cbc malware_analysis c2 reverse_shell password_protected_zip hmac_sha1 software_aes firefox_credentials nss key4_db logins_json http_object_export multipart_exfiltration

$ ls tags/ techniques/

pcap network_forensics aes_cbc malware_analysis c2 reverse_shell password_protected_zip hmac_sha1 software_aes firefox_credentials nss key4_db logins_json http_object_export multipart_exfiltration

$ cat /etc/rate-limit

Rate limit reached (20 reads/hour per IP). Showing preview only — full content returns at the next hour roll-over.

Masks Off — HackTheBox

Description

Valentine's Day themed. A forensics analyst broke up with their "security engineer" partner after discovering years of spying. The partner is a malware-developing vigilante hacker; you are the forensics analyst. A single PCAP is provided.

English summary: We are given one packet capture. It contains a malware download, an encrypted command-and-control (C2) reverse shell, and a data-exfiltration upload. The flag is not in the traffic in cleartext — it must be recovered by reversing the custom C2 implant, decrypting the session to learn an archive password, and finally decrypting saved Firefox credentials from the exfiltrated profile.

Analysis

Stage 0 — Setup

challenge.zip is password-protected. The standard HTB password hackthebox extracts capture.pcap (776 packets, ~151 KB, captured 2022-02-05).

Stage 1 — PCAP triage

capinfos capture.pcap
tshark -r capture.pcap -z conv,tcp -q
tshark -r capture.pcap -z io,phs -q

Three TCP streams are present. The protocol hierarchy shows http carrying an embedded elf and a mime_multipart body:

Stream	Port	Direction	Content
0	80	HTTP `GET /ic2kp`	Victim downloads a 9777-byte ELF C2 implant
1	1234	bidirectional encrypted	C2 reverse shell
2	8000	HTTP `POST` multipart/form-data	Exfiltration of `b12gb.zip`

Hosts: victim (connect-back) 192.168.1.11; attacker listener 192.168.1.4:1234.

The implant ELF is 64-bit x86-64, PIE, stripped, dynamically linked, with no OpenSSL imports — meaning all cryptography is implemented in software.

Export HTTP objects:

tshark -r capture.pcap --export-objects http,http_objects/

This yields ic2kp (the implant ELF) and the multipart POST body.

Stage 2 — Recover the exfiltrated archive

The POST body is multipart form-data. Carve from the first PK\x03\x04 to obtain b12gb.zip:

...