reversemedium

FFModule

HackTheBox

Task: A Windows PE loader injects XOR-decoded shellcode into Firefox, where it hooks NSS networking code to steal plaintext POST data before TLS encryption. Solution: Reverse the injector and shellcode, identify the custom rolling transform used for UDP exfiltration, and apply the same routine to the embedded marker to recover the flag.

$ ls tags/ techniques/
firefoxxorwindowspe32shellcodeprocess_injectionapi_hashingcrc32cnss3udp_exfiltration
shellcode_unpackingcrc32_api_hash_resolutionfirefox_pr_write_hook_analysiscustom_transform_reversalstatic_flag_recovery
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Create a free account with GitHub to get started.

$ssh [email protected]