Shush Protocol — HackTheBox

Description

Analysis of network traffic containing standard Modbus/TCP packets and unusual transactions with a custom function code.

Analysis

In the provided traffic.pcapng file, Modbus/TCP traffic is observed. Standard Modbus functions (e.g., 1 — Read Coils, 3 — Read Holding Registers) are used for legitimate activity, however packets with function code 102 (0x66) stand out among them.

Using tshark or Wireshark filters allows quick isolation of these packets:

tshark -r traffic.pcapng -Y "mbtcp.func_code == 102"

Upon detailed examination of packets with code 102, it was noticed that they contain data in the Modbus Data field. In particular, frame 35 contains a long hexadecimal string.

Solution

1. Open the file in Wireshark or use tshark to extract data from frame 35.
2. Find the Modbus data field: 4854427b35306d3337316d33355f63753537306d5f70323037306330315f3432335f6e30375f336e30753968377d.
3. Decode the hex string to ASCII.

hex_data = "4854427b35306d3337316d33355f63753537306d5f70323037306330315f3432335f6e30375f336e30753968377d"
flag = bytes.fromhex(hex_data).decode('utf-8')
print(flag)

Result: HTB{REDACTED}