RedTrails

hackthebox

Task: analyze a pcap of a Redis server attack to find a three-part flag hidden across data exfiltration, obfuscated bash malware, and AES-encrypted command output. Solution: parse Redis RESP protocol for flag part in user email, deobfuscate reversed-base64 bash script for SSH key comment, reverse engineer .so module to extract AES-256-CBC key/IV and decrypt system.exec responses.