Шифт

Platform: hackerlab | Category: Forensics | Type: Challenge | Difficulty: Medium | OS: NA | Author: XESXOR | Date: 2026-01-06 | Status: Solved Techniques: byte_reversal, pcap_extraction, row_alignment_correlation

Summary

Task: Analyze suspicious traffic to find evidence of compromise. Solution: Extract reversed JPEG from pcap, reverse bytes to restore, then fix horizontal row shifts using correlation-based alignment to reveal the flag.

Шифт — HackerLab

Description

Analysis of suspicious employee traffic to find evidence of internal service compromise.

Analysis

1. Traffic analysis: HTTP traffic to host s1ckly.ru:65535 was discovered in the provided attack.pcapng file.
2. Interaction: The attacker interacted with tinyfilemanager.php, indicating the use of a web shell-like interface for file management.
3. Data extraction: The file d3fac3d.jpg was extracted from the traffic.
4. File recovery: When attempting to open the file, it turned out that its structure was corrupted. Byte analysis showed that the file was completely reversed (byte-level reverse). After reversing the bytes again, an image file was obtained.
5. Image distortion: The resulting image was heavily distorted — rows were shifted horizontally, creating an "interlacing" or strong tilt effect, making the text unreadable. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Solution

Step 1: Byte restoration

 python read-only • copy allowed Copy
with open('d3fac3d.jpg', 'rb') as f:
    data = f.read()
with open('restored.jpg', 'wb') as f:
    f.write(data[::-1])

Step 2: Row alignment

To restore the image, a script was written that iterates through possible cyclic shifts for each row, maximizing correlation (minimum difference) with the previous row.

 python read-only • copy allowed Copy
import numpy as np
from PIL import Image

def solve_shift(input_file, output_file):
    img = Image.open(input_file).convert('RGB')
    data = np.array(img)
    h, w, c = data.shape
‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

    fixed = np.zeros_like(data)
    fixed[0] = data[0]

    for i in range(1, h):
        prev_row = fixed[i-1].astype(np.int16)
        current_row = data[i]
        
        best_shift = 0
        min_diff = float('inf')
        
        # Iterate through all possible shifts
        for s in range(w):
            shifted = np.roll(current_row, s, axis=0)
            diff = np.sum(np.abs(prev_row - shifted.astype(np.int16)))
            
            if diff < min_diff:
                min_diff = diff
                best_shift = s
        
        fixed[i] = np.roll(current_row, best_shift, axis=0)
        if i % 100 == 0:
            print(f"Processed {i}/{h} rows...")
‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

    Image.fromarray(fixed).save(output_file)

if __name__ == "__main__":
    solve_shift('restored.jpg', 'flag_aligned.jpg')

After running the script, the flag became clearly visible in the bottom right corner of the resulting image. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍