Общение (Communication)

Platform: hackerlab | Category: Forensics | Type: Challenge | Difficulty: Medium | OS: Windows | Author: XESXOR | Date: 2026-01-06 | Status: Solved Techniques: base64_decoding, disassembly, tcp_stream_extraction, xor_decryption

Summary

Task: Analyze suspicious localhost traffic from a pcap file to find a flag. Solution: Extract TCP streams, identify PE malware with XOR encryption (key 0x99), decrypt Base64-encoded C2 messages marked with $$$#...#$$$ delimiters.

Общение (Communication) — HackerLab

Description

После заражения нашей сети мы обнаружили у админа Олега файл, который, предположительного, был вредоносным. Но до этого так же другой админ записал и нашёл подозрительный трафик в Wireshark. После этого он отправил его нам. Вы - эксперт форензики. Помогите нам проанализировать трафик.

Translation: After infecting our network, we found a file on admin Oleg's computer that was presumably malicious. But before that, another admin recorded and found suspicious traffic in Wireshark. After that, he sent it to us. You are a forensics expert. Help us analyze the traffic. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Files: communication.zip containing traffic.pcapng

Analysis

1. Initial Traffic Analysis

Extracted the pcap file and analyzed with tshark:

 bash read-only • copy allowed Copy
unzip communication.zip
tshark -r traffic.pcapng -q -z conv,tcp

Found TCP traffic on port 9123 (localhost to localhost) - a typical pattern for C2 (Command & Control) communication or local malware testing.

2. TCP Stream Extraction

Extracted all 4 TCP streams:

 bash read-only • copy allowed Copy
for i in 0 1 2 3; do
    tshark -r traffic.pcapng -q -z follow,tcp,raw,$i | tail -n +7 | head -n -1 | tr -d '\n' | xxd -r -p > stream_$i.bin
done

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Stream analysis:

3. Malware Analysis (PE File)

Analyzed the PE executable from stream 0:

 bash read-only • copy allowed Copy
file stream_0.bin
# PE32+ executable (console) x86-64, for MS Windows

strings stream_0.bin | grep -i message
# $$$#message#$$$

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Found the message marker format $$$#message#$$$ in the binary strings.

4. Disassembly - Finding the XOR Key

Disassembled the main function to find the encryption algorithm:

 bash read-only • copy allowed Copy
objdump -d stream_0.bin | grep -A 50 "<main>"

Key finding in the disassembly:

 asm read-only • copy allowed Copy
xorl $-0x67, %eax  ; -0x67 in two's complement = 0x99

The malware uses XOR encryption with key 0x99.

5. Encryption Scheme

The communication protocol:

1. Messages are wrapped with markers: $$$# (start) and #$$$ (end)
2. Content between markers is XOR encrypted with key 0x99
3. Result is Base64 encoded ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Solution

Decryption Script

 python read-only • copy allowed Copy
#!/usr/bin/env python3
import base64

def decrypt_message(data):
    """Decrypt C2 message: remove markers, XOR with 0x99, Base64 decode"""
    # Remove markers
    start_marker = b'$$$#'
    end_marker = b'#$$$'
    
    start = data.find(start_marker)
    end = data.find(end_marker)
    
    if start == -1 or end == -1:
        return None
    
    encrypted = data[start + len(start_marker):end]
    
    # XOR decrypt with key 0x99
    xor_key = 0x99
    decrypted = bytes([b ^ xor_key for b in encrypted])
    
    # Base64 decode
    try:
        plaintext = base64.b64decode(decrypted)
        return plaintext.decode('utf-8', errors='replace')
    except:
        return decrypted
‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

# Decrypt streams 1, 2, 3
for i in [1, 2, 3]:
    with open(f'stream_{i}.bin', 'rb') as f:
        data = f.read()
    
    message = decrypt_message(data)
    print(f"=== Stream {i} ===")
    print(message)
    print()

Decrypted Messages

Stream 1:

Attacker discussing gaining foothold in network, mentioning boss has Heroes of Might and Magic III, company accounts and employee data

Stream 2:

Attacker confirming boss has the game installed, planning to copy company data and go to "Paris village in Russia" ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Stream 3:

Warning to be quiet, use secret code, and contains the FLAG

Methodology

1. Traffic Analysis - Identify suspicious streams and protocols
2. Stream Extraction - Separate different data types (binary, text)
3. Malware Reverse Engineering - Find encryption algorithm in binary
4. Protocol Reconstruction - Understand message format and markers
5. Decryption - Apply discovered algorithm to recover plaintext

Related Techniques

• C2 traffic analysis
• Malware reverse engineering
• XOR cipher identification (common in malware)
• Protocol reverse engineering ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍