Зашифрованный трафик (Encrypted Traffic)

Platform: hackerlab | Category: Forensics | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-01-05 | Status: Solved Techniques: binary_strings, file_extraction, http_analysis, tls_decryption, zip_comment_analysis

Summary

Task: Analyze network dump with encrypted TLS traffic and sslkey.log file to find data exfiltration. Solution: Decrypt TLS using NSS Key Log, extract uploaded ZIP from HTTP POST, find password in ZIP comment, extract ELF binary, decode Base64 string to get flag.

Зашифрованный трафик — HackerLab

Description

В нашей компании произошла утечка. Узнайте каким образом злоумышленник слил информацию.

Files: task.zip contains:

• task.pcapng — network dump
• sslkey.log — TLS session keys (NSS Key Log format)

Analysis

Step 1: Initial Examination

Received two files:

• task.pcapng — network capture with encrypted TLS traffic
• sslkey.log — file with pre-master secrets in NSS Key Log format

NSS Key Log format is used by browsers (Firefox, Chrome) to record TLS session keys. Wireshark/tshark can use this file to decrypt traffic. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Step 2: TLS Traffic Decryption

Using tshark with the key file:

 bash read-only • copy allowed Copy
tshark -r task.pcapng -o "tls.keylog_file:sslkey.log" -Y "http" -T fields -e http.request.uri -e http.host

Found HTTP requests to dropmefiles.com (file sharing service):

/s5/upload/create                          dropmefiles.com
/s5/uploadch?name=secret.zip&chunk=0&chunks=1&updir=EB7ZN    dropmefiles.com
/s5/upload/password                        dropmefiles.com
/s5/upload/save                            dropmefiles.com

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

The attacker was uploading secret.zip to a file sharing service!

Step 3: File Extraction

Exporting data from the POST request to /s5/uploadch:

 bash read-only • copy allowed Copy
# Extract hex data from POST request body
tshark -r task.pcapng -o "tls.keylog_file:sslkey.log" \
  -Y "http.request.uri contains uploadch" \
  -T fields -e data.data > upload_hex.txt

# Convert hex to binary file
xxd -r -p upload_hex.txt > secret.zip

Step 4: ZIP Archive Analysis

 bash read-only • copy allowed Copy
$ file secret.zip
secret.zip: Zip archive data, at least v2.0 to extract
‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

$ unzip -l secret.zip
Archive:  secret.zip
  Length      Date    Time    Name
---------  ---------- -----   ----
    16384  2023-09-01 00:00   flag
---------                     -------
    16384                     1 file

$ zipinfo secret.zip
Archive:  secret.zip
Zip file size: 2841 bytes, number of entries: 1
-rwxr-xr-x  3.0 unx    16384 bx defN 23-Sep-01 00:00 flag
1 file, 16384 bytes uncompressed, 2687 bytes compressed:  83.6%

The archive is password-protected! But when viewing the comment: ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

 bash read-only • copy allowed Copy
$ unzip -z secret.zip
Archive:  secret.zip
CODEBY{w3ll_d0n3!}

The ZIP archive comment contains the string CODEBY{w3ll_d0n3!} — this is the password!

Step 5: Extracting the Archive

 bash read-only • copy allowed Copy
$ unzip -P "CODEBY{w3ll_d0n3!}" secret.zip
Archive:  secret.zip
  inflating: flag

$ file flag
flag: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked...

Step 6: Binary Analysis

 bash read-only • copy allowed Copy
$ strings flag | grep -E "^[A-Za-z0-9+/]{20,}={0,2}$"
Q09ERUJZe3Rsc180bmRfdzFyZXNoNHJrXzwzfQ==
‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

$ echo "Q09ERUJZe3Rsc180bmRfdzFyZXNoNHJrXzwzfQ==" | base64 -d
CODEBY{REDACTED}

Solution (script)

 bash read-only • copy allowed Copy
#!/bin/bash
# solve.sh - Solution for "Encrypted Traffic" challenge

PCAP="task.pcapng"
SSLKEY="sslkey.log"

# 1. Decrypt TLS and extract the uploaded file
echo "[*] Extracting uploaded file from TLS traffic..."
tshark -r "$PCAP" -o "tls.keylog_file:$SSLKEY" \
  -Y "http.request.method == POST && http.request.uri contains uploadch" \
  -T fields -e http.file_data 2>/dev/null | xxd -r -p > secret.zip
‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

# 2. Get password from ZIP comment
echo "[*] Extracting ZIP comment (password)..."
ZIP_PASS=$(unzip -z secret.zip 2>/dev/null | tail -1)
echo "[+] Password: $ZIP_PASS"

# 3. Extract the archive
echo "[*] Extracting archive..."
unzip -P "$ZIP_PASS" -o secret.zip -d extracted/

# 4. Search for Base64 in binary
echo "[*] Searching for Base64 in binary..."
B64=$(strings extracted/flag | grep -E "^[A-Za-z0-9+/]{20,}={0,2}$" | head -1)
echo "[+] Found Base64: $B64"

# 5. Decode the flag
FLAG=$(echo "$B64" | base64 -d)
echo "[+] FLAG: $FLAG"

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Tools

Lessons

1. NSS Key Log — standard format for recording TLS session keys. Supported by Wireshark/tshark via the tls.keylog_file option

2. ZIP comments — often used to hide metadata or passwords. Check with unzip -z or zipinfo ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

3. Data exfiltration — attackers often use legitimate file sharing services (dropmefiles, transfer.sh, etc.) to exfiltrate data

4. Multi-layer encoding — typical CTF pattern: ZIP → ELF → Base64 → flag

References

• Wireshark TLS Decryption
• NSS Key Log Format
• tshark Manual ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍