← Back to Writeups
CUSTOMMediumForensics
Bookmark

Keys

XESXOR9/2/20262 min read
#forensics#custom#medium#aes_ctr_decryption#key_extraction#packet_carving

Keys

Platform: hackerlab | Category: Forensics | Type: Challenge | Difficulty: Medium | OS: NA | Author: XESXOR | Date: 2026-04-05 | Status: Solved Techniques: aes_ctr_decryption, key_extraction, packet_carving

Summary

Task: a ZIP archive contains a single PCAP with synthetic Ethernet frames carrying HTTP-like traffic to a Havoc-style C2. Solution: carve the AES-256 key and IV from one custom packet, then decrypt a later octet-stream payload with AES-CTR to recover the flag.

Keys — HackerLab

Description

Organizer description was not preserved with the solved files. The provided archive contained keys.zip with a single capture file, traffic.pcap.

English summary: the task is a small traffic-analysis challenge. The goal is to inspect the PCAP, recover the encryption material hidden in one C2 packet, and decrypt another packet to obtain the flag.

Analysis

The ZIP contained only one useful artifact:

  • traffic.pcap

Initial recon of the capture showed synthetic Ethernet frames carrying raw HTTP-like payloads to a Havoc-style C2 endpoint: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

  • evil.c2.example:8080

The important packets were easy to spot because the HTTP-like bodies used application/octet-stream and started with a custom header.

Frame 26: key material

Frame 26 contained this custom packet layout:

 text 
00000036 deadbeef b7d8 <32-byte key> <16-byte IV>

Extracted values:

  • AES-256 key: 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff
  • IV / initial counter: 01020304050607080102030405060708

Frame 343: encrypted flag

Frame 343 contained another octet-stream body: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 text 
00000020 deadbeef b7d8 5533872213aa86a5d323a66629f941d85443043f67e64f1fa929

After stripping the custom header, the remaining bytes were decrypted with AES-CTR using the recovered key and IV.

Solution

  1. Open traffic.pcap and filter for the HTTP-like octet-stream traffic.
  2. Inspect frame 26 and carve the 32-byte AES key and 16-byte IV from the custom packet after deadbeef b7d8.
  3. Inspect frame 343 and extract the ciphertext after the same marker.
  4. Decrypt that ciphertext with AES-256 in CTR mode using the recovered IV as the initial counter value. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Minimal recovery script:

 python 
#!/usr/bin/env python3
from Crypto.Cipher import AES

key = bytes.fromhex("00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff")
iv = bytes.fromhex("01020304050607080102030405060708")
ciphertext = bytes.fromhex("5533872213aa86a5d323a66629f941d85443043f67e64f1fa929")

cipher = AES.new(key, AES.MODE_CTR, nonce=b"", initial_value=int.from_bytes(iv, "big"))
print(cipher.decrypt(ciphertext).decode())

Output:

 text 
CODEBY{REDACTED}

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍