Chase

Platform: HackTheBox | Category: Forensics | Difficulty: Easy | Author: D3v0o0Nu11 | Date: 2026-02-10

Description

One of our web servers triggered an AV alert, but none of the sysadmins say they were logged onto it. We've taken a network capture before shutting the server down to take a clone of the disk. Can you take a look at the PCAP and see if anything is up?

Solution Approach

Core idea: Identify the weakness from source review or fingerprinting first. Iterate with incremental payloads instead of guessing.

Steps

1. First, unzip the .zip file given.

2. Now open the .pcapng file in wireshark.

3. Let's follow the tcp stream.

4. Based on it we can conclude that the webserver IP Address is 22.22.22.5.

5. We know that the attacker uploaded a webshell (?) with the authKey=admin.

6. Next, the attacker executed a command line.

7. Then download the netcat.exe via certutil.

8. Now let's follow this TCP stream.

9. Based from it, we know the attacker executed whoami and ipconfig.

10. Then the attacker upload a .txt file twice.

11. By using powershell and certutil.

12. To see what's inside the .txt file, i filtered the tcp stream to 5.

13. Nothing interesting from the inside.

14. I kind of lucky, because i think the filename is look like a encoded text (?)

15. I pasted the text to cyberchef and got this result.

16. Turns out the text is encoded in base32.

17. Got the flag!

Flag

REDACTED

Lessons Learned

1. Identify the weakness from source review or fingerprinting first.
2. Iterate with incremental payloads instead of guessing.
3. Reuse the same pattern in future engagements.