Keep Tryin'

Platform: HackTheBox | Category: Forensics | Difficulty: Easy | Author: D3v0o0Nu11 | Date: 2026-02-10

Description

This packet capture seems to show some suspicious traffic

Solution Approach

Core idea: Identify the weakness from source review or fingerprinting first. Iterate with incremental payloads instead of guessing.

Steps

1. First, unzip the .zip file given.

2. Notice there's 2 packets with url-encoded.

3. After open both, one of them have this encoded base64 strings.

4. Hmm.. The DNS packets caught my attention here.

5. Let's try to decode this strings.

6. Now let's follow this request.

OUR INTEREST

1. When i pasted that on cyberchef, we got nothing.

2. Then, when i checking the packets, found a request sent to /flag.

3. Let's focus on the DNS packets here, based on the packets and results we got here, what comes to my mind is, we need to do DNS Exfiltration, but before use that approach, let's try to find an easy way to solve this (if there is).

4. Well the previous text we got must be base64 text, but there are . that got in the way and makes it looks corrupted.

5. Let's remove the domain name and the . also the text behind it (first) and in front of it (last).

0ejXWsr6TH-P_1xkEstaVwi7WDy8AcxufnGotWXH3ckb2Lh5A-qFljIWOAOLUS0?T1W8P4CpiCZbCM7_QKcv-r0JG29RpsyYY5YkZRxo7YDIYUJpHlGgxu5PWV1G_DA?KNrmnrktfbeDgzcpPJBjPTeMYx3Qs1Q6bAuFhROWXemJ80gPTYIz0xl8usJQN3m

1. Well i tried to read the forum and found out that sometext related to RC4 (?)

2. What comes to my mind is let's add RC4 to the cyberchef and use TryHarder as the key.

3. Great! Based from the header we know it's a zip file.

HEADER

https://users.cs.jmu.edu/buchhofp/forensics/formats/pkzip.html

1. Let's add unzip.

2. One file found.

3. Got the flag!

Flag

REDACTED

Lessons Learned

1. Identify the weakness from source review or fingerprinting first.
2. Iterate with incremental payloads instead of guessing.
3. Reuse the same pattern in future engagements.