Shush Protocol

Platform: HackTheBox | Category: Forensics | Type: Challenge | Difficulty: Easy | OS: NA | Author: D3v0o0Nu11 | Date: 2026-01-28 | Status: Solved Techniques: data_extraction, protocol_analysis

Summary

Task: Analyze network traffic with Modbus/TCP packets. Solution: Filter for custom function code 102, extract hex data from Modbus Data field, decode to ASCII to get the flag.

Recon

Port scan

 bash read-only • copy allowed Copy
nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: hackthebox | ID: 20260128_hackthebox_shush_protocol
• Tags: pcap, tshark, modbus, custom-protocol
• Indicators: Modbus function code 102, hex string in data field
• Source: 20260128_hackthebox_shush_protocol.md

Foothold

Vulnerability / Misconfiguration

1. data_extraction
2. protocol_analysis

 bash read-only • copy allowed Copy
<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

 bash read-only • copy allowed Copy
sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

 bash read-only • copy allowed Copy
<command>

Flags

Key Takeaways / Lessons

• data_extraction
• protocol_analysis
• Tags: pcap, tshark, modbus, custom-protocol

Original Writeup

<details><summary>Click to expand original content</summary>

Description

Analysis of network traffic containing standard Modbus/TCP packets and unusual transactions with a custom function code.

Analysis

In the provided traffic.pcapng file, Modbus/TCP traffic is observed. Standard Modbus functions (e.g., 1 — Read Coils, 3 — Read Holding Registers) are used for legitimate activity, however packets with function code 102 (0x66) stand out among them.

Using tshark or Wireshark filters allows quick isolation of these packets:

 bash read-only • copy allowed Copy
tshark -r traffic.pcapng -Y "mbtcp.func_code == 102"

Upon detailed examination of packets with code 102, it was noticed that they contain data in the Modbus Data field. In particular, frame 35 contains a long hexadecimal string.

Solution

1. Open the file in Wireshark or use tshark to extract data from frame 35.
2. Find the Modbus data field: 4854427b35306d3337316d33355f63753537306d5f70323037306330315f3432335f6e30375f336e30753968377d.
3. Decode the hex string to ASCII.

 python read-only • copy allowed Copy
hex_data = "4854427b35306d3337316d33355f63753537306d5f70323037306330315f3432335f6e30375f336e30753968377d"
flag = bytes.fromhex(hex_data).decode('utf-8')
print(flag)

Result: HTB{REDACTED}

</details>

---

signed by XESXOR