Shush Protocol

Platform: HackTheBox | Category: Forensics | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-01-28 | Status: Solved Techniques: data_extraction, protocol_analysis

Summary

Task: Analyze network traffic with Modbus/TCP packets. Solution: Filter for custom function code 102, extract hex data from Modbus Data field, decode to ASCII to get the flag.

Shush Protocol — HackTheBox

Description

Analysis of network traffic containing standard Modbus/TCP packets and unusual transactions with a custom function code.

Analysis

In the provided traffic.pcapng file, Modbus/TCP traffic is observed. Standard Modbus functions (e.g., 1 — Read Coils, 3 — Read Holding Registers) are used for legitimate activity, however packets with function code 102 (0x66) stand out among them.

Using tshark or Wireshark filters allows quick isolation of these packets:

 bash read-only • copy allowed Copy
tshark -r traffic.pcapng -Y "mbtcp.func_code == 102"

Upon detailed examination of packets with code 102, it was noticed that they contain data in the Modbus Data field. In particular, frame 35 contains a long hexadecimal string.

Solution

1. Open the file in Wireshark or use tshark to extract data from frame 35.
2. Find the Modbus data field: 4854427b35306d3337316d33355f63753537306d5f70323037306330315f3432335f6e30375f336e30753968377d.
3. Decode the hex string to ASCII.

 python read-only • copy allowed Copy
hex_data = "4854427b35306d3337316d33355f63753537306d5f70323037306330315f3432335f6e30375f336e30753968377d"
flag = bytes.fromhex(hex_data).decode('utf-8')
print(flag)

Result: HTB{REDACTED}