← Back to Writeups
HTBEasySOC/DFIR
Bookmark

OpTinselTrace-4

D3v0o0Nu119/2/20265 min read
#soc/dfir#htb#easy

OpTinselTrace-4

Platform: HackTheBox | Type: SOC/DFIR | Difficulty: Easy | Author: D3v0o0Nu11 | Date: 2026-02-10

Scenario

Printers are important in Santa’s workshops, but we haven’t really tried to secure them! The Grinch and his team of elite hackers may try and use this against us! Please investigate using the packet capture provided! The printer server IP Address is 192.168.68.128.

Key Questions

  1. What indicators of compromise exist?
  2. What attack chain / MITRE techniques were used?
  3. What is the full timeline?

Investigation Timeline

TimeEventEvidence / Source
—In this challenge, we're given a packet capture of printer activities for IP 192.168.68.128.
—To identify which IP address has an excessive amount of traffic to the printer server, we can check by go to **statis...
—Based from the results above, we can identified 2 IPs with the most activities.
—We can conclude that IP --> 172.17.79.132 is the answer.
—Next, to identify which port was then targeted for initial compromise of the printer, we can start by filter the sour...
—Based from the description, the printer's IP is 192.168.68.128. Let's start by filter the IP.
—Based from the results above, we found several traffic with SYN flag and the packet bytes are small + request timesta...
—From this evidence, we can conclude the attacker attempted an nmap scans and we start analyzing these packets.
—Scrolling down, we found several ACK response from the nmap scan for port 9100.
—Searching on the internet about default port for service printing, turns out that 9100 is the default port.
—It's clear then, that port 9100 is the port exploited by the attacker. Not only that we identified that the attacker ...
—Upon following the packet stream activity for port 9100, found the printer fullname at packet stream eq 28.

Evidence Analysed

  • Tools: nmap, ssh.
  • Artifacts: per the investigation narrative.

Detailed Investigation

  1. In this challenge, we're given a packet capture of printer activities for IP 192.168.68.128.

1ST QUESTION --> ANS: REDACTED

  1. To identify which IP address has an excessive amount of traffic to the printer server, we can check by go to statistics -> IPv4 Statistics -> All Addresses.

  2. Based from the results above, we can identified 2 IPs with the most activities.

  3. We can conclude that IP --> 172.17.79.132 is the answer.

2ND QUESTION --> ANS: REDACTED

  1. Next, to identify which port was then targeted for initial compromise of the printer, we can start by filter the source ip and analyze for port scanning attempts.

  2. Based from the description, the printer's IP is 192.168.68.128. Let's start by filter the IP.

  3. Based from the results above, we found several traffic with SYN flag and the packet bytes are small + request timestamp is very close in milisecond.

  4. From this evidence, we can conclude the attacker attempted an nmap scans and we start analyzing these packets.

  5. Scrolling down, we found several ACK response from the nmap scan for port 9100.

  6. Searching on the internet about default port for service printing, turns out that 9100 is the default port.

  7. It's clear then, that port 9100 is the port exploited by the attacker. Not only that we identified that the attacker might be using 2 machine within NAT network remembering the IP used for scanning is --> 172.17.79.133.

3RD QUESTION --> ANS: REDACTED

  1. Upon following the packet stream activity for port 9100, found the printer fullname at packet stream eq 28.

4TH QUESTION --> ANS: REDACTED

  1. To identify the 2nd child on the nice list, simply analyze the packet stream at 28.

  2. It's Douglas Price.

5TH QUESTION --> ANS: REDACTED

  1. Again, analyzing the same packet stream by scrolling down we found a JOB NAME="Elfin-Layoff".
  2. Noticed there's a reason for Elfin's layoff, that should be the word rationale behind the decision to terminate Elfin's employment.

6TH QUESTION --> ANS: REDACTED

  1. Upon analyzing the packet stream at 46, we can found a scheduled printjob named MerryChristmas+BonusAnnouncment.

7TH QUESTION --> ANS: REDACTED

  1. Scrolling down the packet stream, we can identify an id_rsa key which might be used by the attacker to do lateral movement.
  2. Based from the commented sentences, we can conclude that this is the path of the file on the printer server that enabled the Grinch to laterally move to this critical server.

8TH QUESTION --> ANS: REDACTED

  1. To identify the file size, we just need to check the SIZE parameter.

9TH QUESTION --> ANS: REDACTED

  1. The hostname of the other compromised critical server is specified at the commented line --> christmas.gifts.

10TH QUESTION --> ANS: REDACTED

  1. This time I followed another packet stream at 71 and found details that indicate a deletion for a file.

  2. To identify the timestamp simply check the timestamp when the traffic came.

Findings

  1. Persistence mechanism — An autostart/persistence mechanism was established on the host (see timeline).
  2. Initial access — The threat actor established access via the vector described in the investigation steps.
  3. Impact — As documented in the investigation steps.

MITRE ATT&CK Mapping

TacticTechniqueID
Lateral MovementRemote ServicesT1021

Answers / Flags

  • 1ST QUESTION --> ANS: REDACTED
  • 2ND QUESTION --> ANS: REDACTED
  • 3RD QUESTION --> ANS: REDACTED
  • 4TH QUESTION --> ANS: REDACTED
  • 5TH QUESTION --> ANS: REDACTED
  • 6TH QUESTION --> ANS: REDACTED
  • 7TH QUESTION --> ANS: REDACTED
  • 8TH QUESTION --> ANS: REDACTED
  • 9TH QUESTION --> ANS: REDACTED
  • 10TH QUESTION --> ANS: REDACTED

Lessons Learned

  1. Hunt potential attacker's IP.
  2. Identify port scanning attempts.
  3. Printer Hacking Network Forensic.