Chase
| Name | Chase |
|---|---|
| Hint | One of our web servers triggered an AV alert, but none of the sysadmins say they were logged onto it. We've taken a network capture before shutting the server down to take a clone of the disk. Can you take a look at the PCAP and see if anything is up? |
| Difficulty | Easy - Retired [0] |
| Rated difficulty |  |
| First blood | HTB-Bot |
| Creator | felamos |
Download and unzip the file and check the hint.
File: chase.pcapng
Opening the PCAP Next Generation file, we search through the packets and find an unusual GET request to a .txt file with an odd string name.
Taking that filename, JBKEE62NIFXF6ODMOUZV6NZTMFGV6URQMNMH2IBA, and running it through CyberChef with the Magic recipe easily gets us the flag.
HTB{MAn_8lu3_73aM_R0cX}
"Chase"ing this down was a cinch!
....... I couldn't resist the Dad joke XD