Hack The Box · Forensics
Marshal in the Middle
Decrypting captured TLS traffic to determine what an attacker exfiltrated from a production web server.
Challenge details
| Name | Marshal in the Middle |
|---|---|
| Hint | The security team was alerted to suspicious network activity from a production web server. Can you determine whether any data was stolen and what it was? |
| Difficulty | Medium · Retired [0] |
| Rated difficulty |  |
| First blood | trackdrew |
| Creator | rotarydrone |
Identify the suspicious host
The challenge provides eight log files, a bundle.pem file, and a packet capture. The first useful lead appears in dns.log.
The connections between 10.10.20.13 and 10.10.20.1 suggest that 10.10.20.13 is the attacker. Filtering the capture on that address shows traffic involving 10.10.99.42, DNS queries to 10.10.20.1, and evidence that /etc/passwd was sent to Pastebin.
Decrypt the TLS traffic
Most of the remaining traffic is encrypted. The supplied bundle.pem and the pre-shared master key from secrets.log allow Wireshark to decrypt it. In Wireshark, open Edit → Preferences → Protocols → TLS, add bundle.pem to the RSA key list, and add secrets.log to the pre-master-secret log field.
After applying the keys, inspect the first packet following the TLS Server Hello at frame 5666. The decrypted stream shows that frame 5725 contains the /etc/passwd data and that POST /api/api_post.php transmitted it.
Attacker IP: 10.10.20.13
Endpoint: /api/api_post.php
Protocol: HTTPFiltering on the attacker IP and HTTP leaves nine results. Three requests target /api/api_post.php; frame 5725 is already known to contain /etc/passwd.
Recover the stolen data
Frame 7039 contains /etc/shadow, but the final answer is in frame 9887. That stream includes American Express data and additional sensitive records. Following the TLS stream reveals the complete output.
Flag: HTB{Th15_15_4_F3nD3r_Rh0d35_M0m3NT!!}