Chase

Name: Chase
Hint: One of our web servers triggered an AV alert, but none of the sysadmins say they were logged onto it. We've taken a network capture before shutting the server down to take a clone of the disk. Can you take a look at the PCAP and see if anything is up?
Base Points: Easy - Retired [0]
Rated Difficulty:
HTB-Bot
Creator: felamos

Download and unzip the file and check the hint:

 

Hint: One of our web servers triggered an AV alert, but none of the sysadmins say they were logged onto it. We've taken a network capture before shutting the server down to take a clone of the disk. Can you take a look at the PCAP and see if anything is up?

 

Files: chase.pcapng

 

Opening the PCAP Next Generation (pcapng) file, we search through the packets and find an unual GET request to a .txt file with an odd string name.

Taking that filename (JBKEE62NIFXF6ODMOUZV6NZTMFGV6URQMNMH2IBA) and running it through CyberChef and using the "Magic" recipe easily gets us the flag.

HTB{MAn_8lu3_73aM_R0cX}

 

"Chase"ing this down was a cinch!

.......

I couldn't resist the Dad joke XD