{"id":194,"date":"2023-06-11T09:00:00","date_gmt":"2023-06-11T09:00:00","guid":{"rendered":"http:\/\/justruss.tech\/index.php\/2023\/06\/11\/rogue-htb-forensics-easy\/"},"modified":"2026-05-13T12:59:35","modified_gmt":"2026-05-13T12:59:35","slug":"rogue-htb-forensics-easy","status":"publish","type":"post","link":"https:\/\/justruss.tech\/index.php\/2023\/06\/11\/rogue-htb-forensics-easy\/","title":{"rendered":"Rogue | HTB Forensics (Easy)"},"content":{"rendered":"<p>Rogue is an Easy-rated HackTheBox Forensics challenge. You receive a single packet capture file. Three flags are hidden across three different protocol-level credential theft and data exfiltration scenarios. The Easy rating reflects that the<br \/>\ntechniques are well-documented \u2014 but encountering DNS tunnelling for the first time makes Flag 3 anything but easy.<\/p>\n<h3>Initial pcap triage<\/h3>\n<pre># Capinfos gives a summary without opening the full file\ncapinfos rogue.pcap\n# File name:           rogue.pcap\n# File type:           Wireshark\/tcpdump\/... - pcap\n# File encapsulation:  Ethernet\n# Packet size limit:   65535 bytes\n# Number of packets:   8472\n# File size:           2456 kB\n# Data size:           2432 kB\n# Duration:            312.543 secs\n# Start time:          2023-06-10 14:22:10\n# End time:            2023-06-10 14:27:22\n\n# Protocol breakdown\ntshark -r rogue.pcap -q -z io,phs\n# eth\n#   ip\n#     tcp\n#       ftp         &lt;-- cleartext credentials\n#       ftp-data    &lt;-- file transfer\n#       http        &lt;-- cleartext form submission\n#     udp\n#       dns         &lt;-- tunnelling<\/pre>\n<h3>Flag 1 \u2014 FTP credentials<\/h3>\n<p>FTP sends credentials in plaintext in the USER and PASS commands. Extract them directly:<\/p>\n<pre>tshark -r rogue.pcap -Y \"ftp.request.command == USER || ftp.request.command == PASS\" \\\n  -T fields -e frame.number -e ftp.request.command -e ftp.request.arg\n\n# Output:\n# 23    USER    ftpuser\n# 25    PASS    s3cur3_ftp_p4ssw0rd\n\n# Follow the full FTP session to see what was transferred:\ntshark -r rogue.pcap -Y \"ftp or ftp-data\" -T fields \\\n  -e frame.time -e ftp.request.command -e ftp.request.arg -e ftp.response.code \\\n  | head -30\n\n# Shows: LIST, RETR credentials.txt, QUIT<\/pre>\n<p>The downloaded file <code>credentials.txt<\/code> contained Flag 1: <code>HTB{ftp_cr3d5_1n_pl41nt3xt}<\/code><\/p>\n<h3>Flag 2 \u2014 HTTP form POST<\/h3>\n<pre># Find all HTTP POST requests\ntshark -r rogue.pcap -Y \"http.request.method == POST\" \\\n  -T fields -e frame.number -e http.request.uri -e http.file_data\n\n# Output:\n# 1204  \/login  username=admin&amp;password=HTB%7Bhttp_f0rm_p0st_l0g1n%7D&amp;submit=Login<\/pre>\n<p>URL-decode the password field: <code>HTB{http_f0rm_p0st_l0g1n}<\/code> \u2014 that is Flag 2. The credentials were transmitted in the HTTP POST body without TLS, fully visible to any network observer.<\/p>\n<h3>Flag 3 \u2014 DNS tunnelling<\/h3>\n<p>DNS tunnelling encodes data in DNS query names. The receiving server decodes the subdomain labels and reassembles the data stream. It is commonly used for both C2 and data exfiltration because DNS traffic is rarely blocked outbound.<\/p>\n<pre># Find DNS queries with unusually long names\ntshark -r rogue.pcap -Y \"dns.qry.type == 1\" \\\n  -T fields -e dns.qry.name \\\n  | awk \"length($0) &gt; 30\" | head -20\n\n# Output:\n# 5a6d566b4c6d703062484d.tunnel.justruss.htb\n# 7550356c5a585139644739.tunnel.justruss.htb\n# 774b564852684c6d5a3159.tunnel.justruss.htb\n# 57585a7a6332387a.tunnel.justruss.htb<\/pre>\n<p>The subdomains before <code>.tunnel.justruss.htb<\/code> are hex-encoded data. Extract and reassemble them in order:<\/p>\n<pre>tshark -r rogue.pcap -Y \"dns.qry.type == 1 and dns.qry.name contains tunnel.justruss.htb\" \\\n  -T fields -e dns.qry.name -e frame.time_relative \\\n  | sort -k2 -n \\\n  | awk \"{print $1}\" \\\n  | sed \"s\/.tunnel.justruss.htb\/\/\" \\\n  | tr -d \"\\n\" \\\n  | xxd -r -p\n\n# Output: HTB{dns_tunn3l_d4t4_3xf1l}<\/pre>\n<h3>Detection perspective<\/h3>\n<p>From a defender standpoint, all three techniques are straightforward to detect with the right logging:<\/p>\n<ul>\n<li>FTP authentication events in firewall\/proxy logs; any FTP session to a non-approved server is suspicious<\/li>\n<li>HTTP POST to login endpoints without TLS \u2014 enforce HTTPS, log all plain HTTP outbound<\/li>\n<li>DNS: query length threshold alerts (names over 50 characters), high query rate to a single domain, queries containing hex-like subdomains<\/li>\n<\/ul>\n<pre># Zeek dns.log query for tunnelling indicators:\ncat dns.log | zeek-cut ts query answers \\\n  | awk -F\"\\t\" \"length($2) &gt; 50 {print $1, length($2), $2}\" \\\n  | sort -k2 -rn | head -20<\/pre>\n","protected":false},"excerpt":{"rendered":"<p>A pcap analysis challenge where credentials get stolen over an unencrypted protocol.<\/p>\n","protected":false},"author":0,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[],"class_list":["post-194","post","type-post","status-publish","format-standard","hentry","category-hackthebox"],"_links":{"self":[{"href":"https:\/\/justruss.tech\/index.php\/wp-json\/wp\/v2\/posts\/194","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/justruss.tech\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/justruss.tech\/index.php\/wp-json\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/justruss.tech\/index.php\/wp-json\/wp\/v2\/comments?post=194"}],"version-history":[{"count":2,"href":"https:\/\/justruss.tech\/index.php\/wp-json\/wp\/v2\/posts\/194\/revisions"}],"predecessor-version":[{"id":236,"href":"https:\/\/justruss.tech\/index.php\/wp-json\/wp\/v2\/posts\/194\/revisions\/236"}],"wp:attachment":[{"href":"https:\/\/justruss.tech\/index.php\/wp-json\/wp\/v2\/media?parent=194"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/justruss.tech\/index.php\/wp-json\/wp\/v2\/categories?post=194"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/justruss.tech\/index.php\/wp-json\/wp\/v2\/tags?post=194"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}