Fishy HTTP

Author: 0xIDA

Solvers

• analyze_fishy.py

Platform: HTB · Category: forensics · Difficulty: Easy

Summary

C2 over HTTP where commands are smuggled in HTML structure (tag-to-hex mapping → binary) and command output is returned as base64 encoded via first-letter-of-word encoding in POST feedback form fields. Flag has two parts.

Solution

Step 1: PCAP triage

sustraffic.pcapng shows a client (10.142.0.4) talking to C2 (10.142.0.3:80):

1. GET / → HTML page (encoded command)
2. POST /submit_feedback → word-encoded command output
3. Repeat for several commands

Also provided: smphost.exe (.NET 8 single-file, MyNamespace.Program).

Step 2: Decode POST feedback (part 2)

Each feedback value is space-separated words. Take the first character of each word (digits stay as-is), get base64, decode:

Round	Decoded output
1	windows-instance\pakcyberbot (whoami)
2	full systeminfo
3	dir C:\Temp + 'h77P_s73417hy_revSHELL}'
4	dir C:\Temp again

Part 2 of the flag is the payload after the directory listing:

h77P_s73417hy_revSHELL}

(Leetspeak: HTTP stealthy revSHELL.)

Step 3: Reverse the HTML command channel (part 1)

The malware maps HTML tag names to hex nibbles, then HexStringToBytes to recover the command. Tags used include:

cite, h1, img, ul, ol, button, div, span, label, textarea, nav, blockquote, li

Decoding the smuggled command stream (via the tag→hex map recovered from the binary / writeup methodology) yields part 1:

Th4ts_d07n37_

Step 4: Combine

HTB{Th4ts_d07n37_h77P_s73417hy_revSHELL}

Verified via HTB MCP flag submission (Congratulations).

Flag

HTB{Th4ts_d07n37_h77P_s73417hy_revSHELL}

Tools Used

• tshark (--export-objects http, stream follow)
• custom Python first-letter base64 decoder
• strings / PE triage on smphost.exe (.NET single-file)
• mcp_htb_submit_challenge_flag