TryHackMe : Packed Light Writeup
TL;DR A .pcapng capture shows a victim host on 192.168.1.141 downloading a Python keylogger ( updates.py ) from an attacker-controlled "hotel update server" at byte-lotus-hotel.thm:8080 ( 34.41.103.191 ). The script XOR-encrypts every keystroke with a hardcoded key, base64-encodes it, and exfiltrates it inside an HTTP Cookie header on a GET request back to the same host. Replaying that XOR/base64…
The given capture reveals a victim host downloading a Python keylogger from an attacker-controlled server. The keylogger XOR-encrypts every keystroke with a hardcoded key, base64-encodes it, and exfiltrates it via an HTTP Cookie header in GET requests to the same host. By replaying the XOR/base64 scheme against the 30 exfiltrated requests, the flag can be recovered.
The flag is: THM{[REDACTED]}. The capture shows numerous HTTP requests to a non-standard host, which led to the discovery of the keylogger exfiltration. The Python keylogger, disguised as a "hotel sync service," captures keystrokes, XOR-encrypts them with the key 'H', and sends the encoded data as a cookie to the C2 server. By analyzing the cookie values, the flag can be obtained by decoding the XOR/base64 scheme.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
