{
  "id": 113880,
  "title": "TryHackMe : Packed Light Writeup",
  "url": "https://urgent.news/2026/08/04/tryhackme-packed-light-writeup",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-04T04:06:29.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/exploitnotes/tryhackme-packed-light-writeup-1n39"
  },
  "original_language": "en",
  "account": "The given capture reveals a victim host downloading a Python keylogger from an attacker-controlled server. The keylogger XOR-encrypts every keystroke with a hardcoded key, base64-encodes it, and exfiltrates it via an HTTP Cookie header in GET requests to the same host. By replaying the XOR/base64 scheme against the 30 exfiltrated requests, the flag can be recovered. The flag is: THM{[REDACTED]}. The capture shows numerous HTTP requests to a non-standard host, which led to the discovery of the keylogger exfiltration. The Python keylogger, disguised as a \"hotel sync service,\" captures keystrokes, XOR-encrypts them with the key 'H', and sends the encoded data as a cookie to the C2 server. By analyzing the cookie values, the flag can be obtained by decoding the XOR/base64 scheme.",
  "summary": "TL;DR A .pcapng capture shows a victim host on 192.168.1.141 downloading a Python keylogger ( updates.py ) from an attacker-controlled \"hotel update server\" at byte-lotus-hotel.thm:8080 ( 34.41.103.191 ). The script XOR-encrypts every keystroke with a hardcoded key, base64-encodes it, and exfiltrates it inside an HTTP Cookie header on a GET request back to the same host. Replaying that XOR/base64…",
  "key_points": [
    "Victim downloads Python keylogger from attacker-controlled server",
    "Keylogger XOR-encrypts keystrokes with hardcoded key 'H'",
    "Flag recovered by replaying XOR/base64 scheme on 30 exfiltrated requests"
  ],
  "editors_take": "The discovery of the keylogger's XOR/base64 exfiltration scheme in the HTTP requests allows for the recovery of the flag, indicating a vulnerability in the victim host's communication with the attacker-controlled server.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}