Hacker Holidays 2026 – Day 4 Packed Light

Bybwright

Room Briefing Tiny packets. Odd hours. Suspiciously regular. Someone’s smuggling out the data equivalent of a hotel towel every night, folded neatly inside traffic that looks ordinary until you decode it. A short capture from the guest network is all VERA could pull before the connection dropped. Somewhere in that traffic, a quiet little errand is running on a loop, and it isn’t part of any service the hotel actually offers.

Objective

  • Analyse the provided capture for a covert communication channel
  • Identify where the exfiltrated data is being hidden and reassemble it
  • Decode the recovered data and submit the flag

1. Initial Inspection

Open traffic.pcapng in Wireshark (or tshark). Filter on HTTP:

http

You will notice a series of requests that all share the same distinctive User-Agent:

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) ByteLotusClient/1.1

Each of these requests also carries a cookie that looks almost legitimate at first glance:

Cookie: hotel_sess_state=HA==

The cookie values are short, Base64-looking strings that change with every request. This is the covert channel.

2. Extracting the Cookie Values

Extract every hotel_sess_state value in packet order. There are exactly 30 of them:

HA==
AA==
BQ==
Mw==
Hg==
ew==
Og==
fA==
Fw==
eQ==
Ow==
Fw==
Pw==
fA==
PA==
Kw==
IA==
eQ==
Jg==
Lw==
Fw==
eA==
Pg==
LQ==
Gg==
Fw==
MQ==
eA==
PQ==
NQ==

3. Decoding the Channel

Each value is a single byte that has been Base64-encoded. After decoding you get:

0x1c 0x00 0x05 0x33 0x1e 0x7b 0x3a 0x7c 0x17 0x79
0x3b 0x17 0x3f 0x7c 0x3c 0x2b 0x20 0x79 0x26 0x2f
0x17 0x78 0x3e 0x2d 0x1a 0x17 0x31 0x78 0x3d 0x35

These bytes are XOR-encrypted with the single-byte key 0x48 (the ASCII character H).

Python

encrypted_bytes = [0x1c, 0x00, 0x05, ...]   # the list above
flag = "".join(chr(b ^ 0x48) for b in encrypted_bytes)
print(flag)

Result:

FLAG

4. Why This Works

  • The client (masquerading as ByteLotusClient/1.1) takes one character of the secret at a time.
  • It XORs that character with H (0x48).
  • It Base64-encodes the resulting single byte.
  • It places the result into the hotel_sess_state cookie and sends a normal-looking HTTP request.

Because each cookie carries only one encrypted byte, the traffic looks sparse and routine — perfect for a low-and-slow exfiltration channel.

Summary Path

PCAP
 → HTTP traffic (User-Agent: ByteLotusClient/1.1)
 → hotel_sess_state cookies (in order)
 → Base64 decode → single encrypted byte
 → XOR with 0x48 ('H')
 → Reassemble characters
 → FLAG

Key takeaway HTTP cookies and custom User-Agent strings are excellent places to hide data. Always inspect them when a capture looks “almost normal.”

Similar Posts