Challenge Context#

BASIT was a network forensics challenge. The PCAP showed an attacker exploiting an internal Apache server and exfiltrating an encrypted archive.

Reconnaissance#

The traffic identified:

1
attacker: 10.0.0.66
2
victim:   10.0.0.10
3
server:   Apache/2.4.49 (Ubuntu)

Apache 2.4.49 is vulnerable to path traversal via CVE-2021-41773 when misconfigured.

Attack Chain#

1
Apache path traversal
2
  -> read /var/www/html/.env
3
  -> recover archive password
4
  -> download bocal.zip
5
  -> decrypt ZIP
6
  -> inspect PNG trailing data
7
  -> extract hidden ZIP
8
  -> recover flag from final image/text

Exploitation#

The traversal used the classic encoded path:

1
/icons/.%2e/%2e%2e/%2e%2e/

The attacker read sensitive files including:

1
/etc/passwd
2
/etc/hostname
3
/var/www/html/.env
4
/var/www/html/.htpasswd

The .env exposed an archive secret. That password decrypted bocal.zip. Inside, bocal.png contained data after the PNG IEND marker: another hidden ZIP. Extracting that second layer led to the final flag.

Nested structure:

1
bocal.zip
2
  -> bocal.png
3
      -> data after IEND
4
          -> hidden ZIP
5
              -> staff.txt / staff.png
6
                  -> flag

Flag#

1
leet{W1r3sh4rk_k1ws1_lh4dr4_1mz47a}

Lesson Learned#

Good PCAP forensics reconstructs the attacker’s path, not just the final artifact. Here the flag only made sense after following traversal, credential disclosure, archive extraction, and PNG stego layers.

Cover: Wallhaven yq8w5k.