Archive 28

CTF 16 Box 6 Web Exploitation 6

185 words

1 minute

1337 Local CTF: Encrypted Callback — TLS 1.3 Decryption → PowerShell Malware

2026-06-27

CTF

1337CTF

CTF

Forensics

TLS13

PowerShell

Malware

Encrypted Callback#

Challenge Context#

The challenge provided a PCAP/PCAPNG and sslkeylog.log. The traffic contained suspicious PowerShell activity over TLS on localhost port 8443.

Reconnaissance#

Important TLS details:

1
cipher suite: TLS_AES_256_GCM_SHA384 (0x1302)
2
server sends NewSessionTicket before HTTP responses
3
HTTP response application-data records start at sequence number 2

Those two details mattered: SHA-384 must be used for HKDF, and TLS record sequence numbers must account for NewSessionTicket records.

Attack Chain#

1
sslkeylog.log
2
  -> TLS 1.3 application-data decryption
3
  -> GET /stage1 response
4
  -> PowerShell -EncodedCommand
5
  -> AES-CBC key/IV
6
  -> decrypt /stage2.enc
7
  -> reverse telemetry transform
8
  -> flag

Exploitation#

Stage 1 was a Base64-encoded PowerShell downloader. Decoding it revealed:

1
AES key: 0123456789abcdef0123456789abcdef
2
AES IV:  abcdef0123456789

Stage 2 decrypted to logic that XORed the flag with Sup3rS3cr3t, converted the bytes to hex, reversed the hex string, and base64 encoded it before POSTing telemetry.

The telemetry value was:

1
{
2
  "machine_id": "DESKTOP-89A4B",
3
  "data": "RTQ4MTQxMjM4MTg1MDAyMDI1MTNBMUI1MzExMEMwNTEyNTMxMjAyNTQwOTA3NDUxMDFGMw=="
4
}

Decoding process:

1
import base64
2
blob = "RTQ4MTQxMjM4MTg1MDAyMDI1MTNBMUI1MzExMEMwNTEyNTMxMjAyNTQwOTA3NDUxMDFGMw=="
3
hex_reversed = base64.b64decode(blob).decode()
4
xored = bytes.fromhex(hex_reversed[::-1])
5
key = b"Sup3rS3cr3t"
6
flag = bytes(xored[i] ^ key[i % len(key)] for i in range(len(xored)))
7
print(flag.decode())

Flag#

1
leet{Waaaaa_tchhbaarklaah}

Lesson Learned#

TLS key logs do not remove all complexity. For TLS 1.3, the cipher-suite hash and record sequence numbers are part of the decryption state.

Cover: Wallhaven ly3gmr.

If this article helped you, please share it with others!

1337 Local CTF: Encrypted Callback — TLS 1.3 Decryption → PowerShell Malware

https://achux21.github.io/posts/1337-local-ctf-encrypted-callback/

Author

ACHUX21

Published at

2026-06-27

License

CC BY-NC-SA 4.0

1337 Local CTF: big brother — Reverse Engineering Hidden Session Logic

1337 Local CTF: holy bytes hh — Timing Side Channel

Music

Music

Encrypted Callback#

Challenge Context#

Reconnaissance#

Attack Chain#

Exploitation#

Flag#

Lesson Learned#

Share Article

Music

Table of Contents