Fishy Http
Fishy Http is a sanitized challenge note from the local HTB archive, organized for quick review by category, difficulty, evidence flow, and reusable operator
Scenario
Fishy Http attack path
Fishy Http is a sanitized challenge note from the local HTB archive, organized for quick review by category, difficulty, evidence flow, and reusable operator
Objective
Challenge walkthrough focused on Forensics evidence, validation, and reusable operator lessons.
Walkthrough flow
Evidence collection
Artifact grouping
Root cause reconstruction
Proof captured
Source coverage
High source coverage
Status: complete. This article is generated from 6 sanitized Markdown sources and keeps raw flags, credentials, keys, cookies, and reusable secrets out of the rendered blog.
High confidence: the page is reconstructed from a primary walkthrough plus multiple supporting notes or evidence sources. Treat the chain as source-backed, while still checking the listed source files for sensitive values.
- Forensics/Fishy-Http/writeup.md
- htb-challenge/Forensics/Fishy-Http/notes.md
- htb-challenge/Forensics/Fishy-Http/memory-summary.md
- htb-challenge/Forensics/Fishy-Http/hypothesis-board.md
- HTB/_knowledge/exports/ctf-lightrag-latest-203412/documents/challenge__Forensics__Fishy-Http__memory-summary.md.44aea0fff4.md
- HTB/_knowledge/exports/ctf-lightrag-latest-203412/documents/challenge__Forensics__Fishy-Http__notes.md.f73b2bff3c.md
Technical Walkthrough
Writeup
Challenge
- Name: Fishy-Http
- Category: Forensics
- Difficulty: Easy
- Mode: file
Summary
The provided PCAP and executable describe the same custom HTTP C2 flow. The executable is a .NET 8 bundled program; extracting its bundle manifest reveals a small MyProject.dll containing the encoder/decoder logic. Server responses hide commands in HTML tag names mapped to hex nibbles, while client feedback hides command output in first-letter acrostics that decode from base64. The two flag parts are split across those channels.
Artifact Inventory
files/extracted/smphost.exe: Windows x64 .NET 8 self-contained executable.files/extracted/sustraffic.pcapng: captured HTTP traffic between the program and a web server.analysis/extracted-bundle/manifest.json: parsed .NET bundle manifest generated during analysis.analysis/extracted-bundle/MyProject.dll: recovered managed project assembly.
Analysis
The executable bundle manifest identifies 171 embedded files and exposes MyProject.dll. Managed user strings in that assembly include:
- a body extraction regex:
<body>(.*?)</body> - a tag extraction regex:
<(\w+)[\s>] HexStringToBytesFromBase64String/ToBase64Stringsubmit_feedback
That points to two encodings:
- Server-to-client commands: selected HTML tags are converted to hex nibbles, then hex-decoded into command text.
- Client-to-server command output: feedback words are reduced to their first letters, then base64-decoded.
Decoding the captured HTTP streams produced four commands and four command outputs. The first flag fragment appeared in a decoded command as a file name beginning with the expected HTB{ prefix. The matching decoded feedback output contained the quoted second fragment and closing brace.
Solve
Run:
Forensics/Fishy-Http/.venv/bin/python Forensics/Fishy-Http/solve/solve.pyThe solver:
- Parses the .NET bundle manifest from
smphost.exe. - Verifies
MyProject.dllcontains the expected decoder artifacts. - Rebuilds TCP streams from
sustraffic.pcapng. - Decodes HTML-tag command traffic and feedback acrostic output traffic.
- Combines both flag fragments and writes the result to
loot/flag-candidate.txt.
The harness then captured the validated flag into loot/flag.txt.
Flag
Raw flag is stored in loot/flag.txt and intentionally not reproduced here.
Lessons
- For self-contained .NET executables, parse the appended bundle manifest instead of treating the large PE as opaque.
- In PCAP-based malware/C2 challenges, decode both directions. The command channel and output channel may use different encodings.
- Visible text acrostics were a false lead here; the meaningful server-to-client channel was encoded in HTML tag names.
Source-Backed Dossier
The sections below are merged from companion Markdown notes for the same case. They are rendered after sanitization so the article stays precise without publishing raw flags, credentials, or target-specific secrets.
Notes
Scope
- Challenge: Fishy-Http
- Category: Forensics
- Difficulty: Easy
- Mode: file
- Remote instance: none
- Start time: 2026-06-09T09:23:05Z
- Operator: harness
- State file:
challenge-state.json
Harness Status
- Current phase: see
challenge-state.json - Next allowed actions: see
next-action.json - Raw flags and sensitive material stay in
loot/only. Do not paste them here.
Artifact Inventory
| File | Size | SHA256 | Type | Notes |
|---|---|---|---|---|
files/a12c733e-4cdf-437a-92cd-951d1f371fb3.zip | 29619281 | <hash redacted> | Zip archive data, at least v2.0 to extract, compression method=deflate | zip entries: 2 shown in artifact inventory JSON |
Evidence Ledger
| Time | Action | Output/File | Finding | Confidence | Next |
|---|---|---|---|---|---|
| 2026-06-09T09:23:05Z | harness init | challenge-state.json | Workspace initialized with deterministic state file | High | Inventory artifacts |
| 2026-06-09T09:23:05Z | artifact inventory | analysis/artifact-inventory.json | 1 artifact(s) inventoried | High | Build or update hypotheses |
| 2026-06-09T09:23:29Z | hypothesis recorded | hypothesis-board.md | Recover two flag parts by correlating HTTP traffic in sustraffic.pcapng with strings/config/logic in smphost.exe. | Medium | Extract HTTP objects/URIs/headers from pcapng, then inspect executable strings/resources/imports for matching endpoints, keys, or embedded flag material. |
| 2026-06-09T09:37:33Z | research skip | analysis/research/research-skip.md | Research intentionally skipped with recorded reason | Medium | Gate before exploit |
| 2026-06-09T09:37:33Z | flag capture | loot/flag.txt | HTB-format flag captured; raw value kept in loot only | High | Write solution and run completion gate |
| 2026-06-09T09:38:13Z | completion gate | challenge-state.json | Completion gate passed; state marked COMPLETE | High | Optional sanitized memory summary approval |
Key Findings
- Archive extracted with the standard HTB challenge archive convention. It contains
smphost.exeandsustraffic.pcapng. smphost.exeis a .NET 8 self-contained/single-file Windows executable with a readable bundle manifest at offset67506344.- The bundle manifest exposes
MyProject.dllat offset9662464, size15872, SHA256<hash redacted>. MyProject.dllconfirms two custom channels:
- HTTP response bodies encode commands by mapping selected HTML tags to hex nibbles.
- POST /submit_feedback bodies encode command output by using the first letter of each feedback word as base64.
- Decoding the response command channel recovered the first flag fragment as a filename in a
type HTB{...command. - Decoding the POST feedback channel recovered the second flag fragment in the corresponding command output.
- The reproducible solver writes the combined flag to
loot/flag-candidate.txt; the harness captured it intoloot/flag.txt.
RAG / Advisory Memory
RAG output is advisory only. Record evaluated retrievals with:
scripts/challenge_harness.py rag-record <workspace> --query "..." --tag MATCHED|PARTIAL|MISSING|<secret redacted>|GENERIC --validation "..."Secrets/Flags
Raw flags and sensitive material stay in loot/ only. Use scripts/challenge_harness.py capture-flag to validate and record flag capture without printing the value.
Memory Summary
Metadata
- Platform: HackTheBox Challenges
- Category: Forensics
- Challenge: Fishy-Http
- Difficulty: Easy
- Source workspace:
<local workspace>
Validated Solve Chain
Concepts only. Do not include raw flags, reusable credentials, tokens, cookies, private keys, or live secrets.
1.
Reusable Lessons
-
Dead Ends
-
Tool Quirks
-
Evidence Paths
-
Ingestion Decision
- Proposed for LightRAG: yes/no
- Requires user approval before ingestion: yes
Hypothesis Board
Keep no more than 3 active hypotheses on Easy/Medium and 5 on Hard unless the user explicitly asks for breadth.
| Rank | Path | Evidence | Missing Proof | Cheapest Validation | Confidence | Status |
|---|---|---|---|---|---|---|
| 1 | Recover two flag parts by correlating HTTP traffic in sustraffic.pcapng with strings/config/logic in smphost.exe. | Challenge scenario explicitly says suspicious program makes HTTP requests and the flag has two parts; archive contains smphost.exe and sustraffic.pcapng. | Extract HTTP objects/URIs/headers from pcapng, then inspect executable strings/resources/imports for matching endpoints, keys, or embedded flag material. | Medium | Active |
Closed Branches
| Branch | Evidence Tested | Failure Output | Reason Closed | Revisit Condition |
|---|
Memory Summary
approval_required: true
Sanitized Memory Summary
Metadata
- Platform: HackTheBox Challenges
- Category: Forensics
- Challenge: Fishy-Http
- Difficulty: Easy
- Source workspace:
<local workspace>
Validated Solve Chain
Concepts only. Do not include raw flags, reusable credentials, tokens, cookies, private keys, or live secrets.
1.
Reusable Lessons
-
Dead Ends
-
Tool Quirks
-
Evidence Paths
-
Ingestion Decision
- Proposed for LightRAG: yes/no
- Requires user approval before ingestion: yes
Notes
Notes
Scope
- Challenge: Fishy-Http
- Category: Forensics
- Difficulty: Easy
- Mode: file
- Remote instance: none
- Start time: 2026-06-09T09:23:05Z
- Operator: harness
- State file:
challenge-state.json
Harness Status
- Current phase: see
challenge-state.json - Next allowed actions: see
next-action.json - Raw flags and sensitive material stay in
loot/only. Do not paste them here.
Artifact Inventory
| File | Size | SHA256 | Type | Notes |
|---|---|---|---|---|
files/a12c733e-4cdf-437a-92cd-951d1f371fb3.zip | 29619281 | <hash redacted> | Zip archive data, at least v2.0 to extract, compression method=deflate | zip entries: 2 shown in artifact inventory JSON |
Evidence Ledger
| Time | Action | Output/File | Finding | Confidence | Next |
|---|---|---|---|---|---|
| 2026-06-09T09:23:05Z | harness init | challenge-state.json | Workspace initialized with deterministic state file | High | Inventory artifacts |
| 2026-06-09T09:23:05Z | artifact inventory | analysis/artifact-inventory.json | 1 artifact(s) inventoried | High | Build or update hypotheses |
| 2026-06-09T09: <REDACTED>, then inspect executable strings/resources/imports for matching endpoints, keys, or embedded flag material. | |||||
| 2026-06-09T09:37:33Z | research skip | analysis/research/research-skip.md | Research intentionally skipped with recorded reason | Medium | Gate before exploit |
| 2026-06-09T09: <REDACTED> | |||||
| 2026-06-09T09:38:13Z | completion gate | challenge-state.json | Completion gate passed; state marked COMPLETE | High | Optional sanitized memory summary approval |
Key Findings
- Archive extracted with the standard HTB challenge archive convention. It contains
smphost.exeandsustraffic.pcapng. smphost.exeis a .NET 8 self-contained/single-file Windows executable with a readable bundle manifest at offset67506344.- The bundle manifest exposes
MyProject.dllat offset9662464, size15872, SHA256<hash redacted>. MyProject.dllconfirms two custom channels:
- HTTP response bodies encode commands by mapping selected HTML tags to hex nibbles.
- POST /submit_feedback bodies encode command output by using the first letter of each feedback word as base64.
- Decoding the response command channel recovered the first flag fragment as a filename in a
type <<secret redacted>>...command. - Decoding the POST feedback channel recovered the second flag fragment in the corresponding command output.
- The reproducible solver writes the combined flag to
loot/flag-candidate.txt; the harness captured it intoloot/flag.txt.
RAG / Advisory Memory
RAG output is advisory only. Record evaluated retrievals with:
scripts/challenge_harness.py rag-record <workspace> --query "..." --tag MATCHED|PARTIAL|MISSING|<secret redacted>|GENERIC --validation "..."Secrets/Flags
Raw flags and sensitive material stay in loot/ only. Use scripts/challenge_harness.py capture-flag to validate and record flag capture without printing the value.
Technical analogy
How to remember this solve
Think of the challenge as a small system with one rule that matters more than the rest. The solve is finding that rule, validating it, and using it carefully enough to reach the final proof.
For Fishy Http, keep the mental model simple: identify the trusted assumption, prove it with the smallest safe test, then automate or repeat only the part that directly leads to the flag.