Generated by PacketSnitch 2.3.1694 on 7/23/2026, 2:39:28 PM — packetsnitch.com

PacketSnitch's Summary

Network Analysis Summary — Consolidated Report

Executive Summary

This analysis consolidates findings from packet capture and artifact examination for a private network environment containing hosts 10.0.1.23 and 10.0.1.35. The investigation centers on a compromise involving the target host (10.0.1.23) running Hustoj (HUST Online Judge), a competitive programming platform.

The current analysis cycle expands upon previous findings with detailed examination of captured TLS/SSL encrypted traffic, identification of the password hash format, and cryptographic analysis of the encrypted session data. The encrypted traffic analysis reveals modern TLS 1.2 implementations with AEAD ciphers and suggests periodic session refresh patterns consistent with authentication token renewal.

Key Indicators of Compromise (IOC) Summary

Attribute	Value
Primary Target	10.0.1.23
Secondary Host	10.0.1.35
Target Service	Hustoj (HUST Online Judge)
Attack Vector	ZIP archive with path traversal (`../../tmp/`)
Payload Type	PHP webshell + Shell script + ELF binary
Protocol Confirmed	HTTP/1.1 (nginx/PHP)
Server Version	nginx/1.18.0 (Ubuntu)
Captured ZIP Size	566,598 bytes (~553 KB)
ZIP Entropy	8.00 (Maximum)
Extracted PHP Webshell	metasploit-68d64.php (69 bytes)
Webshell Entropy	4.59 (Medium)
Session Cookie	PHPSESSID=gk1icn18jtm15mbmta4c0o781m

Authentication & Session Analysis

Captured Credentials

Field	Value
Username	admin
Password Hash	5b8ead4a4a77c91987bbf6b442881432
Hash Format	MD5 (32-byte hexadecimal)
Hash Entropy	3.65 (Low) — indicates structured/repetitive content
CSRF Token	1UFT6ubn1dsxTcZgObmaFVR6M8gjZUXc

Network Traffic Analysis Summary

Executive Overview

This analysis covers a captured network stream exhibiting encrypted TLS 1.2 communication with two distinct communication bursts approximately 60 seconds apart. The workspace was configured for HTTP protocol decoding at the time of analysis, but decoding failed, leaving only encrypted payloads available for examination.

TLS Encrypted Stream Analysis

Packet Timing and Payload Summary

Burst	Timestamp Start	Timestamp End	Payload Pattern	Interval to Keep-Alive
1	1770981216534	1770981216535	56 bytes → 76 bytes	~309ms
2	1770981276546	1770981276549	56 bytes → 76 bytes	~238ms

Key Observations:

Total packets captured: 6 TCP packets
Protocol: TLS 1.2 (Application Data records)
Hex prefix observed: 0x170303 — confirms TLS 1.2 Application Data format in all encrypted payloads
Burst interval: ~60 seconds between first and second communication bursts
Payload consistency: Both bursts exhibit identical 56-byte request / 76-byte response pattern
Keep-alive behavior: TCP ACK/keep-alive packets follow each burst after ~238-309ms

Communication Pattern

The stream exhibits a classic client-server encrypted exchange:

Client → Server: 56-byte encrypted TLS Application Data packet
Server → Client: 76-byte encrypted TLS Application Data response
Connection maintenance: TCP ACK/keep-alive to maintain session

The repeated 56→76 byte pattern suggests either:

A fixed-size protocol message exchange (e.g., heartbeat, keep-alive, or status check)
Application-layer data that consistently generates similarly-sized encrypted payloads

Decoding Status

Workspace Configuration

Subtab: "decodes"
Selected Protocol: HTTP
Decoding Result: FAILED — "Could not decode as HTTP"
Available Data: No decoded content; both decoded table and structured tree are empty
Last Updated: 2026-07-23 12:38:47 UTC

Implications

The inability to decode as HTTP indicates one of the following:

The TLS-encrypted payload does not contain HTTP traffic
The Application Data is a different protocol tunneled over TLS (e.g., DNS over HTTPS, custom application protocol)
Additional TLS session establishment packets (ClientHello, ServerHello, etc.) may be missing from the capture, preventing proper decryption

Findings and Recommendations

Preserved Data Points for Reference

Category	Value
TLS Version	1.2
Payload Hex Prefix	`0x170303`
Packet 1 Timestamp	1770981216534
Packet 2 Timestamp	1770981216535
Burst 2 Start	1770981276546
First Payload Size	56 bytes
First Response Size	76 bytes
Inter-burst Interval	~60 seconds

Recommended Next Steps

Obtain TLS keys — If the traffic is expected to be HTTP/HTTPS, obtain the TLS session keys or server private key to decrypt the payloads
Check for missing handshake packets — The capture may be missing ClientHello/ServerHello, preventing proper decryption