HTB Global Cyber Skills Benchmark CTF 2025: Operation Blackout - Journal

This is a challenge from a corporate CTF that a senior at F leaked to me so I could try it out (thanks my brother Ravi) Q1: Which credentials has been used to login on the platform? (e.g. username:password)

Looking through the pcap file, since the challenge asks to find credentials, I filtered for keywords like auth, authentication,... As everything is plain HTTP, it’s easy to read the payload of the auth request.

Ans: admin:dL4zyVJ1y8UhT1hX1m

Q2: Which Nexus OSS version is in use? (e.g. 1.10.0-01)

Looking at the response of the previous request, often the server responds with the current system version in the headers.

Ans: 2.15.1-02

Q3: The attacker created a new user for persistence. Which credentials has been set? (e.g. username:password)

Reading the challenge we see the words create and set. Based on basic networking knowledge, these actions are usually sent via POST.

Ans: adm1n1str4t0r:46vaGuj566

Q4: One core library written in Java has been tampered and replaced by a malicious one. Which is its package name? (e.g. com.company.name)

Looking further into the capture file I noticed a PUT request with a .jar file extension that looks suspicious.

Ans: com.phoenix.toolkit

Q5 & Q6: - The tampered library contains encrypted communication logic. What is the secret key used for session encryption? (e.g. Secret123)
- Which is the name of the function that manages the (AES) string decryption process? (e.g. aVf41)

Seems my suspicion was right, this file is obfuscated in the style typical of malware. I read through and summarized it like this:

Ans: uJtXq5

By leveraging the fact that the key will be decrypted before use, we can print it out after it is successfully decrypted.

Ans: vuvtuYXvHYvW"#vu

Q7: Which is the system command that triggered the reverse shell execution for this session running the tampered JAR? (e.g. "java .... &")

Simple: "run it".

Ans: java -jar PhoenixCyberToolkit-1.0.jar

Q8: Which is the first executed command in the encrypted reverse shell session? (e.g. whoami)

tcp && tcp.port == 4444

The communication data is encrypted AES -> Base64, just need to reverse this process :smile:

Ans: uname -a

Q9: Which other legit user has admin permissions on the Nexus instance (excluding "adm1n1str4t0r" and "admin")? (e.g. john_doe)

Ans: john_smith

Q10: The attacker wrote something in a specific file to maintain persistence, which is the full path? (e.g. /path/file)

Still basic obfuscation techniques, after decoding we can see the path used for persistence.

Ans: /sonatype-work/storage/.phoenix-updater

recipe