The Puppet Master — HackTheBox

Description

The Puppet Master is an OSINT challenge that requires conducting an investigation based on data found in a web application and identifying military equipment.

Analysis

1. Upon examining the challenge website, it was discovered that it is built on React.
2. In the JavaScript source code (via DevTools), a direct link to an image used in the application was found: https://www.nzdf.mil.nz/assets/Uploads/BannerImages/20230525_NZDF_P1061532_025__FocusFillWyIwLjAwIiwiMC4wMCIsNjAwLDQwMF0.JPG
3. The link leads to the official New Zealand Defence Force (NZDF) website.

Solution

Step 1: Vehicle Identification

The image shows an armored vehicle. Searching the NZDF website and visual comparison allowed identification of it as the Bushmaster Protected Mobility Vehicle (NZ5.5 variant), used by NZDF.

Step 2: Gathering Specifications

To complete the 5-stage investigation on the challenge website, the following vehicle data was required:

• Vehicle: Bushmaster
• Manufacturer: Thales Australia
• First service: 1997
• Origin: Australia
• Capacity: 10 people (9 passengers + 1 driver)

Step 3: Obtaining the Flag

After entering all specifications into the form on the challenge website, the final flag was unlocked.