Phreaky — HackTheBox

Description

"In the shadowed realm where the Phreaks hold sway"

The challenge provided a download link to a ZIP file containing a PCAP capture.

Analysis

Initial Analysis

Downloaded and extracted the challenge file (password: hackthebox), revealing phreaky.pcap - a network capture file.

PCAP Protocol Analysis

Analyzed the PCAP with tshark to identify protocols:

tshark -r phreaky.pcap -q -z io,phs

Key findings:

• SMTP traffic (337 frames)
• IMF (Internet Message Format) - 15 email messages
• Emails sent from [email protected] to [email protected]
• Subject: "Secure File Transfer"

Email Extraction

Exported email objects from the PCAP:

tshark -r phreaky.pcap -Y "smtp" --export-objects "imf,emails"

Found 15 unique emails (with duplicates totaling 30 files). Each email contained:

1. A text body with a password (e.g., "Password: S3W8yzixNoL8")
2. A base64-encoded ZIP attachment

Attachment Analysis

Each ZIP file contained a part of a PDF file:

• phreaks_plan.pdf.part1 through phreaks_plan.pdf.part15
• Each ZIP was password-protected with a unique password from its email

Passwords found:

Part	Password
1	S3W8yzixNoL8
2	r5Q6YQEcGWEF
3	TVm9aC1UycxF
4	jISlbC8145Ox
5	AdtJYhF4sFgv
6	j2SRRDraIvUZ
7	xh161WSXX7tB
8	yH5vqnkm7Ixa
9	tJPUTUfceO1P
10	2qKlZHZlBPQz
11	mbkUvLZ1koxu
12	ZN4yKAYrtf8x
13	0eA143t4432M
14	oea41WCJrWwN
15	gdOvbPtB0xCK

Solution

Python Extraction Script

Created a Python script to:

1. Parse all .eml files
2. Extract passwords from email bodies
3. Decode base64 ZIP attachments
4. Extract each part using its password
5. Combine all parts in order

#!/usr/bin/env python3
import os, base64, zipfile, re
from email import policy
from email.parser import BytesParser

emails_dir = "emails"
parts = {}

for filename in sorted(os.listdir(emails_dir)):
    if not filename.endswith('.eml'):
        continue
    
    with open(os.path.join(emails_dir, filename), 'rb') as f:
        msg = BytesParser(policy=policy.default).parse(f)
    
    password = None
    zip_data = None
    zip_filename = None
    
    for part in msg.walk():
        if part.get_content_type() == 'text/plain':
            match = re.search(r'Password:\s*(\S+)', part.get_content())
            if match:
                password = match.group(1)
        elif part.get_content_type() == 'application/zip':
            zip_data = part.get_content()
            fn_match = re.search(r'filename\*0="([^"]+)"', str(part))
            fn_match2 = re.search(r'filename\*1="([^"]+)"', str(part))
            if fn_match and fn_match2:
                zip_filename = fn_match.group(1) + fn_match2.group(1)
    
    if password and zip_data and zip_filename:
        if zip_filename not in parts:
            parts[zip_filename] = (password, zip_data)

# Extract and combine parts
extracted_parts = {}
os.makedirs("extracted", exist_ok=True)

for zip_filename, (password, zip_data) in parts.items():
    zip_path = os.path.join("extracted", zip_filename)
    with open(zip_path, 'wb') as f:
        f.write(zip_data)
    
    with zipfile.ZipFile(zip_path, 'r') as zf:
        zf.setpassword(password.encode())
        for name in zf.namelist():
            match = re.search(r'\.part(\d+)$', name)
            if match:
                part_num = int(match.group(1))
                extracted_parts[part_num] = zf.read(name)

# Combine all parts
combined = b''.join(extracted_parts[i] for i in sorted(extracted_parts.keys()))
with open("phreaks_plan.pdf", 'wb') as f:
    f.write(combined)

PDF Analysis

The combined file was a valid PDF document (3302 bytes, 2 pages) titled "Operation Spotlight: The Phreaks' Grand Scheme Against The Talents".

Extracted text with:

pdftotext phreaks_plan.pdf -

The document described a fictional operation plan, and the flag was hidden in the Appendix section:

Appendix: Communication Protocols For secure communication, all operatives are required to use encrypted channels only. Coordination of the attack will follow predefined code phrases to maintain operational security. Key for secure communication: HTB{REDACTED}.

Tools Used

• tshark - Wireshark CLI for PCAP analysis and object extraction
• Python 3 - email and zipfile modules for parsing and extraction
• pdftotext - PDF text extraction