Espresso — hackthebox

Description

Someone leaked the new Espresso firmware, can you try to figure out what it does?

Provided: a password-protected zip (password hackthebox) containing firmware.bin, a 4 MB ESP32 flash dump. "Espresso" is a wordplay on Espressif (the ESP32 vendor). The goal is to recover a flag the firmware generates at runtime — but only when it believes it is running on genuine hardware.

Analysis

1. Extraction & first look

unzip -P hackthebox espresso.zip          # -> hw_espresso/firmware.bin
file firmware.bin                          # -> data
wc -c firmware.bin                         # -> 4194304 (4 MB)

A hexdump shows the image is mostly 0xFF padding (erased NOR flash). The real content sits at the standard ESP32 flash offsets.

2. Identify as an ESP32 flash dump

Offset	Magic	Meaning
0x1000	0xE9	second-stage bootloader (ESP image)
0x8000	0xAA50	partition table
0x10000	0xE9	application (ESP image)

3. Parse the partition table (@0x8000)

Each entry is 32 bytes: magic(0xAA50) type subtype <I addr <I size label[16].

import struct
data = open("firmware.bin","rb").read()
off = 0x8000
while True:
    e = data[off:off+32]
    if e[:2] != b"\xAA\x50":
        break
    _, t, st, addr, size = struct.unpack("<HBBII", e[:12])
    label = e[12:28].rstrip(b"\x00").decode()
    print(f"{label:10} type={t} sub={st} addr={addr:#08x} size={size:#08x}")
    off += 32

nvs        type=1 sub=2  addr=0x009000 size=0x006000   (empty)
phy_init   type=1 sub=1  addr=0x00f000 size=0x001000
factory    type=0 sub=0  addr=0x010000 size=0x100000   (the 1 MB application)

4. Parse the application image header (@0x10000)

ESP image magic 0xE9, 6 segments, chip_id=0 ⇒ ESP32 (original Xtensa LX6). Build info from strings: ESP-IDF v6.1-dev, project name espresso, entry point 0x400814ac.

Segment map (file offset is relative to the app image at firmware.bin+0x10000):

...