Hack The Box · Docker Forensics

Peel Back The Layers

Recovering a deleted backdoor by examining Docker image history and unpacking the relevant filesystem layer.

Challenge details

Name	Peel Back The Layers
Hint	A rival compromised the Docker Hub profile, inserted a backdoor into `steammaintainer/gearrepairimage`, and later deleted it. Recover the removed backdoor.
Difficulty	Easy · Retired [0]
Rated difficulty
First blood	HTB-Bot
Creator	thewildspirit

Pull and save the Docker image

There is no separate challenge download. Pull the image named in the hint and save it as a tar archive.

sudo docker pull steammaintainer/gearrepairimage
sudo docker save steammaintainer/gearrepairimage > PBTL.tar

Use ContainerTools container-diff to inspect the image history.

curl -LO https://storage.googleapis.com/container-diff/latest/container-diff-linux-amd64
sudo install container-diff-linux-amd64 /usr/local/bin/container-diff
sudo container-diff analyze -t history PBTL.tar

Container-diff output showing historical changes in the Docker image — The image history points to a suspicious file under `/usr/share/lib`.

Extract the suspicious layer

The history indicates a file under /usr/share/lib. Unpack the saved image, enter the relevant layer directory, and extract its layer.tar.

tar xf PBTL.tar
cd 0aec9568b70f59cc149be9de4d303bc0caf0ed940cd5266671300b2d01e47922/
tar xf layer.tar
cd usr/share/lib
strings librs.so

Strings output from librs.so revealing the backdoor commands and encoded flag — The shared library contains the flag immediately before the `REMOTE_ADDR` and `REMOTE_PORT` backdoor strings.

The raw string is HTB{1_r3H4lly_l1kH3_st34mpHunk_r0b0Hts!!!}. Removing the extra H characters and restoring the intended leetspeak yields the final answer.

Flag: HTB{1_r34lly_l1k3_st34mpunk_r0b0ts!!!}

Fun challenge. It is always interesting to see what can be recovered from Docker layers.