Hack The Box · Misc Challenge

fs0ciety

Challenge details
Name	fs0ciety
Hint	We believe that there is an SSH password inside a password-protected ZIP folder. Can you crack the ZIP folder and get the SSH password?
Difficulty	Easy - Retired [0]
Rated difficulty
First blood	stefano118
Creator	subzer0x0

Analysis

We start again with the file unzipped using the standard Hack The Box challenge password. Inside, we find another ZIP appropriately named fsociety. It asks for another password when we try to open it, so let's run it through fcrackzip with our favorite rockyou.txt wordlist.

$ fcrackzip -u -D -p /usr/share/wordlists/rockyou.txt fsociety.zip
PASSWORD FOUND!!!!: pw == justdoit

Step one done. Unzip fsociety.zip with the password justdoit and open sshcreds_datacenter.txt, which contains:

Encrypted SSH credentials to access Blume ctOS:

MDExMDEwMDEgMDExMDAxMTAgMDEwMTExMTEgMDExMTEwMDEgMDAxMTAwMDAgMDExMTAxMDEgMDEwMTExMTEgMDE
xMDAwMTEgMDEwMDAwMDAgMDExMDExMTAgMDEwMTExMTEgMDAxMDAxMDAgMDExMDExMDEgMDAxMTAwMTEgMDExMD
ExMDAgMDExMDExMDAgMDEwMTExMTEgMDExMTAxMTEgMDExMDEwMDAgMDEwMDAwMDAgMDExMTAxMDAgMDEwMTExM
TEgMDExMTAxMDAgMDExMDEwMDAgMDAxMTAwMTEgMDEwMTExMTEgMDExMTAwMTAgMDAxMTAwMDAgMDExMDAwMTEg
MDExMDEwMTEgMDEwMTExMTEgMDExMDEwMDEgMDExMTAwMTEgMDEwMTExMTEgMDExMDAwMTEgMDAxMTAwMDAgMDA
xMTAwMDAgMDExMDEwMTEgMDExMDEwMDEgMDExMDExMTAgMDExMDAxMTE=

That looks like Base64. Decoding it produces binary:

01101001 01100110 01011111 01111001 00110000 01110101
01011111 01100011 01000000 01101110 01011111 00100100
01101101 00110011 01101100 01101100 01011111 01110111
01101000 01000000 01110100 01011111 01110100 01101000
00110011 01011111 01110010 00110000 01100011 01101011
01011111 01101001 01110011 01011111 01100011 00110000
00110000 01101011 01101001 01101110 01100111

Decoding the binary provides the flag: HTB{if_y0u_c@n_$m3ll_wh@t_th3_r0ck_is_c00king}