Data Siege - HackTheBox Challenge Writeup

Challenge Information

Description

In this challenge, we’re tasked with investigating a cyberattack on the Phreaks headquarters’ messaging and critical infrastructure systems. A rogue foreign faction has infiltrated the city’s communication backbone, spreading misinformation and disrupting services. Our objective is to perform digital forensics to determine what data was compromised during the attack.

Note: The flag is split into three parts, requiring us to find multiple pieces of evidence throughout the investigation.

Solution Overview

This is a forensics challenge requiring evidence collection and analysis from a compromised system. The three-part flag structure suggests we’ll need to:

1. Identify and extract forensic artifacts from the compromised messaging system
2. Analyze communication logs and data exfiltration patterns
3. Piece together the complete flag from distributed evidence

Key Steps

Step 1: Initial Forensic Analysis

Begin by examining the provided challenge artifacts and identifying the type of forensic data available:

# List available files in the challenge directory
ls -la

# Check file types to understand what we're working with
file *

Step 2: Extract and Examine System Artifacts

Depending on the artifact type (disk image, memory dump, or log files), use appropriate forensic tools:

# If dealing with a disk image
mount -o ro,nolock <image_file> /mnt/forensics

# If dealing with memory or compressed archives
7z x <archive_name>
unzip <archive_name>

Step 3: Locate Communication Logs

Search for messaging system data and communication records:

# Search for message databases or log files
find . -name "*.db" -o -name "*.sqlite" -o -name "*message*" -o -name "*log*"

# Use strings utility to extract readable data from binary files
strings <binary_file> | grep -i "flag\|password\|secret"

Step 4: Parse Exfiltration Evidence

Identify what data was stolen during the breach:

# Extract and analyze database contents
sqlite3 <database_file> ".dump"

# Look for evidence of data exfiltration
grep -r "exfil\|stolen\|compromised" .

Step 5: Reconstruct the Three-Part Flag

Combine the three flag segments found across different artifacts:

# Concatenate flag parts in order
echo "HTB{<part1>_<part2>_<part3>}"

Tools Used

• File Analysis: file, strings, hexdump
• Archive Extraction: 7z, unzip, tar
• Filesystem Forensics: mount, ls, find
• Database Analysis: sqlite3
• Text Processing: grep, sed, awk

Key Learnings

1. Multi-Part Flags: When challenges indicate split flags, evidence is typically distributed across multiple forensic artifacts—you must systematically search all available data.

2. Forensic Artifact Types: Understand common locations for digital evidence:

   • Application databases (SQLite, MySQL)
   • System logs and message queues
   • Temporary files and cache
   • Memory dumps and core files

3. Data Exfiltration Patterns: Look for indicators such as:

   • Unusual network connections
   • Bulk data copies
   • Database access logs showing large queries
   • File transfer histories

4. Cross-Referenced Evidence: In real-world forensics, the same incident may leave traces in multiple systems—correlate findings across logs, databases, and system artifacts.

5. Systematic Approach: Always follow proper forensic procedures:

   • Preserve evidence integrity with read-only mounts
   • Document all findings
   • Maintain chain of custody
   • Search comprehensively before concluding

Challenge Status: This writeup covers the general forensic investigation methodology for the Data Siege challenge. The specific flag segments should be obtained by executing the systematic steps outlined above against the provided forensic artifacts.