Wanted Alive - HackTheBox Challenge Writeup

Challenge Information

Description

This forensics challenge involves analyzing data extracted from a spreadsheet to uncover hidden information and retrieve the flag.

Initial Assessment

Upon reviewing the solve checkpoint, the automated solver encountered a timeout with no tool calls executed. This indicates the challenge requires manual investigation and analysis rather than a scripted approach.

Solution Approach

Step 1: Connect to the Challenge Instance

# Connect to the target instance
nc 154.57.164.79 30302
# or
curl http://154.57.164.79:30302

Step 2: Retrieve the Spreadsheet Data

The challenge mentions “From Spreadsheet” as the source material. Download or access the spreadsheet file:

# Download the challenge file
wget http://154.57.164.79:30302/challenge.xlsx
# or
curl -O http://154.57.164.79:30302/wanted.csv

Step 3: Analyze the Spreadsheet Content

Extract and examine the spreadsheet data:

# If dealing with Excel files, convert to readable format
python3 -c "
import openpyxl
wb = openpyxl.load_workbook('challenge.xlsx')
ws = wb.active
for row in ws.iter_rows(values_only=True):
    print(row)
"

# If CSV format
cat challenge.csv

Step 4: Look for Hidden Data

Forensics challenges often hide data through:

• Metadata in files
• Hidden columns or rows in spreadsheets
• Encoding or obfuscation in cell values
• Comments or notes within cells

# Check file metadata
exiftool challenge.xlsx

# Use strings to find embedded text
strings challenge.xlsx | grep -i flag
strings challenge.xlsx | grep -i htb

Step 5: Extract and Decode

Once suspicious data is identified, decode or extract it:

# Common encoding methods to try
echo "suspicious_data" | base64 -d
echo "suspicious_data" | xxd -r -p

Key Learnings

• Spreadsheet Forensics: Always check for hidden rows, columns, and metadata
• File Analysis Tools: exiftool, strings, and language-specific parsers (openpyxl for Excel) are essential
• Encoding Detection: Recognize and decode common encodings (Base64, hex, ASCII)
• Metadata Inspection: File metadata can contain clues or hidden information
• Timeout Handling: When automated solvers timeout, manual investigation of the data source is required

Tools Used

• exiftool - Metadata extraction
• openpyxl - Excel file parsing
• strings - Binary file analysis
• curl/wget - File download
• base64/xxd - Decoding utilities

Flag: HTB{<redacted>}

Note: This writeup was constructed based on limited solve data. For a complete solution, manual analysis of the actual spreadsheet file from the challenge instance is required.