{"id":59,"date":"2022-06-14T00:45:25","date_gmt":"2022-06-14T00:45:25","guid":{"rendered":"https:\/\/jasonlcurby.com\/blog\/?p=59"},"modified":"2025-11-07T03:58:52","modified_gmt":"2025-11-07T03:58:52","slug":"hack-the-box-challenge-walkthrough-the-needle","status":"publish","type":"post","link":"https:\/\/jasonlcurby.com\/blog\/2022\/06\/14\/hack-the-box-challenge-walkthrough-the-needle\/","title":{"rendered":"Hack The Box Challenge Walkthrough &#8211; The Needle"},"content":{"rendered":"<p>The Needle is a very easy challenge in the hardware category. The challenge description is as follows:<\/p>\n<p><em>&#8216;As a part of our SDLC process, we&#8217;ve got our firmware ready for security testing. Can you help us by performing a security assessment?&#8217;<\/em><\/p>\n<p>SHA-256 of the files necessary to download: <em>535191a711ea95bf58a6d64f940f9409f3af272fcfd685d0e72971e0d55ea03c<\/em>.<\/p>\n<p><strong>First Steps<\/strong><\/p>\n<p>Let&#8217;s download the&nbsp;<em>firmware.bin<\/em> file &#8211; the only one provided for the challenge. A quick scan, check of the file properties and any potential valuable metadata, and open in text editor. It&#8217;s binary or unsupported text encoding &#8211; nothing obvious. We&#8217;re going to need to access and run it somehow &#8211; either on a virtual machine or software suite to match the machine instance provided. Trying the browser with&nbsp;<em>ip&nbsp;<\/em>and&nbsp;<em>ip:port<\/em> returns nothing.<\/p>\n<p>An&nbsp;<em>nmap<\/em> of the instance is next, as well as a&nbsp;<em>w3af<\/em> scan. There&#8217;s&nbsp;<em>a lot (<\/em>the haystack?) of stuff hosted on the machine &#8211; MySQL, multiple Node.js, Apache, WordPress sites &#8211; a web hosting server. On port 30568 &#8211; the specific port referenced by the HackTheBox challenge &#8211; is a <em>tcp open telnet BusyBox telnetd&nbsp;<\/em>service. Quick read up on BusyBox &#8211; it runs firmware versions for different router boxes, the path sitting in&nbsp;<em>\/usr\/sbin.&nbsp;<\/em>Well, we have a firmware file. This is target <em>numero uno&nbsp;<\/em>&#8211; the needle in the haystack (for now).<\/p>\n<p>More on BusyBox&nbsp;<em>telnetd<\/em>. Telnet into the instance service port. It&#8217;s asking for a login. Try a few of the standard generic combinations &#8211; nothing works. Watch a Youtube on how reset software, firmware, Bluetooth and a factory reset of a BusyBox. Not very informative.<\/p>\n<p><strong>The .bin file<\/strong><\/p>\n<p>So we return to the challenges&nbsp;<em>.bin&nbsp;<\/em>file &#8211; we have to open, read, view it somehow to look for any hints &#8211; factory settings, saved configuration or another target. Kali Linux has a tool called Binwalk, described as: &#8216;<em>a tool for searching a given binary image for embedded files and executable code. Specifically, it is designed for identifying files and code embedded inside of firmware images.&#8217;&nbsp;<\/em>Let&#8217;s make sure we have it.<\/p>\n<p><span style=\"color: #00ff41;\">sudo apt install binwalk<br \/>\nsudo -h<br \/>\nsudo binwalk -e firmware.bin<br \/>\n<\/span><\/p>\n<p>This commands Binwalk to extract from the&nbsp;<em>firmware.bin&nbsp;<\/em>file a large collection of files to work with into a new folder:&nbsp;<em>_firmware.bin.extracted.<\/em><\/p>\n<p><a style=\"font-family: var(--definition-term--font-family); font-weight: bold; font-size: var(--global--font-size-xs); text-align: center; background-color: var(--global--color-background); display: inline !important;\" href=\"https:\/\/jasonlcurby.com\/blog\/wp-content\/uploads\/2022\/06\/hackthebox-the-needle-3.png\"><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-70\" src=\"https:\/\/jasonlcurby.com\/blog\/wp-content\/uploads\/2022\/06\/hackthebox-the-needle-3.png\" alt=\"Extracting the download .bin file gives us a large haystack of a filesystem.\" width=\"975\" height=\"936\" srcset=\"https:\/\/jasonlcurby.com\/blog\/wp-content\/uploads\/2022\/06\/hackthebox-the-needle-3.png 975w, https:\/\/jasonlcurby.com\/blog\/wp-content\/uploads\/2022\/06\/hackthebox-the-needle-3-300x288.png 300w, https:\/\/jasonlcurby.com\/blog\/wp-content\/uploads\/2022\/06\/hackthebox-the-needle-3-768x737.png 768w\" sizes=\"auto, (max-width: 975px) 100vw, 975px\" \/><\/a><\/p>\n<p style=\"text-align: center;\"><em style=\"color: #00ff41;\">Extracting the download .bin file gives us a large haystack of a filesystem.<\/em><\/p>\n<p><strong>Searching the Haystack<\/strong><\/p>\n<p>So I thought the haystack was the instance &#8211; looks like it&#8217;s actually the large collection folders and files above. I do a quick scan for anything that stands out- vim the BusyBox files, where I don&#8217;t find much of interest. List file pointers to a lot of locations in the&nbsp;<em>\/bin&nbsp;<\/em>and&nbsp;<em>\/usr&nbsp;<\/em>directory &#8211; which are both empty. The login files simply read &#8216;busybox&#8217; &#8211; maybe a login or account name? Next I&#8217;ll run some&nbsp;<em>grep&nbsp;<\/em>commands to find anything matching what I might be looking for.<\/p>\n<p><span style=\"color: #00ff41;\">grep -rn &#8220;.\/&#8221; -e &#8220;password&#8221;<\/span><\/p>\n<p>Nothing stands out regarding an obvious system or user password.<\/p>\n<p><span style=\"color: #00ff41;\">grep -rn &#8220;.\/&#8221; -e &#8220;login&#8221;<\/span><\/p>\n<p>To dig deeper looking for anything related to a login or connection. Another needle that stands out after reading through the results:<\/p>\n<p><em><span style=\"color: #00ff41;\">.\/squashfs-root\/etc\/scripts\/teletd.sh: telnetd -l \u201c\/usr\/sbin\/login\u201d -u Device_Admin:$sign -I $lf &amp;.<\/span><\/em><\/p>\n<p>Is this a telnet login using the plain text written username <em>Device_Admin <\/em>and password?<\/p>\n<p><a style=\"font-family: var(--definition-term--font-family); font-weight: bold; font-size: var(--global--font-size-xs); text-align: center; background-color: var(--global--color-background); display: inline !important;\" href=\"https:\/\/jasonlcurby.com\/blog\/wp-content\/uploads\/2022\/06\/hackthebox-the-needle-1.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-65 size-full\" title=\"grep -rn \u201c.\/\u201d -e \u201clogin\u201d returning a login -u username and password link.\" src=\"https:\/\/jasonlcurby.com\/blog\/wp-content\/uploads\/2022\/06\/hackthebox-the-needle-1.jpg\" alt=\"grep -rn \u201c.\/\u201d -e \u201clogin\u201d returning a login -u username and password link.\" width=\"1126\" height=\"57\" srcset=\"https:\/\/jasonlcurby.com\/blog\/wp-content\/uploads\/2022\/06\/hackthebox-the-needle-1.jpg 1126w, https:\/\/jasonlcurby.com\/blog\/wp-content\/uploads\/2022\/06\/hackthebox-the-needle-1-300x15.jpg 300w, https:\/\/jasonlcurby.com\/blog\/wp-content\/uploads\/2022\/06\/hackthebox-the-needle-1-1024x52.jpg 1024w, https:\/\/jasonlcurby.com\/blog\/wp-content\/uploads\/2022\/06\/hackthebox-the-needle-1-768x39.jpg 768w\" sizes=\"auto, (max-width: 1126px) 100vw, 1126px\" \/><\/a><\/p>\n<p><em style=\"color: #00ff41;\">grep -rn \u201c.\/\u201d -e \u201clogin\u201d returning a login -u username and password link.<\/em><\/p>\n<p>So I search for the sign reference, and find a sign file in the extracted director. Viola, it&#8217;s got a very obvious password only stored on a single line. So now we have <em>Device_Admin&nbsp;<\/em>as a telnet login and an unencrypted password from the&nbsp;<em>sign&nbsp;<\/em>file.<\/p>\n<p><!--more--><\/p>\n<figure id=\"attachment_68\" aria-describedby=\"caption-attachment-68\" style=\"width: 155px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/jasonlcurby.com\/blog\/wp-content\/uploads\/2022\/06\/hackthebox-the-needle-2.png\"><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-68\" src=\"https:\/\/jasonlcurby.com\/blog\/wp-content\/uploads\/2022\/06\/hackthebox-the-needle-2.png\" alt=\"Password stored in sign file referenced in the login search previously.\" width=\"155\" height=\"56\"><\/a><figcaption id=\"caption-attachment-68\" class=\"wp-caption-text\"><em style=\"color: #00ff41;\"><em style=\"color: #00ff41;\">Password stored in sign file referenced in the login search previously.<\/em><\/em><\/figcaption><\/figure>\n<p><strong>Logging in<\/strong><\/p>\n<p>We <em>telnet<\/em> back into the machine with the credentials we just found, and just like that we&#8217;re in. A quick&nbsp;<em>ls<\/em> returns a single file:&nbsp;<em>flag.txt. cat. flag.txt&nbsp;<\/em>prints its contents out on the terminal.<\/p>\n<figure id=\"attachment_74\" aria-describedby=\"caption-attachment-74\" style=\"width: 735px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/jasonlcurby.com\/blog\/wp-content\/uploads\/2022\/06\/hackthebox-the-needle-4.png\"><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-74\" src=\"https:\/\/jasonlcurby.com\/blog\/wp-content\/uploads\/2022\/06\/hackthebox-the-needle-4.png\" alt=\"Logging into the HTB instance with the discovered admin username and sign password.\" width=\"735\" height=\"224\" srcset=\"https:\/\/jasonlcurby.com\/blog\/wp-content\/uploads\/2022\/06\/hackthebox-the-needle-4.png 735w, https:\/\/jasonlcurby.com\/blog\/wp-content\/uploads\/2022\/06\/hackthebox-the-needle-4-300x91.png 300w\" sizes=\"auto, (max-width: 735px) 100vw, 735px\" \/><\/a><figcaption id=\"caption-attachment-74\" class=\"wp-caption-text\"><em style=\"color: #00ff41;\"> Logging into the HTB instance with the discovered admin username and sign password.<\/em><\/figcaption><\/figure>\n<p>Approximate time taken was 1 hour.<\/p>\n<p><strong>Flag<\/strong>: <em style=\"color: #00ff41;\">HTB{4_hug3_blund3r_d289a1_!!}<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"<p>The Needle is a very easy challenge in the hardware category. The challenge description is as follows: &#8216;As a part of our SDLC process, we&#8217;ve got our firmware ready for security testing. Can you help us by performing a security assessment?&#8217; SHA-256 of the files necessary to download: 535191a711ea95bf58a6d64f940f9409f3af272fcfd685d0e72971e0d55ea03c. First Steps Let&#8217;s download the&nbsp;firmware.bin file [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":70,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8,9],"tags":[],"class_list":["post-59","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","category-hack-the-box"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.4 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Hack The Box Challenge Walkthrough - The Needle - JLC<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/jasonlcurby.com\/blog\/2022\/06\/14\/hack-the-box-challenge-walkthrough-the-needle\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Hack The Box Challenge Walkthrough - The Needle - JLC\" \/>\n<meta property=\"og:description\" content=\"The Needle is a very easy challenge in the hardware category. The challenge description is as follows: &#8216;As a part of our SDLC process, we&#8217;ve got our firmware ready for security testing. Can you help us by performing a security assessment?&#8217; SHA-256 of the files necessary to download: 535191a711ea95bf58a6d64f940f9409f3af272fcfd685d0e72971e0d55ea03c. First Steps Let&#8217;s download the&nbsp;firmware.bin file [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/jasonlcurby.com\/blog\/2022\/06\/14\/hack-the-box-challenge-walkthrough-the-needle\/\" \/>\n<meta property=\"og:site_name\" content=\"JLC\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/jason.curby\" \/>\n<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/jason.curby\" \/>\n<meta property=\"article:published_time\" content=\"2022-06-14T00:45:25+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-11-07T03:58:52+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/jasonlcurby.com\/blog\/wp-content\/uploads\/2022\/06\/hackthebox-the-needle-3.png\" \/>\n\t<meta property=\"og:image:width\" content=\"975\" \/>\n\t<meta property=\"og:image:height\" content=\"936\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"rofo\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@https:\/\/twitter.com\/JasonCurby\" \/>\n<meta name=\"twitter:site\" content=\"@JasonCurby\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"rofo\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/jasonlcurby.com\\\/blog\\\/2022\\\/06\\\/14\\\/hack-the-box-challenge-walkthrough-the-needle\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/jasonlcurby.com\\\/blog\\\/2022\\\/06\\\/14\\\/hack-the-box-challenge-walkthrough-the-needle\\\/\"},\"author\":{\"name\":\"rofo\",\"@id\":\"https:\\\/\\\/jasonlcurby.com\\\/blog\\\/#\\\/schema\\\/person\\\/187b41b22ffae39c83b69ddc480ea1f3\"},\"headline\":\"Hack The Box Challenge Walkthrough &#8211; The Needle\",\"datePublished\":\"2022-06-14T00:45:25+00:00\",\"dateModified\":\"2025-11-07T03:58:52+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/jasonlcurby.com\\\/blog\\\/2022\\\/06\\\/14\\\/hack-the-box-challenge-walkthrough-the-needle\\\/\"},\"wordCount\":761,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/jasonlcurby.com\\\/blog\\\/#\\\/schema\\\/person\\\/187b41b22ffae39c83b69ddc480ea1f3\"},\"image\":{\"@id\":\"https:\\\/\\\/jasonlcurby.com\\\/blog\\\/2022\\\/06\\\/14\\\/hack-the-box-challenge-walkthrough-the-needle\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/jasonlcurby.com\\\/blog\\\/wp-content\\\/uploads\\\/2022\\\/06\\\/hackthebox-the-needle-3.png\",\"articleSection\":[\"Cybersecurity\",\"Hack The Box\"],\"inLanguage\":\"en-AU\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/jasonlcurby.com\\\/blog\\\/2022\\\/06\\\/14\\\/hack-the-box-challenge-walkthrough-the-needle\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/jasonlcurby.com\\\/blog\\\/2022\\\/06\\\/14\\\/hack-the-box-challenge-walkthrough-the-needle\\\/\",\"url\":\"https:\\\/\\\/jasonlcurby.com\\\/blog\\\/2022\\\/06\\\/14\\\/hack-the-box-challenge-walkthrough-the-needle\\\/\",\"name\":\"Hack The Box Challenge Walkthrough - The Needle - JLC\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/jasonlcurby.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/jasonlcurby.com\\\/blog\\\/2022\\\/06\\\/14\\\/hack-the-box-challenge-walkthrough-the-needle\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/jasonlcurby.com\\\/blog\\\/2022\\\/06\\\/14\\\/hack-the-box-challenge-walkthrough-the-needle\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/jasonlcurby.com\\\/blog\\\/wp-content\\\/uploads\\\/2022\\\/06\\\/hackthebox-the-needle-3.png\",\"datePublished\":\"2022-06-14T00:45:25+00:00\",\"dateModified\":\"2025-11-07T03:58:52+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/jasonlcurby.com\\\/blog\\\/2022\\\/06\\\/14\\\/hack-the-box-challenge-walkthrough-the-needle\\\/#breadcrumb\"},\"inLanguage\":\"en-AU\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/jasonlcurby.com\\\/blog\\\/2022\\\/06\\\/14\\\/hack-the-box-challenge-walkthrough-the-needle\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-AU\",\"@id\":\"https:\\\/\\\/jasonlcurby.com\\\/blog\\\/2022\\\/06\\\/14\\\/hack-the-box-challenge-walkthrough-the-needle\\\/#primaryimage\",\"url\":\"https:\\\/\\\/jasonlcurby.com\\\/blog\\\/wp-content\\\/uploads\\\/2022\\\/06\\\/hackthebox-the-needle-3.png\",\"contentUrl\":\"https:\\\/\\\/jasonlcurby.com\\\/blog\\\/wp-content\\\/uploads\\\/2022\\\/06\\\/hackthebox-the-needle-3.png\",\"width\":975,\"height\":936,\"caption\":\"Extracting the download .bin file gives us a large haystack of a filesystem.\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/jasonlcurby.com\\\/blog\\\/2022\\\/06\\\/14\\\/hack-the-box-challenge-walkthrough-the-needle\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/jasonlcurby.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Hack The Box Challenge Walkthrough &#8211; The Needle\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/jasonlcurby.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/jasonlcurby.com\\\/blog\\\/\",\"name\":\"JLC\",\"description\":\"Rofo\",\"publisher\":{\"@id\":\"https:\\\/\\\/jasonlcurby.com\\\/blog\\\/#\\\/schema\\\/person\\\/187b41b22ffae39c83b69ddc480ea1f3\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/jasonlcurby.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-AU\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\\\/\\\/jasonlcurby.com\\\/blog\\\/#\\\/schema\\\/person\\\/187b41b22ffae39c83b69ddc480ea1f3\",\"name\":\"rofo\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-AU\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d2dd9850d47eebbd37c03d0e52e99b93092ad17dac4f99a7154b214dfe78d894?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d2dd9850d47eebbd37c03d0e52e99b93092ad17dac4f99a7154b214dfe78d894?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d2dd9850d47eebbd37c03d0e52e99b93092ad17dac4f99a7154b214dfe78d894?s=96&d=mm&r=g\",\"caption\":\"rofo\"},\"logo\":{\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d2dd9850d47eebbd37c03d0e52e99b93092ad17dac4f99a7154b214dfe78d894?s=96&d=mm&r=g\"},\"sameAs\":[\"https:\\\/\\\/jasonlcurby.com\\\/blog\",\"https:\\\/\\\/www.facebook.com\\\/jason.curby\",\"https:\\\/\\\/www.instagram.com\\\/jasoncurby\\\/\",\"https:\\\/\\\/www.linkedin.com\\\/in\\\/jason-curby\\\/\",\"https:\\\/\\\/x.com\\\/https:\\\/\\\/twitter.com\\\/JasonCurby\"],\"url\":\"https:\\\/\\\/jasonlcurby.com\\\/blog\\\/author\\\/jlcurby\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Hack The Box Challenge Walkthrough - The Needle - JLC","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/jasonlcurby.com\/blog\/2022\/06\/14\/hack-the-box-challenge-walkthrough-the-needle\/","og_locale":"en_US","og_type":"article","og_title":"Hack The Box Challenge Walkthrough - The Needle - JLC","og_description":"The Needle is a very easy challenge in the hardware category. The challenge description is as follows: &#8216;As a part of our SDLC process, we&#8217;ve got our firmware ready for security testing. Can you help us by performing a security assessment?&#8217; SHA-256 of the files necessary to download: 535191a711ea95bf58a6d64f940f9409f3af272fcfd685d0e72971e0d55ea03c. First Steps Let&#8217;s download the&nbsp;firmware.bin file [&hellip;]","og_url":"https:\/\/jasonlcurby.com\/blog\/2022\/06\/14\/hack-the-box-challenge-walkthrough-the-needle\/","og_site_name":"JLC","article_publisher":"https:\/\/www.facebook.com\/jason.curby","article_author":"https:\/\/www.facebook.com\/jason.curby","article_published_time":"2022-06-14T00:45:25+00:00","article_modified_time":"2025-11-07T03:58:52+00:00","og_image":[{"width":975,"height":936,"url":"https:\/\/jasonlcurby.com\/blog\/wp-content\/uploads\/2022\/06\/hackthebox-the-needle-3.png","type":"image\/png"}],"author":"rofo","twitter_card":"summary_large_image","twitter_creator":"@https:\/\/twitter.com\/JasonCurby","twitter_site":"@JasonCurby","twitter_misc":{"Written by":"rofo","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/jasonlcurby.com\/blog\/2022\/06\/14\/hack-the-box-challenge-walkthrough-the-needle\/#article","isPartOf":{"@id":"https:\/\/jasonlcurby.com\/blog\/2022\/06\/14\/hack-the-box-challenge-walkthrough-the-needle\/"},"author":{"name":"rofo","@id":"https:\/\/jasonlcurby.com\/blog\/#\/schema\/person\/187b41b22ffae39c83b69ddc480ea1f3"},"headline":"Hack The Box Challenge Walkthrough &#8211; The Needle","datePublished":"2022-06-14T00:45:25+00:00","dateModified":"2025-11-07T03:58:52+00:00","mainEntityOfPage":{"@id":"https:\/\/jasonlcurby.com\/blog\/2022\/06\/14\/hack-the-box-challenge-walkthrough-the-needle\/"},"wordCount":761,"commentCount":0,"publisher":{"@id":"https:\/\/jasonlcurby.com\/blog\/#\/schema\/person\/187b41b22ffae39c83b69ddc480ea1f3"},"image":{"@id":"https:\/\/jasonlcurby.com\/blog\/2022\/06\/14\/hack-the-box-challenge-walkthrough-the-needle\/#primaryimage"},"thumbnailUrl":"https:\/\/jasonlcurby.com\/blog\/wp-content\/uploads\/2022\/06\/hackthebox-the-needle-3.png","articleSection":["Cybersecurity","Hack The Box"],"inLanguage":"en-AU","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/jasonlcurby.com\/blog\/2022\/06\/14\/hack-the-box-challenge-walkthrough-the-needle\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/jasonlcurby.com\/blog\/2022\/06\/14\/hack-the-box-challenge-walkthrough-the-needle\/","url":"https:\/\/jasonlcurby.com\/blog\/2022\/06\/14\/hack-the-box-challenge-walkthrough-the-needle\/","name":"Hack The Box Challenge Walkthrough - The Needle - JLC","isPartOf":{"@id":"https:\/\/jasonlcurby.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/jasonlcurby.com\/blog\/2022\/06\/14\/hack-the-box-challenge-walkthrough-the-needle\/#primaryimage"},"image":{"@id":"https:\/\/jasonlcurby.com\/blog\/2022\/06\/14\/hack-the-box-challenge-walkthrough-the-needle\/#primaryimage"},"thumbnailUrl":"https:\/\/jasonlcurby.com\/blog\/wp-content\/uploads\/2022\/06\/hackthebox-the-needle-3.png","datePublished":"2022-06-14T00:45:25+00:00","dateModified":"2025-11-07T03:58:52+00:00","breadcrumb":{"@id":"https:\/\/jasonlcurby.com\/blog\/2022\/06\/14\/hack-the-box-challenge-walkthrough-the-needle\/#breadcrumb"},"inLanguage":"en-AU","potentialAction":[{"@type":"ReadAction","target":["https:\/\/jasonlcurby.com\/blog\/2022\/06\/14\/hack-the-box-challenge-walkthrough-the-needle\/"]}]},{"@type":"ImageObject","inLanguage":"en-AU","@id":"https:\/\/jasonlcurby.com\/blog\/2022\/06\/14\/hack-the-box-challenge-walkthrough-the-needle\/#primaryimage","url":"https:\/\/jasonlcurby.com\/blog\/wp-content\/uploads\/2022\/06\/hackthebox-the-needle-3.png","contentUrl":"https:\/\/jasonlcurby.com\/blog\/wp-content\/uploads\/2022\/06\/hackthebox-the-needle-3.png","width":975,"height":936,"caption":"Extracting the download .bin file gives us a large haystack of a filesystem."},{"@type":"BreadcrumbList","@id":"https:\/\/jasonlcurby.com\/blog\/2022\/06\/14\/hack-the-box-challenge-walkthrough-the-needle\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/jasonlcurby.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Hack The Box Challenge Walkthrough &#8211; The Needle"}]},{"@type":"WebSite","@id":"https:\/\/jasonlcurby.com\/blog\/#website","url":"https:\/\/jasonlcurby.com\/blog\/","name":"JLC","description":"Rofo","publisher":{"@id":"https:\/\/jasonlcurby.com\/blog\/#\/schema\/person\/187b41b22ffae39c83b69ddc480ea1f3"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/jasonlcurby.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-AU"},{"@type":["Person","Organization"],"@id":"https:\/\/jasonlcurby.com\/blog\/#\/schema\/person\/187b41b22ffae39c83b69ddc480ea1f3","name":"rofo","image":{"@type":"ImageObject","inLanguage":"en-AU","@id":"https:\/\/secure.gravatar.com\/avatar\/d2dd9850d47eebbd37c03d0e52e99b93092ad17dac4f99a7154b214dfe78d894?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/d2dd9850d47eebbd37c03d0e52e99b93092ad17dac4f99a7154b214dfe78d894?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d2dd9850d47eebbd37c03d0e52e99b93092ad17dac4f99a7154b214dfe78d894?s=96&d=mm&r=g","caption":"rofo"},"logo":{"@id":"https:\/\/secure.gravatar.com\/avatar\/d2dd9850d47eebbd37c03d0e52e99b93092ad17dac4f99a7154b214dfe78d894?s=96&d=mm&r=g"},"sameAs":["https:\/\/jasonlcurby.com\/blog","https:\/\/www.facebook.com\/jason.curby","https:\/\/www.instagram.com\/jasoncurby\/","https:\/\/www.linkedin.com\/in\/jason-curby\/","https:\/\/x.com\/https:\/\/twitter.com\/JasonCurby"],"url":"https:\/\/jasonlcurby.com\/blog\/author\/jlcurby\/"}]}},"_links":{"self":[{"href":"https:\/\/jasonlcurby.com\/blog\/wp-json\/wp\/v2\/posts\/59","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/jasonlcurby.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/jasonlcurby.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/jasonlcurby.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/jasonlcurby.com\/blog\/wp-json\/wp\/v2\/comments?post=59"}],"version-history":[{"count":30,"href":"https:\/\/jasonlcurby.com\/blog\/wp-json\/wp\/v2\/posts\/59\/revisions"}],"predecessor-version":[{"id":184,"href":"https:\/\/jasonlcurby.com\/blog\/wp-json\/wp\/v2\/posts\/59\/revisions\/184"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/jasonlcurby.com\/blog\/wp-json\/wp\/v2\/media\/70"}],"wp:attachment":[{"href":"https:\/\/jasonlcurby.com\/blog\/wp-json\/wp\/v2\/media?parent=59"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/jasonlcurby.com\/blog\/wp-json\/wp\/v2\/categories?post=59"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/jasonlcurby.com\/blog\/wp-json\/wp\/v2\/tags?post=59"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}