Insider

Platform: HackTheBox | Category: Forensics | Difficulty: Easy | Author: D3v0o0Nu11 | Date: 2026-02-10

Description

A potential insider threat has been reported, and we need to find out what they accessed. Can you help?

Solution Approach

Core idea: Identify the weakness from source review or fingerprinting first. Iterate with incremental payloads instead of guessing.

Steps

1. First, unzip the .zip file given, then jump to the extracted directory.

2. Notice we have few .sqlite database and there's cookies.sqlite database inside the 2542z9mo.default-release directory.

3. Let's open that database using DBbrowser.

4. Hmm.. Got nothing interesting here.

5. Let's see if there are any other files that can be our interest.

6. Let's check the login.json.

USE PRETTY PRINT

 json read-only • copy allowed Copy
{
  "nextId": 2,
  "logins": [
    {
      "id": 1,
      "hostname": "http://acc01:8080",
      "httpRealm": "Tomcat Manager Application",
      "formSubmitURL": null,
      "usernameField": "",
      "passwordField": "",
      "encryptedUsername": "MDIEEPgAAAAAAAAAAAAAAAAAAAEwFAYIKoZIhvcNAwcECF+d3kuwB9ZWBAj5QRmuUB+gqg==",
      "encryptedPassword": "MEIEEPgAAAAAAAAAAAAAAAAAAAEwFAYIKoZIhvcNAwcECBqsTKru3+k8BBgCXKb5CRSS4SF6O3Dh4jUKFRBtxfiabQk=",
      "guid": "{69f06e46-1ffa-42a0-9166-0ca4b8fac057}",
      "encType": 1,
      "timeCreated": 1604509320314,
      "timeLastUsed": 1604509320314,
      "timePasswordChanged": 1604509320314,
      "timesUsed": 1
    }
  ],
  "potentiallyVulnerablePasswords": [],
  "dismissedBreachAlertsByLoginGUID": {},
  "version": 3
}

1. Stuck here, so i did a small outsource about this, found out that we can use firefox_decrypt.py to decrypt the password.

firefox_decrypt.py github link

https://github.com/unode/firefox_decrypt

PAYLOAD

 sh read-only • copy allowed Copy
python3 firefox_decrypt.py foren/Mozilla/Firefox/Profiles/2542z9mo.default-release

1. Got the flag!

Flag

REDACTED

Lessons Learned

1. Identify the weakness from source review or fingerprinting first.
2. Iterate with incremental payloads instead of guessing.
3. Reuse the same pattern in future engagements.