Peel Back The Layers

Platform: HackTheBox | Category: Forensics | Difficulty: Easy | Author: D3v0o0Nu11 | Date: 2026-02-10

Description

A well known hacker rival of ours, managed to gain access to our dockehub profile and insert a backdoor to one of our public docker images in order to distribute his malware and fullfil his soul purpose, which is to destroy our steampunk robot using his steam malware. When we started tracing him back he deleted his backdoor. Can you help us retrieve his backdoor? Docker Image: steammaintainer/gearrepairimage

Solution Approach

Core idea: Identify the weakness from source review or fingerprinting first. Iterate with incremental payloads instead of guessing.

Steps

1. Based from the description, let's pull the image using docker command.

docker pull steammaintainer/gearrepairimage

1. Let's save it on a .tar file.

sudo docker save steammaintainer/gearrepairimage > peel.tar

1. Let's untar the .tar file.

2. Let's jump to this directory first.

3. Now let's untar the layer.tar file, then jump to the extracted directory.

4. Got a binary file.

5. Let's strings it first.

6. Surprisingly got the flag!

7. But remove the H character first.

Flag

REDACTED

Lessons Learned

1. Identify the weakness from source review or fingerprinting first.
2. Iterate with incremental payloads instead of guessing.
3. Reuse the same pattern in future engagements.