Phreaky

Platform: HackTheBox | Category: Forensics | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2026-01-29 | Status: Solved Techniques: email_extraction, file_carving, password_protected_zip, pcap_analysis

Summary

"In the shadowed realm where the Phreaks hold sway"

Phreaky — HackTheBox

Description

"In the shadowed realm where the Phreaks hold sway"

The challenge provided a download link to a ZIP file containing a PCAP capture.

Analysis

Initial Analysis

Downloaded and extracted the challenge file (password: hackthebox), revealing phreaky.pcap - a network capture file.

PCAP Protocol Analysis

Analyzed the PCAP with tshark to identify protocols:

 bash read-only • copy allowed Copy
tshark -r phreaky.pcap -q -z io,phs

Key findings:

• SMTP traffic (337 frames)
• IMF (Internet Message Format) - 15 email messages
• Emails sent from caleb@thephreaks.com to resources@thetalents.com
• Subject: "Secure File Transfer"

Email Extraction

Exported email objects from the PCAP:

 bash read-only • copy allowed Copy
tshark -r phreaky.pcap -Y "smtp" --export-objects "imf,emails"

Found 15 unique emails (with duplicates totaling 30 files). Each email contained:

1. A text body with a password (e.g., "Password: S3W8yzixNoL8")
2. A base64-encoded ZIP attachment

Attachment Analysis

Each ZIP file contained a part of a PDF file:

• phreaks_plan.pdf.part1 through phreaks_plan.pdf.part15
• Each ZIP was password-protected with a unique password from its email

Passwords found:

Solution

Python Extraction Script

Created a Python script to:

1. Parse all .eml files
2. Extract passwords from email bodies
3. Decode base64 ZIP attachments
4. Extract each part using its password
5. Combine all parts in order

 python read-only • copy allowed Copy
#!/usr/bin/env python3
import os, base64, zipfile, re
from email import policy
from email.parser import BytesParser

emails_dir = "emails"
parts = {}

for filename in sorted(os.listdir(emails_dir)):
    if not filename.endswith('.eml'):
        continue
    
    with open(os.path.join(emails_dir, filename), 'rb') as f:
        msg = BytesParser(policy=policy.default).parse(f)
    
    password = None
    zip_data = None
    zip_filename = None
    
    for part in msg.walk():
        if part.get_content_type() == 'text/plain':
            match = re.search(r'Password:\s*(\S+)', part.get_content())
            if match:
                password = match.group(1)
        elif part.get_content_type() == 'application/zip':
            zip_data = part.get_content()
            fn_match = re.search(r'filename\*0="([^"]+)"', str(part))
            fn_match2 = re.search(r'filename\*1="([^"]+)"', str(part))
            if fn_match and fn_match2:
                zip_filename = fn_match.group(1) + fn_match2.group(1)
    
    if password and zip_data and zip_filename:
        if zip_filename not in parts:
            parts[zip_filename] = (password, zip_data)

# Extract and combine parts
extracted_parts = {}
os.makedirs("extracted", exist_ok=True)

for zip_filename, (password, zip_data) in parts.items():
    zip_path = os.path.join("extracted", zip_filename)
    with open(zip_path, 'wb') as f:
        f.write(zip_data)
    
    with zipfile.ZipFile(zip_path, 'r') as zf:
        zf.setpassword(password.encode())
        for name in zf.namelist():
            match = re.search(r'\.part(\d+)$', name)
            if match:
                part_num = int(match.group(1))
                extracted_parts[part_num] = zf.read(name)

# Combine all parts
combined = b''.join(extracted_parts[i] for i in sorted(extracted_parts.keys()))
with open("phreaks_plan.pdf", 'wb') as f:
    f.write(combined)

PDF Analysis

The combined file was a valid PDF document (3302 bytes, 2 pages) titled "Operation Spotlight: The Phreaks' Grand Scheme Against The Talents".

Extracted text with:

 bash read-only • copy allowed Copy
pdftotext phreaks_plan.pdf -

The document described a fictional operation plan, and the flag was hidden in the Appendix section:

Appendix: Communication Protocols For secure communication, all operatives are required to use encrypted channels only. Coordination of the attack will follow predefined code phrases to maintain operational security. Key for secure communication: HTB{REDACTED}.

Tools Used

• tshark - Wireshark CLI for PCAP analysis and object extraction
• Python 3 - email and zipfile modules for parsing and extraction
• pdftotext - PDF text extraction