Photon Lockdown

Platform: HackTheBox | Category: Hardware | Difficulty: Very Easy | Author: D3v0o0Nu11 | Date: 2026-02-10

Description

We've located the adversary's location and must now secure access to their Optical Network Terminal to disable their internet connection. Fortunately, we've obtained a copy of the device's firmware, which is suspected to contain hardcoded credentials. Can you extract the password from it?

Solution Approach

Core idea: Extracting a squash file using unsquashfs.

Steps

1. In this challenge we're given 3 files. fwu_ver and hw_ver seems not our interest (judging from the filesize).

2. Noticed there's a rootfs file, it's a squash file which means a compressed read-only filesystem format commonly used in Linux distributions and embedded systems. It allows for efficient storage and distribution of file systems by compressing them into a single file.

3. To unsquash it we can use --> sudo unsquashfs rootfs.

CONTENT OF ROOTFS

1. Seems our objective is to find the flag locations. Actually I found 2 methods, the first one is the method used for linux privesc to identify custom binaries, password stored, or else.

COMMAND:

grep --include=*.{txt,xml,php,py,conf,yml} -rnw '.' -ie 'HTB' 2>/dev/null

1. The second method is just strings all the available files inside the directories and grab for the flag's prefix.

2. Anyway, we got the flag!

Flag

REDACTED

Lessons Learned

1. Extracting a squash file using unsquashfs.