The Puppet Master

Platform: HackTheBox | Category: OSINT | Type: Challenge | Difficulty: Easy | OS: NA | Author: D3v0o0Nu11 | Date: 2026-01-26 | Status: Solved Techniques: image_reverse_search, source_code_analysis, technical_spec_lookup

Summary

Task: OSINT challenge requiring investigation of a React web app to identify military equipment. Solution: Extract hidden image URL from JS source code, identify Bushmaster vehicle from NZDF website, gather technical specifications.

Recon

Port scan

nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: hackthebox | ID: 20260126_hackthebox_the_puppet_master
• Tags: osint, web_source, vehicle_id, geoint
• Indicators: React application, NZDF image URL, Bushmaster vehicle
• Source: 20260126_hackthebox_the_puppet_master.md

Foothold

Vulnerability / Misconfiguration

1. Image_reverse_search
2. Source_code_analysis
3. Technical_spec_lookup

<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

<command>

Flags

Key Takeaways / Lessons

• image_reverse_search
• source_code_analysis
• technical_spec_lookup
• Tags: osint, web_source, vehicle_id, geoint

Original Writeup

<details><summary>Click to expand original content</summary>

Description

The Puppet Master is an OSINT challenge that requires conducting an investigation based on data found in a web application and identifying military equipment.

Analysis

1. Upon examining the challenge website, it was discovered that it is built on React.
2. In the JavaScript source code (via DevTools), a direct link to an image used in the application was found: https://www.nzdf.mil.nz/assets/Uploads/BannerImages/20230525_NZDF_P1061532_025__FocusFillWyIwLjAwIiwiMC4wMCIsNjAwLDQwMF0.JPG
3. The link leads to the official New Zealand Defence Force (NZDF) website.

Solution

Step 1: Vehicle Identification

The image shows an armored vehicle. Searching the NZDF website and visual comparison allowed identification of it as the Bushmaster Protected Mobility Vehicle (NZ5.5 variant), used by NZDF.

Step 2: Gathering Specifications

To complete the 5-stage investigation on the challenge website, the following vehicle data was required:

• Vehicle: Bushmaster
• Manufacturer: Thales Australia
• First service: 1997
• Origin: Australia
• Capacity: 10 people (9 passengers + 1 driver)

Step 3: Obtaining the Flag

After entering all specifications into the form on the challenge website, the final flag was unlocked.

</details>

---

Auto-tracked: saved to WriteUps; run /xesor-revise to fold lessons into XESXor_Methodology.md.

signed by XESXOR