Hardware - Espresso

Fri, 05 Jun 2026 00:00:00 +0000

Hack The Box Challenge Writeup: Espresso Link to heading

Challenge Link to heading

Name: Espresso

Scenario:

Someone leaked the new Espresso firmware, can you try to figure out what it does?

The challenge provides an ESP32 firmware image. The firmware checks whether it is running on expected hardware by comparing the ESP32 factory MAC address against zero bytes. If the check fails, it prints anti-clone messages. If the check passes, it generates the flag by XOR decoding a 31 byte table stored in the firmware data segment.

Herald

Sun, 10 May 2026 00:00:00 +0000

Nmap Scan

[12ms][127][~/herald]$ nmap -sCV 10.0.12.3
Starting Nmap 7.98 ( https://nmap.org ) at 2026-04-13 17:45 -0400
Stats: 0:00:50 elapsed; 0 hosts completed (1 up), 1 undergoing Script Scan
NSE Timing: About 99.95% done; ETC: 17:46 (0:00:00 remaining)
Nmap scan report for herald.htb (10.0.12.3)
Host is up (0.00091s latency).
Not shown: 986 filtered tcp ports (no-response)
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-04-13 21:45:30Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: herald.htb, Site: Default-First-Site-Name)
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
1433/tcp open ms-sql-s Microsoft SQL Server 2019 15.00.2000.00; RTM
| ms-sql-info: 
| 10.0.12.3:1433: 
| Version: 
| name: Microsoft SQL Server 2019 RTM
| number: 15.00.2000.00
| Product: Microsoft SQL Server 2019
| Service pack level: RTM
| Post-SP patches applied: false
|_ TCP port: 1433
|_ssl-date: 2026-04-13T21:46:08+00:00; -3s from scanner time.
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
| Not valid before: 2026-04-13T21:42:38
|_Not valid after: 2056-04-13T21:42:38
| ms-sql-ntlm-info: 
| 10.0.12.3:1433: 
| Target_Name: HERALD
| NetBIOS_Domain_Name: HERALD
| NetBIOS_Computer_Name: DC01
| DNS_Domain_Name: herald.htb
| DNS_Computer_Name: DC01.herald.htb
| DNS_Tree_Name: herald.htb
|_ Product_Version: 10.0.17763
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: herald.htb, Site: Default-First-Site-Name)
3269/tcp open tcpwrapped
5357/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Service Unavailable
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
MAC Address: 08:00:27:0F:D0:78 (Oracle VirtualBox virtual NIC)
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode: 
| 3.1.1: 
|_ Message signing enabled and required
|_clock-skew: mean: 0s, deviation: 3s, median: 1s
| smb2-time: 
| date: 2026-04-13T21:45:35
|_ start_date: N/A
|_nbstat: NetBIOS name: DC01, NetBIOS user: <unknown>, NetBIOS MAC: 08:00:27:0f:d0:78 (Oracle VirtualBox virtual NIC)

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 61.04 seconds

add in etc/hosts

VeryEasy on z3r0s

Hardware - Espresso

Hack The Box Challenge Writeup: Espresso Link to heading

Challenge Link to heading

Summary Link to heading

Herald