Alien Cradle — HTB Writeup | The Hack Sparrow

A suspicious PowerShell script (a download cradle). The flag isn't in the remote payload but obfuscated by string concatenation within the script itself.

Challenge overview

Field	Value
Platform	Hack The Box · Challenge
Category	Forensics
Difficulty	Very Easy
State	Retired
Files	`cradle.ps1`

Attack map

[cradle.ps1] malicious PowerShell
      │
      ▼
[check] WindowsIdentity == secret_HQ\Arth
      │
      ▼
[download+IEX] remote payload (decoy)
      │
      ▼
[$f='H'+'T'+'B'+...] concatenated flag
      │
      ▼
[FLAG]

Script PowerShell sospechoso (un cradle de descarga). La flag no está en el payload remoto sino ofuscada por concatenación de cadenas dentro del propio script.

Ficha del challenge

Campo	Valor
Plataforma	Hack The Box · Challenge
Categoría	Forensics
Dificultad	Very Easy
Estado	Retirado
Archivos	`cradle.ps1`

Mapa del ataque

[cradle.ps1] PowerShell malicioso
      │
      ▼
[check] WindowsIdentity == secret_HQ\Arth
      │
      ▼
[download+IEX] payload remoto (señuelo)
      │
      ▼
[$f='H'+'T'+'B'+...] flag concatenada
      │
      ▼
[FLAG]

🔒 Free account required

This is USER ACCESS content — free to unlock, no payment. The rest of the write-up (and everything else at this level) opens up once you're signed in.

Create a free account