Anti Flag

Platform: HackTheBox | Category: Reversing | Difficulty: N/A | Author: D3v0o0Nu11 | Date: 2026-02-10

Description

Flag? What's a flag?

Solution Approach

Core idea: Identify the weakness from source review or fingerprinting first. Iterate with incremental payloads instead of guessing.

Steps

1. First, unzip the .zip file given.

2. Next, check type of file we got.

3. Run the binary.

4. Hmm.. let us decompile the binary.

5. Looks like i found the main function.

6. Found something that could be our interest.

7. Could be this is an encrypted flag??

8. And this is the key?

9. But i don't know what encryption algorithm used.

10. Let us user another approach with patching the binary.

11. After analyzing the main() function, actually we can change the intruction for this offset to jmp to 0x1525.

12. Now export the binary and run it.

13. Got the flag!

ALTERNATE SOLUTION

1. Also we can solve it dynamically with gdb.

2. As we know the binary protection for PIE is enabled.

3. So to solve it dynamically we need to identify the piebase to do a jump (dynamically).

4. Before that i realize ghidra removes uncreachable code which we can undo that by doing this at ghidra:

edit -> tool options -> analysis -> "do uncheck" for eliminate reachable code

1. Then click apply.

2. As you can see we got another logic validations at the middle, which we can bypass by simply change to true, then we can get the flag easily (for static).

3. For dynamic, since the binary is stripped, we can't just set a breakpoint there:

4. Because we don't now the base address for the offset we want and we can't see the address.

5. But we can start breakpoint by ran starti. With this we can jump to the flag decode function to get the flag.

OUR INTEREST OFFSET TO JUMP (THE FLAG DECODE FUNCTION) --> 0x1525

1. We can run piebase 0x1525 to get the piebase for that offset then jump to the piebase we got.
2. But we can't just do that, it shall gave us SEGMENTATION FAULT.
3. We need to breakrva first at the first check (first if statement), then hit continue and grab the piebase for 0x1525 to jump there.

SET BREAKPOINT AT 0x14f4 (first breakpoint) and hti continue

HIT CONTINUE

GET PIEBASE for 0x1525 and JUMP there.

1. Got the flag!

Flag

REDACTED

Lessons Learned

1. Identify the weakness from source review or fingerprinting first.
2. Iterate with incremental payloads instead of guessing.
3. Reuse the same pattern in future engagements.