Hunting License

Platform: HackTheBox | Category: Reversing | Difficulty: N/A | Author: D3v0o0Nu11 | Date: 2026-02-10

Description

STOP! Adventurer, have you got an up to date relic hunting license? If you don't, you'll need to take the exam again before you'll be allowed passage into the spacelanes!

Solution Approach

Core idea: Identify the weakness from source review or fingerprinting first. Iterate with incremental payloads instead of guessing.

Steps

1. Unzipping the zip file shall resulting to a 64 bit binary file.

2. It's interesting, because in reversing we're rarely have a host to run in order to get the flag.

3. Let us run the host first to check what is it.

4. Seems we need to answer all the questions in order to get the flag.

5. The first questions it asked about the file format.

6. Well we can check that simply by running file license and as you can see the format file is ELF.

7. Now it's asking the CPU Architecture, Based on the result of file command, it's 64 bit.

8. Let us run ldd to the binary -> ldd license. It's libreadline.so.8.

9. Now it's asking the address of the main() function.

Using GDB

1. It's 0x401172.

2. Well we still can identify that by disassemble the main() function.

3. We have 5 puts@plt.

4. Next, it's asking for the first password.

Using GHIDRA

1. To make sure we have the correct password, let us run the binary.

2. Got it correctly -> PasswordNumeroUno.

3. Next it's asking the reversed form of the 2nd password.

4. Let us analyze the main() function.

5. It seems the 2nd password is the result of the reverse() call.

6. Since it will take time to do static analysis, let us do dynamic by set a breakpoint at the strcmp().

Using GDB

1. Now enter random text.

2. We hit the breakpoint.

3. As you can see it's comparing our input to P4ssw0rdTw0. It must be the correct one, let us test that by use them.

4. Got it correct!

5. To answer the question simply reverse it -> 0wTdr0wss4P.

6. It's asking for the real one -> P4ssw0rdTw0.

7. It's asking for the key used to XOR. Open ghidra again.

8. It using the 4th param as the key.

9. It's 19 then.

10. To get the 3rd password, simply do the same process by set a breakpoint at the comparing section.

11. Turns out it's -> ThirdAndFinal!!!

12. Got the flag!

Flag

REDACTED

Lessons Learned

1. Identify the weakness from source review or fingerprinting first.
2. Iterate with incremental payloads instead of guessing.
3. Reuse the same pattern in future engagements.