echoland

Platform: HackTheBox | Category: Pwn | Difficulty: N/A | Author: D3v0o0Nu11 | Date: 2026-02-10

Description

It is heavily raining. You run to the cave in order to find shelter, but a heavy boulder falls and shuts your exit. Darkness everywhere, you cannot see a thing. You and your friend get separated. You need your friend to help you move the boulder! You shout, and shout for dear life, but there's dead silence and your friend is nowhere to be found. Are you really both going to be stuck in this cave forever, or are you going to do something to get a response back?

Solution Approach

Core idea: Pwning blind PWN. Exploiting Format Strings Bug (leaking PIE and LIBC runtime).

Steps

1. In this challenge we're not given any binary or source code. It's a blind pwn challenge.
2. Knowing this is a blind pwn challenge, most likely there is FSB and the program flow shall be simple.

Identifying FSB

1. We're given 2 menu options, but the FSB is found at the menu option prompt. The second menu seems should not be our interest.

2. Upon checking whether there is canary by simply sending 1024 cyclic pattern, got segfault but no stack smashing. This indicates that there is no canary.

3. Further checking, by leaking addresses, found that PIE is enabled.

4. In a blind pwn challenge, the objective is to dump the binary. The first approach is to identify potential main() function.

5. At this state we're lacking of visibility, index 12, 17, or 20 can be used to dump the binary.

6. Try address at index 12 and substract few bytes until we met the ELF Magic Bytes.

Flag

(no flag captured)

Lessons Learned

1. Pwning blind PWN.
2. Exploiting Format Strings Bug (leaking PIE and LIBC runtime).
3. Binary dumping.