LootStash

Platform: HackTheBox | Category: Reversing | Type: Challenge | Difficulty: Very_easy | OS: NA | Author: D3v0o0Nu11 | Date: 2026-02-17 | Status: Solved Techniques: flag_grep, noise_filtering, strings_extraction

Summary

The task provides a zip archive with a single file stash — an ELF binary containing hundreds of decoy strings. The goal is to find the flag among the "junk" data.

Recon

Port scan

nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: HackTheBox | ID: 20260217_hackthebox_lootstash
• Tags: grep, static_analysis, elf, strings, plaintext_flag
• Indicators: ELF binary with many embedded strings, flag hidden among decoy data, no obfuscation or encryption
• Source: 20260217_hackthebox_lootstash.md

Foothold

Vulnerability / Misconfiguration

1. Flag_grep
2. Noise_filtering
3. Strings_extraction

<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

<command>

Flags

Key Takeaways / Lessons

• flag_grep
• noise_filtering
• strings_extraction
• Tags: grep, static_analysis, elf, strings, plaintext_flag

Original Writeup

<details><summary>Click to expand original content</summary>

Description

A giant stash of powerful weapons and gear have been dropped into the arena - but there's one item you have in mind. Can you filter through the stack to get to the one thing you really need?

The task provides a zip archive with a single file stash — an ELF binary containing hundreds of decoy strings. The goal is to find the flag among the "junk" data.

Analysis

File Identification

$ file stash
stash: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, not stripped

Standard 64-bit ELF, dynamically linked, not stripped — no signs of packing or obfuscation.

String Examination

$ strings stash | head -30
Ebony, Core of Perdition
Phantomdream, Trinket of the Corrupted
Shadowstrike, Pendant of Twilight's End
Doomhowl, Relic of the Fallen
Stormfang, Amulet of Eternal Fury
...

The binary contains hundreds of strings with fantasy weapon and gear names — this is the "loot stash". The strings appear to be decorative noise, among which the flag is hidden.

Finding the Flag

$ strings stash | grep "HTB{"
HTB{REDACTED}

The flag was found instantly — it's stored in plaintext among hundreds of decoy strings. No encryption, encoding, or obfuscation was applied.

Meaning of the Name

The flag HTB{REDACTED} is leetspeak for "needle in a loot stack", a play on the idiom "needle in a haystack". The task description directly hints at this: you need to "filter through the stack" to find the one thing you need.

Solution

Commands

# 1. Extract the archive
unzip rev_lootstash.zip

# 2. Identify the file
file stash

# 3. Find the flag
strings stash | grep "HTB{"

The solution takes one command after extraction — the classic strings | grep.

Alternative One-liner

strings stash | grep -oE "HTB\{[^}]+\}"

Lessons

1. Always start with strings | grep — before launching a disassembler or debugger, check if the flag is in plaintext. This takes 2 seconds and solves ~10% of reverse tasks at CTFs
2. The task description is a hint — "filter through the stack" directly tells you the solving technique: string filtering
3. The flag name confirms the method — "needle in a loot stack" = you just needed to grep the needle in the haystack

Alternative Approaches

• Ghidra/IDA — you can open the binary and find the string in the .rodata section, but this is overkill for this task
• hexdump / xxd — search for the hex pattern 48 54 42 7B (HTB{) in the binary file
• rabin2 -z — extract strings via radare2, similar to strings

</details>

---

Auto-tracked: saved to WriteUps; run /xesor-revise to fold lessons into XESXor_Methodology.md.

signed by XESXOR