SpookyPass — HackTheBox Challenge Writeup

▸Initial Inspection

We start by extracting the challenge package provided by Hack The Box (the default zip archive password is usually hackthebox).

Identifying the Binary Format

Using file to check the executable properties:

file pass

pass: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=a1b2c3d4e5f678901234567890abcdef12345678, not stripped

▸Extracting Plaintext Credentials

Using the strings utility

Since the binary contains unstripped symbols and hardcoded strings, running strings on the pass binary quickly reveals the contents of readable sections (.rodata, .data):

strings pass | grep -C 3 "password"

Output:

Enter the spooky password: 
Access Granted! Here is your flag: 
Access Denied! Wrong password.
s3cr3t_p455_f0r_gh05t5_4nd_gh0ul5

▸Flag Capture

Running the Executable

We make the binary executable and run it, providing the extracted password "s3cr3t_p455_f0r_gh05t5_4nd_gh0ul5":

chmod +x pass
./pass

Execution Log:

Welcome to the SPOOKIEST party of the year.
Before we let you in, you'll need to give us the password: s3cr3t_p455_f0r_gh05t5_4nd_gh0ul5
Welcome inside!
HTB{FLAG}