https://app.hackthebox.com/challenges/802

Description

You’ve infiltrated the secret meeting of the demonic cult - they want you to join their summoning circle. But who to link hands with?

Exploitation

#!/usr/bin/python3
import subprocess,concurrent.futures,signal,sys,os

start_first_addr = 0x00404040
end_first_addr = 0x004042af
start_second_addr = 0x00404040
end_second_addr = 0x004042af
last_output = None
stop_brute_force = False

def test_addresses(first_address, second_address):
    global last_output
    if stop_brute_force: return
    input_str = f"{first_address:#x} {second_address:#x}"
    process = subprocess.Popen('./link', stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
    try:
        stdout, stderr = process.communicate(input=input_str.encode())
        output_str = stdout.decode().strip()
        if output_str and (last_output is None or output_str != last_output):
            print(f"Output for first address {first_address:#x}, second address {second_address:#x}: {output_str}")
            last_output = output_str
    except Exception as e:
        print(f"Error for {first_address:#x}, {second_address:#x}: {str(e)}")

def signal_handler(sig, frame):
    global stop_brute_force
    print("\nCtrl+C detected. Forcefully stopping brute force...")
    stop_brute_force = True
    os._exit(1)

def brute_force():
    with concurrent.futures.ThreadPoolExecutor(max_workers=10) as executor:
        futures = [executor.submit(test_addresses, first, second) 
                   for first in range(start_first_addr, end_first_addr + 1)
                   for second in range(start_second_addr, end_second_addr + 1)]
        for future in concurrent.futures.as_completed(futures):
            if stop_brute_force: break

signal.signal(signal.SIGINT, signal_handler)
print("Starting brute force for both addresses using multi-threading...")
brute_force()
print("Brute force complete.")

Summary

LinkHands: reverse the validation logic, model the transform, and recover the accepted input.