HackTheBox LinkHands Challenge
https://app.hackthebox.com/challenges/802
Description
You’ve infiltrated the secret meeting of the demonic cult - they want you to join their summoning circle. But who to link hands with?
Exploitation
#!/usr/bin/python3
import subprocess,concurrent.futures,signal,sys,os
start_first_addr = 0x00404040
end_first_addr = 0x004042af
start_second_addr = 0x00404040
end_second_addr = 0x004042af
last_output = None
stop_brute_force = False
def test_addresses(first_address, second_address):
global last_output
if stop_brute_force: return
input_str = f"{first_address:#x} {second_address:#x}"
process = subprocess.Popen('./link', stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
try:
stdout, stderr = process.communicate(input=input_str.encode())
output_str = stdout.decode().strip()
if output_str and (last_output is None or output_str != last_output):
print(f"Output for first address {first_address:#x}, second address {second_address:#x}: {output_str}")
last_output = output_str
except Exception as e:
print(f"Error for {first_address:#x}, {second_address:#x}: {str(e)}")
def signal_handler(sig, frame):
global stop_brute_force
print("\nCtrl+C detected. Forcefully stopping brute force...")
stop_brute_force = True
os._exit(1)
def brute_force():
with concurrent.futures.ThreadPoolExecutor(max_workers=10) as executor:
futures = [executor.submit(test_addresses, first, second)
for first in range(start_first_addr, end_first_addr + 1)
for second in range(start_second_addr, end_second_addr + 1)]
for future in concurrent.futures.as_completed(futures):
if stop_brute_force: break
signal.signal(signal.SIGINT, signal_handler)
print("Starting brute force for both addresses using multi-threading...")
brute_force()
print("Brute force complete.")
Summary
LinkHands: reverse the validation logic, model the transform, and recover the accepted input.