← Landing page Writeups home

Use the tree to jump between collections without leaving the reader.

archive Select writeup Open tree
HackTheBox/Challenges/Challenge Spooky Pass.en.md READ_ONLY

Challenge Spooky Pass

This challenge consists of analyzing an executable to find its password and the solution consists of using Ghidra to examine the main function, extract the static password, and run the binary to obtain the flag.

Solution

  • Download the archive and extract it. This produces a folder called rev_spookypass with a file named pass:

  • Run it and you will see that it asks for a password:

  • Open the binary in Ghidra and start analyzing it:

  • Keep reading through the file contents in Ghidra:

  • In the main function, the password needed to run pass appears directly: iVar1 = strcmp(local_98,"s3cr3t_p455_f0r_gh05t5_4nd_gh0ul5");

  • Run the executable with that password and the flag is displayed: