Distract And Destroy

Technical Walkthrough

Writeup

Challenge

• Name: Distract-and-Destroy
• Category: Blockchain
• Difficulty: Very Easy
• Mode: remote

Summary

The launcher exposed a funded private key, player address, setup address, target address, and RPC endpoint. The Creature contract only loses life when attacked by a contract after aggro has first been set by a different sender, so the solve path was to refresh the live connection info, deploy one helper to set aggro, and a second helper to deal 1000 damage and immediately loot the target balance, making Setup.isSolved() true.

The launcher exposed the private key, player address, setup address, target address, and RPC endpoint. The Creature contract only loses life when attacked by a contract after aggro has first been set by a different sender, so the solve path was to deploy one helper to set aggro and a second helper to deal 1000 damage and immediately loot the target balance, making Setup.isSolved() true.

Artifact Inventory

• analysis/connection_info.http — initial launcher credentials and addresses.
• analysis/connection_info-live.json — refreshed live credentials and addresses used for the final solve.
• analysis/extracted/blockchain_distract_and_destroy/Creature.sol — challenge contract source.
• analysis/extracted/blockchain_distract_and_destroy/Setup.sol — setup/win-condition source.
• analysis/solve-result.json — post-exploit state showing isSolved=true.
• analysis/flag-response.txt — raw flag response before harness capture.
• solve/solve.py — reproducible exploit.

• analysis/connection_info.http — live chain credentials and contract addresses.
• analysis/extracted/blockchain_distract_and_destroy/Creature.sol — challenge contract source.
• analysis/extracted/blockchain_distract_and_destroy/Setup.sol — setup/win-condition source.
• analysis/solve-result.json — post-exploit chain state showing isSolved=true.
• analysis/flag-response.txt — raw flag response before harness capture.
• solve/solve.py — reproducible exploit.

Reference analysis/artifact-inventory.json and summarize the relevant files or remote surface.

Analysis

Setup.isSolved() returns true when the target contract balance reaches zero. Creature.attack() only subtracts damage when _isOffBalance() is true and aggro != msg.sender. Because _isOffBalance() checks tx.origin != msg.sender, calls must come from contracts, not EOAs. The first helper contract calls attack(0) to set aggro to its own address. The second helper contract then calls attack(1000) as a different contract address, satisfying both conditions and reducing lifePoints to zero, then calls loot() to drain the balance.

Setup.isSolved() returns true when the target contract balance reaches zero. Creature.attack() only subtracts damage when _isOffBalance() is true and aggro != msg.sender. Because _isOffBalance() checks tx.origin != msg.sender, calls must come from contracts, not EOAs. The first helper contract calls attack(0) to set aggro to its own address. The second helper contract then calls attack(1000) as a different contract, satisfying both conditions and reducing lifePoints to zero, then calls loot() to drain the 10 wei balance.

Solve

The solver refreshes /connection_info at runtime to avoid stale setup/target addresses after resets, then uses web3 and py-solc-x to compile and deploy two tiny helper contracts. One sets aggro, the second attacks for 1000 damage from a different contract address and then calls loot(). After verifying Setup.isSolved(), the solver fetches /flag.

The solver uses web3 and py-solc-x to compile and deploy two tiny helper contracts. The first constructor sets aggro on the target. The second constructor attacks for 1000 damage from a different contract address and then calls loot(). After the deployments, the solver verifies Setup.isSolved() and fetches /flag.

Flag

Raw flag is stored in loot/flag.txt and intentionally not reproduced here.

Lessons

When blockchain challenge launchers expose connection info via HTTP, refresh that data immediately before exploitation rather than trusting previously fetched addresses. Here the core bug was still tx.origin != msg.sender, but stale launcher addresses would make an otherwise correct exploit fail silently.

When a blockchain launcher directly exposes a funded private key and contract addresses, read the docs and source before installing heavy tooling. Here the intended trick was understanding tx.origin != msg.sender and using two contract deployments rather than a direct EOA transaction.

Source-Backed Dossier

The sections below are merged from companion Markdown notes for the same case. They are rendered after sanitization so the article stays precise without publishing raw flags, credentials, or target-specific secrets.

Notes

Scope

• Challenge: Distract-and-Destroy
• Category: Blockchain
• Difficulty: Very Easy
• Mode: remote
• Remote instance: <TARGET>:31125
• Start time: 2026-06-07T08:49:07Z
• Operator: harness
• State file: challenge-state.json

Harness Status

• Current phase: see challenge-state.json
• Next allowed actions: see next-action.json
• Raw flags and sensitive material stay in loot/ only. Do not paste them here.

Artifact Inventory

Evidence Ledger

Key Findings

-

RAG / Advisory Memory

RAG output is advisory only. Record evaluated retrievals with:

scripts/challenge_harness.py rag-record <workspace> --query "..." --tag MATCHED|PARTIAL|MISSING|<secret redacted>|GENERIC --validation "..."

Secrets/Flags

Raw flags and sensitive material stay in loot/ only. Use scripts/challenge_harness.py capture-flag to validate and record flag capture without printing the value.

Scenario

After defeating her first monster, Alex stood frozen, staring up at another massive, hulking creature that loomed over her. She knew that this was a fight she could not win on her own. She turned to her guildmates, trying to come up with a plan. "We need to distract it," Alex said. "If we can get it off balance, we might be able to take it down." Her guildmates nodded, their eyes narrowed in determination. They quickly came up with a plan to lure the monster away from their position, using a combination of noise and movement to distract it. As they put their plan into action, Alex drew her sword and waited for her chance.

Operator Question

Analyze the provided Blockchain challenge artifact and live target host, identify the smart contract or blockchain interaction required, exploit or solve it reproducibly, and capture the HTB flag.

Memory Summary

Metadata

• Platform: HackTheBox Challenges
• Category: Blockchain
• Challenge: Distract-and-Destroy
• Difficulty: Very Easy
• Source workspace: <local workspace>

Validated Solve Chain

Concepts only. Do not include raw flags, reusable credentials, tokens, cookies, private keys, or live secrets.

1.

Reusable Lessons

-

Dead Ends

-

Tool Quirks

-

Evidence Paths

-

Ingestion Decision

• Proposed for LightRAG: yes/no
• Requires user approval before ingestion: yes

Hypothesis Board

Keep no more than 3 active hypotheses on Easy/Medium and 5 on Hard unless the user explicitly asks for breadth.

Closed Branches

Memory Summary

approval_required: true

Sanitized Memory Summary

Metadata

• Platform: HackTheBox Challenges
• Category: Blockchain
• Challenge: Distract-and-Destroy
• Difficulty: Very Easy
• Source workspace: <local workspace>

Validated Solve Chain

Concepts only. Do not include raw flags, reusable credentials, tokens, cookies, private keys, or live secrets.

1.

Reusable Lessons

-

Dead Ends

-

Tool Quirks

-

Evidence Paths

-

Ingestion Decision

• Proposed for LightRAG: yes/no
• Requires user approval before ingestion: yes

Notes

Notes

Scope

• Challenge: Distract-and-Destroy
• Category: Blockchain
• Difficulty: Very Easy
• Mode: remote
• Remote instance: <TARGET>:31125
• Start time: 2026-06-07T08:49:07Z
• Operator: harness
• State file: challenge-state.json

Harness Status

• Current phase: see challenge-state.json
• Next allowed actions: see next-action.json
• Raw flags and sensitive material stay in loot/ only. Do not paste them here.

Artifact Inventory

Evidence Ledger

Key Findings

-

RAG / Advisory Memory

RAG output is advisory only. Record evaluated retrievals with:

scripts/challenge_harness.py rag-record <workspace> --query "..." --tag MATCHED|PARTIAL|MISSING|<secret redacted>|GENERIC --validation "..."

Secrets/Flags

Raw flags and sensitive material stay in loot/ only. Use scripts/challenge_harness.py capture-flag to validate and record flag capture without printing the value.

Scenario

After defeating her first monster, Alex stood frozen, staring up at another massive, hulking creature that loomed over her. She knew that this was a fight she could not win on her own. She turned to her guildmates, trying to come up with a plan. "We need to distract it," Alex said. "If we can get it off balance, we might be able to take it down." Her guildmates nodded, their eyes narrowed in determination. They quickly came up with a plan to lure the monster away from their position, using a combination of noise and movement to distract it. As they put their plan into action, Alex drew her sword and waited for her chance.

Operator Question

Analyze the provided Blockchain challenge artifact and live target host, identify the smart contract or blockchain interaction required, exploit or solve it reproducibly, and capture the HTB flag.