ShinyHunter

Technical Walkthrough

Writeup

Challenge

• Name: ShinyHunter
• Category: Misc
• Difficulty: Easy
• Mode: hybrid

Summary

The challenge is a Python game service where a shiny starter unlocks the flag. The service prints a random device MAC address before asking for input. Source review showed the shiny outcome is deterministic from that MAC address and the integer elapsed boot second when the player name is submitted. The solve reconnects until a MAC has a near-term shiny second, waits for that second, submits the name and predicted starter choice, and captures the reward.

Artifact Inventory

• files/a12c7342-e7bf-44f3-9315-d4c039f10769.zip: original challenge archive.
• files/extracted/challenge/chall.py: Python service source.
• files/extracted/Dockerfile: service runs chall.py through socat.
• analysis/artifact-inventory.json: archive hash and extracted file listing.
• loot/remote-transcript.txt: successful remote interaction transcript, kept in loot/ because it contains the raw flag.

Analysis

chall.py generates and prints a device MAC immediately. Later, after the intro dialog and player-name input, it computes an integer elapsed time from time.time() - boot_time. The initial seed is:

int(elapsed_time) + int(device_mac_without_colons, 16)

That value is passed through the service LCG. Python random then generates the trainer IDs and each starter's PID. The shiny condition is:

((tid ^ sid) ^ (pid & 0xffff) ^ (pid >> 16)) < 8

Since the MAC is printed and the elapsed second can be controlled by delaying input, the solve can predict which future second and starter choice will produce a shiny. A first live attempt confirmed the RNG formula but showed the timing base was about two seconds early, so the final solver uses a calibrated send offset.

Solve

Run:

cd <local workspace>
python3 -u Misc/ShinyHunter/solve/solve.py --host <TARGET> --port 32211 --send-offset 2.35
python3 scripts/challenge_harness.py capture-flag Misc/ShinyHunter --from loot/flag-candidate.txt

The solver parses the MAC banner, screens future elapsed seconds for a shiny starter, reconnects on bad MACs, waits for a predicted second, submits a normal player name and starter choice, and writes the captured flag candidate under loot/.

Flag

Raw flag is stored in loot/flag.txt and intentionally not reproduced here.

Lessons

For timing-based RNG services, the visible seed material is only half the problem. The client-side timing base must be calibrated against the service clock. Here, transcript comparison against the predicted stats showed the first input was two seconds early, and a calibrated send offset made the exploit reliable.

Source-Backed Dossier

The sections below are merged from companion Markdown notes for the same case. They are rendered after sanitization so the article stays precise without publishing raw flags, credentials, or target-specific secrets.

Notes

Scope

• Challenge: ShinyHunter
• Category: Misc
• Difficulty: Easy
• Mode: hybrid
• Remote instance: <TARGET>:32211
• Start time: 2026-06-09T08:41:13Z
• Operator: harness
• State file: challenge-state.json

Harness Status

• Current phase: see challenge-state.json
• Next allowed actions: see next-action.json
• Raw flags and sensitive material stay in loot/ only. Do not paste them here.

Artifact Inventory

Evidence Ledger

Key Findings

-

RAG / Advisory Memory

RAG output is advisory only. Record evaluated retrievals with:

scripts/challenge_harness.py rag-record <workspace> --query "..." --tag MATCHED|PARTIAL|MISSING|<secret redacted>|GENERIC --validation "..."

Secrets/Flags

Raw flags and sensitive material stay in loot/ only. Use scripts/challenge_harness.py capture-flag to validate and record flag capture without printing the value.

Memory Summary

Metadata

• Platform: HackTheBox Challenges
• Category: Misc
• Challenge: ShinyHunter
• Difficulty: Easy
• Source workspace: <local workspace>

Validated Solve Chain

Concepts only. Do not include raw flags, reusable credentials, tokens, cookies, private keys, or live secrets.

1.

Reusable Lessons

-

Dead Ends

-

Tool Quirks

-

Evidence Paths

-

Ingestion Decision

• Proposed for LightRAG: yes/no
• Requires user approval before ingestion: yes

Hypothesis Board

Keep no more than 3 active hypotheses on Easy/Medium and 5 on Hard unless the user explicitly asks for breadth.

Closed Branches

Memory Summary

approval_required: true

Sanitized Memory Summary

Metadata

• Platform: HackTheBox Challenges
• Category: Misc
• Challenge: ShinyHunter
• Difficulty: Easy
• Source workspace: <local workspace>

Validated Solve Chain

Concepts only. Do not include raw flags, reusable credentials, tokens, cookies, private keys, or live secrets.

1.

Reusable Lessons

-

Dead Ends

-

Tool Quirks

-

Evidence Paths

-

Ingestion Decision

• Proposed for LightRAG: yes/no
• Requires user approval before ingestion: yes

Notes

Notes

Scope

• Challenge: ShinyHunter
• Category: Misc
• Difficulty: Easy
• Mode: hybrid
• Remote instance: <TARGET>:32211
• Start time: 2026-06-09T08:41:13Z
• Operator: harness
• State file: challenge-state.json

Harness Status

• Current phase: see challenge-state.json
• Next allowed actions: see next-action.json
• Raw flags and sensitive material stay in loot/ only. Do not paste them here.

Artifact Inventory

Evidence Ledger

Key Findings

-

RAG / Advisory Memory

RAG output is advisory only. Record evaluated retrievals with:

scripts/challenge_harness.py rag-record <workspace> --query "..." --tag MATCHED|PARTIAL|MISSING|<secret redacted>|GENERIC --validation "..."

Secrets/Flags

Raw flags and sensitive material stay in loot/ only. Use scripts/challenge_harness.py capture-flag to validate and record flag capture without printing the value.