Evil Copr

Technical Walkthrough

Writeup

Challenge

• Name: Evil-Copr
• Category: Pwn
• Difficulty: Medium
• Mode: hybrid

Summary

Evil-Copr is a wide-character pwn challenge built around two developer mistakes. The support form converts wide-character input into 16-bit output inside a fixed mapping, which can overflow into an adjacent fixed RWX page. A separate password read in Login overflows the stack. Chaining both bugs gives reliable control: first stage shellcode into the RWX page, then logout and return to it through the login overflow.

Artifact Inventory

• analysis/artifact-inventory.json records the provided ZIP and extracted binary.
• files/extracted/pwn_evil_corp/evil-corp is a 64-bit Linux PIE executable, dynamically linked and not stripped.
• analysis/source-audit.md contains the disassembly-backed exploit reasoning.

Analysis

Static analysis showed plain credentials in .rodata: eliot / 4007. Those credentials unlock the menu and allow access to ContactSupport.

Setup creates two fixed mappings:

• SupportMsg at 0x10000, writable.
• AssemblyTestPage at 0x11000, readable, writable, and executable.

ContactSupport reads up to 0x1000 wide characters and calls wcharToChar16, which stores each input wchar_t as a 16-bit word into SupportMsg. After 2048 input characters, the copy reaches 0x11000, so controlled 16-bit words become executable code.

Login allocates 0x150 stack bytes but reads the password with fgetws(..., 0x12c, stdin). The saved return address is reached at 86 wide characters from the password buffer. Sending codepoint U+11000 at that offset writes the low return-address dword as 0x00011000. EOF immediately after that codepoint makes fgetws append a NUL wchar_t, clearing the high dword.

RAG/local memory did not provide a challenge-specific hint. The decision to proceed was based on direct source evidence in analysis/source-audit.md.

Solve

The final solver is solve/solve.py.

The script:

1. Connects to the live service.
2. Logs in as eliot with password 4007.
3. Selects support contact.
4. Sends 2048 filler wide characters followed by UTF-8 codepoints whose low 16-bit values encode Linux x86-64 shellcode.
5. Logs out.
6. Starts a new login and sends 86 filler wide characters plus U+11000, then half-closes the socket to force EOF termination.
7. The shellcode opens /flag.txt, writes the result to stdout, and exits.

The successful output was saved to loot/flag-candidate.txt and captured through the harness into loot/flag.txt.

Flag

Raw flag is stored in loot/flag.txt and intentionally not reproduced here.

Lessons

• Wide-character input can be exploitable in two separate ways: through byte-width conversion bugs and through larger-than-expected stack writes.
• EOF termination is useful when a wide-character overflow needs to write a zero dword that cannot be supplied directly through normal line input.
• For pwn challenges, direct file-read shellcode is more reliable than spawning an interactive shell when the exploit must close stdin to shape memory.

Source-Backed Dossier

The sections below are merged from companion Markdown notes for the same case. They are rendered after sanitization so the article stays precise without publishing raw flags, credentials, or target-specific secrets.

Notes

Scope

• Challenge: Evil-Copr
• Category: Pwn
• Difficulty: Medium
• Mode: hybrid
• Remote instance: none
• Start time: 2026-06-12T16:10:56Z
• Operator: harness
• State file: challenge-state.json

Harness Status

• Current phase: see challenge-state.json
• Next allowed actions: see next-action.json
• Raw flags and sensitive material stay in loot/ only. Do not paste them here.

Artifact Inventory

Evidence Ledger

Key Findings

• Direct audit in analysis/source-audit.md identifies the active exploit path. Setup maps SupportMsg at fixed 0x10000 and AssemblyTestPage at fixed 0x11000 with RWX permissions.
• ContactSupport copies up to 0x1000 wide characters into SupportMsg as 16-bit words; after 2048 input characters, controlled bytes land in the executable page at 0x11000.
• Login reads up to 0x12c wide characters into a 0x150-byte stack frame. The saved return address is reached at 86 wide characters from the login-input buffer.
• Planned exploit chain: authenticate with recovered .rodata credentials, stage direct file-read shellcode through support-message overflow, logout, then EOF-terminate a login-input overflow so execution returns to 0x11000.

RAG / Advisory Memory

RAG output is advisory only. Record evaluated retrievals with:

scripts/challenge_harness.py rag-record <workspace> --query "..." --tag MATCHED|PARTIAL|MISSING|<secret redacted>|GENERIC --validation "..."

Secrets/Flags

Raw flags and sensitive material stay in loot/ only. Use scripts/challenge_harness.py capture-flag to validate and record flag capture without printing the value.

Memory Summary

Metadata

• Platform: HackTheBox Challenges
• Category: Pwn
• Challenge: Evil-Copr
• Difficulty: Medium
• Source workspace: <local workspace>

Validated Solve Chain

Concepts only. Do not include raw flags, reusable credentials, tokens, cookies, private keys, or live secrets.

1. Audit the ELF and recover the intended login path.
2. Use authenticated support-message functionality to exploit a wide-character conversion bug.
3. Convert controlled wide-character input into 16-bit instruction words that overflow from a fixed support buffer into an adjacent fixed RWX page.
4. Use a second wide-character stack overflow in the login password path to return to the staged executable page.
5. Prefer direct file-read shellcode over an interactive shell when the final overflow needs EOF termination to shape the return address.

Reusable Lessons

• In Linux fgetws targets, count arguments are in wide characters, not bytes. Compare them against the actual byte-sized stack frame.
• A wchar_t to 16-bit conversion can be a controlled encoder when the locale accepts UTF-8 codepoints.
• Fixed mmap regions with adjacent writable and executable permissions can turn a non-control-data overflow into a shellcode staging primitive.
• EOF after a final non-ASCII codepoint can make fgetws write a NUL terminator exactly where a zero dword is needed.

Dead Ends

• No independent challenge-specific RAG memory was found; RAG returned generic pwn guidance only.
• The disabled menu option for the assembly tester is not the trigger. The working trigger is the separate login return-address overwrite.

Tool Quirks

• Local Docker reproduction can fail if en_US.UTF-8 is unavailable, because non-ASCII codepoints may not decode through fgetws.
• The local tool readiness check showed common pwn tools missing, but objdump, Python, and direct socket interaction were sufficient for this solve.

Evidence Paths

• analysis/artifact-inventory.json
• analysis/source-audit.md
• analysis/instrumentation-plan.md
• analysis/evaluator-20260612T161920187702Z-9a5eaacd.md
• solve/solve.py
• loot/flag.txt

Ingestion Decision

• Proposed for LightRAG: yes
• Requires user approval before ingestion: yes

Hypothesis Board

Keep no more than 3 active hypotheses on Easy/Medium and 5 on Hard unless the user explicitly asks for breadth.

Closed Branches