KHP Protocol

Technical Walkthrough

Writeup

Challenge

• Name: KHP-Protocol
• Category: Pwn
• Difficulty: Medium
• Mode: hybrid

Summary

KHP Protocol ships a non-stripped amd64 ELF service that manages username:role key; entries over a simple TCP protocol. The intended path was a protocol and heap-state bug, not shellcode or ROP. The final exploit uses REKE to create a fake admin profile, abuses an overflow from a reused key chunk to overwrite the loaded users.keys heap buffer, authenticates the fake admin, then triggers the built-in admin-only EXEC shell from a second client.

Artifact Inventory

• khp_server: non-stripped 64-bit PIE ELF TCP server.
• users.keys: local key database used by AUTH existence checks.
• Dockerfile: Ubuntu 22.04 runtime exposing port 1337.
• Remote: <TARGET>:31791.

Analysis

Static triage showed the protocol commands REKE, SAVE, AUTH, DEKE, DDKE, RLDB, GTPR, and admin-only EXEC. AUTH checks whether an in-memory key profile exists in the loaded database buffer; EXEC then trusts global authenticated role state and spawns /bin/sh.

The first hypothesis used the packaged admin entry directly. That worked locally but failed remotely because the live database did not contain the same exact admin profile. Public research was then used only as a lead, and the matching local disassembly confirmed the real primitive: REKE allocates a fixed-size heap chunk but formats attacker-controlled fields into it with sprintf, allowing overflow into the subsequently allocated database buffer.

The final solver keeps the exploit stable by using a safe padding SAVE record to make the next database load larger, DEKE -3 to free/null the loaded database buffer, then a controlled REKE overflow to inject a fake admin profile into the heap copy of users.keys. After AUTH succeeds, a second TCP client runs EXEC so the spawned shell is attached to the correct socket.

Solve

Reproducible solver:

python3 solve/solve.py --strategy heap --host <TARGET> --port 31791 --output analysis/flag-candidate.txt --transcript analysis/remote-solve-transcript.txt

The script uses only Python stdlib sockets. It writes raw flag material only to the requested output path for harness capture; transcripts redact the flag.

Flag

Raw flag is stored in loot/flag.txt and intentionally not reproduced here.

Lessons

• Validate direct packaged secrets locally, but do not assume remote challenge state uses the same database contents.
• For stateful threaded pwn services, global auth/session variables can create cross-client exploit paths.
• If failed heap attempts pollute the process, stop and let the instance restart instead of continuing blind probes.
• Keep remote attempts gated and low-noise; local Docker reproduction was enough to build the final exploit.

Source-Backed Dossier

The sections below are merged from companion Markdown notes for the same case. They are rendered after sanitization so the article stays precise without publishing raw flags, credentials, or target-specific secrets.

Notes

Scope

• Challenge: KHP-Protocol
• Category: Pwn
• Difficulty: Medium
• Mode: hybrid
• Remote instance: <TARGET>:31791
• Start time: 2026-06-12T12:56:37Z
• Operator: harness
• State file: challenge-state.json

Harness Status

• Current phase: see challenge-state.json
• Next allowed actions: see next-action.json
• Raw flags and sensitive material stay in loot/ only. Do not paste them here.

Artifact Inventory

Evidence Ledger

Key Findings

• khp_server is a non-stripped amd64 ELF with a custom KHP TCP protocol and built-in admin-only EXEC shell path.
• Direct packaged-admin authentication worked locally but failed remotely because the live users.keys content did not match the packaged admin profile.
• The working primitive is REKE heap overflow into the loaded users.keys heap buffer, validated locally in linux/amd64 Docker and remotely after the instance restarted cleanly.
• The final solver uses safe DB padding, DEKE -3 to reset KEYS_BUF, heap database injection of a fake admin profile, AUTH, then cross-client EXEC.
• Remote flag was captured through the harness and stored only in loot/flag.txt.

RAG / Advisory Memory

RAG output is advisory only. Record evaluated retrievals with:

scripts/challenge_harness.py rag-record <workspace> --query "..." --tag MATCHED|PARTIAL|MISSING|<secret redacted>|GENERIC --validation "..."

Secrets/Flags

Raw flags and sensitive material stay in loot/ only. Use scripts/challenge_harness.py capture-flag to validate and record flag capture without printing the value.

Memory Summary

Metadata

• Platform: HackTheBox Challenges
• Category: Pwn
• Challenge: KHP-Protocol
• Difficulty: Medium
• Source workspace: <local workspace>

Validated Solve Chain

Concepts only. Do not include raw flags, reusable credentials, tokens, cookies, private keys, or live secrets.

1. Triage the non-stripped TCP server binary and map KHP commands.
2. Identify that AUTH checks in-memory profiles against the loaded users.keys buffer and EXEC trusts global authenticated role state.
3. Validate direct packaged-admin auth locally, then close it for remote when the live database did not match.
4. Use REKE heap overflow to overwrite the loaded database buffer with a fake admin profile.
5. Authenticate the fake admin and trigger EXEC from a second client to attach the shell to the desired socket.
6. Read the remote flag through the shell and capture it with the harness.

Reusable Lessons

• For pwn services with local Docker assets, prove heap/protocol behavior locally before touching remote.
• A packaged local database may be useful for structure, but live remote content can differ.
• Stateful threaded services can have exploitable global auth/client socket state across connections.
• Failed heap attempts can pollute the process; stop, let the instance restart, then rerun the clean exploit.

Dead Ends

• Direct packaged-admin authentication: worked locally, failed remotely because the live DB did not contain the same profile.
• Repeating heap attempts on a polluted process: caused allocator instability; clean restart was needed.

Tool Quirks

• The Mac host lacked gdb, pwntools, and checksec; the final solver used Python stdlib sockets.
• Docker required --platform linux/amd64 to run the provided amd64 ELF on Apple Silicon.
• readelf was unavailable locally; static review used strings, nm, and objdump.

Evidence Paths

• analysis/research-direct-static-protocol-review.md
• analysis/research-public-khp-writeup.md
• analysis/local-solve-transcript.txt
• analysis/remote-solve-transcript.txt
• solve/solve.py
• loot/flag.txt

Ingestion Decision

• Proposed for LightRAG: yes
• Requires user approval before ingestion: yes

Hypothesis Board

Keep no more than 3 active hypotheses on Easy/Medium and 5 on Hard unless the user explicitly asks for breadth.

Closed Branches