Scanner

Technical Walkthrough

Writeup

Challenge

• Name: Scanner
• Category: Pwn
• Difficulty: Medium
• Mode: hybrid

Summary

scanner implements three memory-search backends. The optimized naive2 path does not bound the candidate start position by buffer_len - needle_len, so a long needle turns the scanner into an out-of-bounds stack read oracle. A separate %16s read into a 16-byte stack buffer gives a one-byte frame-pointer poison. Chaining those bugs gives a leak and then a ret2libc shell.

Artifact Inventory

• files/extracted/pwn_scanner/scanner: PIE ELF, not stripped, interpreter ./ld-2.31.so.
• files/extracted/pwn_scanner/libc.so.6: bundled glibc used for libc offsets.
• files/extracted/pwn_scanner/ld-2.31.so: bundled loader.
• Remote service: <TARGET>:32084.

Analysis

• read_parameters uses scanf("%16s %u", ...) into a 16-byte local name buffer. A 16-byte invalid scanner token writes the trailing NUL into the saved frame pointer byte.
• naive2 calls memcmp(buffer + i, needle, needle_len) while iterating i <= 0xfff, regardless of needle_len.
• A deterministic newline-free buffer suffix plus fixed needle length turns Found at i=N into a byte oracle for stack bytes above the buffer.
• The first remote version leaked too slowly one guess at a time. The final solver pipelines all 256 guesses for each unknown byte and parses the one response that returns the expected index.
• The final exploit leaks only the active heap pointer and a libc return pointer. It then writes fake post-poison locals for every viable aligned frame-pointer delta and uses a libc-only ret sled, avoiding a PIE leak and exact delta calculation.

Solve

Run:

python3 solve/solve.py --host <TARGET> --port 32084 --output loot/flag.txt

The harness run used scripts/challenge_exec.py so the exploit gate was checked first. The script stores the flag in loot/flag.txt.

Flag

Raw flag is stored in loot/flag.txt and intentionally not reproduced here.

Lessons

• For high-latency remotes, equality oracles need batching. The first working byte oracle was correct but impractically slow over the network.
• If an exact stack-pivot offset is expensive to recover, placing fake locals for all aligned deltas and using a ret sled can remove the dependency.
• RAG and public search were non-contributory here; direct binary audit and local validation were the deciding evidence.

Source-Backed Dossier

The sections below are merged from companion Markdown notes for the same case. They are rendered after sanitization so the article stays precise without publishing raw flags, credentials, or target-specific secrets.

Notes

Scope

• Challenge: Scanner
• Category: Pwn
• Difficulty: Medium
• Mode: hybrid
• Remote instance: none
• Start time: 2026-06-12T22:07:15Z
• Operator: harness
• State file: challenge-state.json

Harness Status

• Current phase: see challenge-state.json
• Next allowed actions: see next-action.json
• Raw flags and sensitive material stay in loot/ only. Do not paste them here.

Artifact Inventory

Evidence Ledger

Key Findings

• Direct binary audit identified two cooperating vulnerabilities: naive2 performs an out-of-bounds stack read when the search length reaches past the 4096-byte stack buffer, and read_parameters uses %16s into a 16-byte stack buffer, allowing a one-byte frame-pointer poison.
• The OOB scanner behavior was converted into a byte oracle by using a fixed search length and a deterministic newline-free buffer suffix.
• Local validation first recovered heap, PIE, libc, and stack-delta values from the stack oracle, then used the frame-pointer poison to overlap the next fgets return address and execute a single-stage ret2libc chain.
• The final remote exploit was optimized to avoid PIE and exact-delta leakage: it leaks only the heap pointer and a libc return pointer, prepares fake locals for all viable poisoned frame-pointer deltas, and uses a libc-only ret sled into system("/bin/sh").
• solve/solve.py implements the optimized path and writes the remote flag to loot/flag.txt without printing it.

RAG / Advisory Memory

RAG output is advisory only. Record evaluated retrievals with:

scripts/challenge_harness.py rag-record <workspace> --query "..." --tag MATCHED|PARTIAL|MISSING|<secret redacted>|GENERIC --validation "..."

Secrets/Flags

Raw flags and sensitive material stay in loot/ only. Use scripts/challenge_harness.py capture-flag to validate and record flag capture without printing the value.

Memory Summary

Metadata

• Platform: HackTheBox Challenges
• Category: Pwn
• Challenge: Scanner
• Difficulty: Medium
• Source workspace: <local workspace>

Validated Solve Chain

Concepts only. Do not include raw flags, reusable credentials, tokens, cookies, private keys, or live secrets.

1.

Reusable Lessons

-

Dead Ends

-

Tool Quirks

-

Evidence Paths

-

Ingestion Decision

• Proposed for LightRAG: yes/no
• Requires user approval before ingestion: yes

Hypothesis Board

Keep no more than 3 active hypotheses on Easy/Medium and 5 on Hard unless the user explicitly asks for breadth.

Closed Branches