You Know 0xDiablos

Technical Walkthrough

Writeup

Challenge

• Name: You-know-0xDiablos
• Category: Pwn
• Difficulty: Easy
• Mode: hybrid

Summary

The challenge is a classic 32-bit ret2win. The binary exposes a flag() function but never calls it through the normal path. The vulnerable function uses gets() into a stack buffer, allowing the saved return address to be overwritten. Returning into flag() with the two required cdecl arguments makes the remote service print the flag.

Artifact Inventory

• files/a12c73af-45ce-498f-9aa6-1dde6ccb7cc7.zip: original AES-encrypted challenge archive.
• analysis/extracted/vuln: extracted 32-bit i386 ELF.
• analysis/nm.txt: symbol listing showing flag, vuln, and main.
• analysis/function-disassembly.txt: focused disassembly used for the exploit.
• Remote endpoint: <TARGET>:30838.

Analysis

analysis/extracted-file-types.txt identifies the extracted artifact as a 32-bit Intel ELF. The symbol listing in analysis/nm.txt shows flag at 0x080491e2 and vuln at 0x08049272.

The focused disassembly in analysis/function-disassembly.txt shows vuln() using gets() on a stack buffer loaded from [ebp-0xb8]. The saved return address sits at [ebp+4], so the offset from the buffer start to saved EIP is:

0xb8 bytes to saved EBP + 4 bytes saved EBP = 188 bytes

The same disassembly shows flag() opening flag.txt, reading it, and printing it only after checking:

arg1 == 0xdeadbeef
arg2 == 0xc0ded00d

Because this is 32-bit cdecl, the payload places a dummy return address after the flag() address, followed by those two arguments.

Solve

Run:

cd <local workspace>
python3 solve/solve.py --host <TARGET> --port 30838

The script builds:

"A" * 188 + p32(0x080491e2) + "BBBB" + p32(0xdeadbeef) + p32(0xc0ded00d)

It sends the payload to the remote service, stores the raw service transcript under loot/, and writes the extracted HTB-format flag candidate to loot/flag-candidate.txt without printing the flag by default.

Flag

Raw flag is stored in loot/flag.txt and intentionally not reproduced here.

Lessons

For Easy Pwn ret2win binaries, symbol tables and focused function disassembly can be enough: identify the win function, determine the calling convention and arguments, calculate the overwrite offset from the stack frame, then run a single bounded remote attempt.

Source-Backed Dossier

The sections below are merged from companion Markdown notes for the same case. They are rendered after sanitization so the article stays precise without publishing raw flags, credentials, or target-specific secrets.

Notes

Scope

• Challenge: You-know-0xDiablos
• Category: Pwn
• Difficulty: Easy
• Mode: hybrid
• Remote instance: <TARGET>:30838
• Start time: 2026-06-10T13:33:36Z
• Operator: harness
• State file: challenge-state.json

Harness Status

• Current phase: see challenge-state.json
• Next allowed actions: see next-action.json
• Raw flags and sensitive material stay in loot/ only. Do not paste them here.

Artifact Inventory

Evidence Ledger

Key Findings

• The extracted vuln artifact is a 32-bit i386 ELF, dynamically linked and not stripped.
• Symbols expose flag, vuln, and main; flag is at 0x080491e2.
• vuln() calls gets() with a stack buffer at ebp-0xb8; the saved return address is reached after 188 bytes.
• flag() opens flag.txt and prints it only if its first two cdecl arguments are 0xdeadbeef and 0xc0ded00d.
• The exploit payload is 188 bytes padding || flag address || dummy return || 0xdeadbeef || 0xc0ded00d.
• Raw remote output and raw flag are kept under loot/ only.

RAG / Advisory Memory

RAG output is advisory only. Record evaluated retrievals with:

scripts/challenge_harness.py rag-record <workspace> --query "..." --tag MATCHED|PARTIAL|MISSING|<secret redacted>|GENERIC --validation "..."

Secrets/Flags

Raw flags and sensitive material stay in loot/ only. Use scripts/challenge_harness.py capture-flag to validate and record flag capture without printing the value.

Memory Summary

You-know-0xDiablos was an Easy Pwn ret2win challenge.

The useful path was:

1. Extract the AES-encrypted ZIP with the standard HTB password.
2. Identify vuln as a 32-bit i386 ELF, dynamically linked and not stripped.
3. Use nm/disassembly to find flag at 0x080491e2, vuln, and main.
4. In vuln(), observe gets() writes to a buffer at ebp-0xb8.
5. Calculate saved EIP offset as 0xb8 + 4 = 188.
6. In flag(), observe the checks for 0xdeadbeef and 0xc0ded00d before printing flag.txt.
7. Send a 32-bit cdecl ret2win payload:

padding(188) || flag_addr || dummy_ret || 0xdeadbeef || 0xc0ded00d.

1. Capture the remote HTB-format flag and keep raw output under loot/.

Reusable lesson: for non-stripped 32-bit ret2win challenges, avoid unnecessary fuzzing. Symbols plus stack-frame disassembly give the win function address, offset, and required cdecl argument layout.

Hypothesis Board

Keep no more than 3 active hypotheses on Easy/Medium and 5 on Hard unless the user explicitly asks for breadth.

Closed Branches

Notes

Notes

Scope

• Challenge: You-know-0xDiablos
• Category: Pwn
• Difficulty: Easy
• Mode: hybrid
• Remote instance: <TARGET>:30838
• Start time: 2026-06-10T13:33:36Z
• Operator: harness
• State file: challenge-state.json

Harness Status

• Current phase: see challenge-state.json
• Next allowed actions: see next-action.json
• Raw flags and sensitive material stay in loot/ only. Do not paste them here.

Artifact Inventory

Evidence Ledger

Key Findings

• The extracted vuln artifact is a 32-bit i386 ELF, dynamically linked and not stripped.
• Symbols expose flag, vuln, and main; flag is at 0x080491e2.
• vuln() calls gets() with a stack buffer at ebp-0xb8; the saved return address is reached after 188 bytes.
• flag() opens flag.txt and prints it only if its first two cdecl arguments are 0xdeadbeef and 0xc0ded00d.
• The exploit payload is 188 bytes padding || flag address || dummy return || 0xdeadbeef || 0xc0ded00d.
• Raw remote output and raw flag are kept under loot/ only.

RAG / Advisory Memory

RAG output is advisory only. Record evaluated retrievals with:

scripts/challenge_harness.py rag-record <workspace> --query "..." --tag MATCHED|PARTIAL|MISSING|<secret redacted>|GENERIC --validation "..."

Secrets/Flags

Raw flags and sensitive material stay in loot/ only. Use scripts/challenge_harness.py capture-flag to validate and record flag capture without printing the value.