SpookyPass

A 64-bit ELF that prompts for a password. The secret sits in cleartext among the binary's strings — strings reveals it with no debugging required.

Challenge overview

Attack map

[ELF pass] file → Linux binary
      │
      ▼
[strings] cleartext password
      │
      ▼
[./pass] enter password
      │
      ▼
[FLAG]

Binario ELF de 64 bits que pide una contraseña. La clave está en claro entre las cadenas del ejecutable: strings la revela sin necesidad de depurar nada.

Ficha del challenge

Mapa del ataque

[ELF pass] file → binario Linux
      │
      ▼
[strings] contraseña en claro
      │
      ▼
[./pass] introducir password
      │
      ▼
[FLAG]

1. Identify the file

Before touching anything, find out what we're dealing with: binary type, architecture and whether it's statically linked.

file pass

pass: ELF 64-bit LSB executable, x86-64

It's a Linux executable — this is basic reversing territory.

2. Check protections

checksec summarises the mitigations (Canary, NX, PIE). Here it's informative only — we won't exploit memory corruption, just read data.

checksec --file=pass

3. Extract strings (key step)

Many "Very Easy" challenges store the password as a literal string. strings dumps every readable chunk of text in the binary.

strings pass | less

Before we let you in, you'll need to give us the password:
s3cr3t_p455_f0r_gh05t5_4nd_gh0ul5

Right among the program's messages, the password appears in plain sight.

4. Run it and enter the password

chmod +x pass
./pass

Welcome to the SPOOKIEST party of the year.
Before we let you in, you'll need to give us the password: s3cr3t_p455_f0r_gh05t5_4nd_gh0ul5

5. Flag

HTB{un0bfu5c4t3d_5tr1ng5}

Chain summary

Lessons learned

• Never store secrets as literal strings in a binary — strings exposes them in seconds.
• Reversing starts with the cheap tools (file, strings, checksec) before opening a disassembler.
• The challenge name (unobfuscated strings) is usually the biggest hint.

1. Identificar el archivo

Antes de tocar nada conviene saber qué tenemos entre manos: tipo de binario, arquitectura y si está enlazado estáticamente.

file pass

pass: ELF 64-bit LSB executable, x86-64

Es un ejecutable de Linux: entramos en terreno de reversing básico.

2. Revisar protecciones

checksec resume las mitigaciones (Canary, NX, PIE). Aquí es informativo: no vamos a explotar corrupción de memoria, solo a leer datos.

checksec --file=pass

3. Extraer cadenas (paso clave)

Muchos challenges "Very Easy" guardan la contraseña como una cadena literal. strings vuelca todo el texto legible del binario.

strings pass | less

Before we let you in, you'll need to give us the password:
s3cr3t_p455_f0r_gh05t5_4nd_gh0ul5

Entre los mensajes del programa aparece directamente la contraseña.

4. Ejecutar e introducir la contraseña

chmod +x pass
./pass

Welcome to the SPOOKIEST party of the year.
Before we let you in, you'll need to give us the password: s3cr3t_p455_f0r_gh05t5_4nd_gh0ul5

5. Flag

HTB{un0bfu5c4t3d_5tr1ng5}

Resumen de la cadena

Lecciones aprendidas

• Nunca guardes secretos como cadenas literales en un binario: strings los expone en segundos.
• El reversing empieza por lo barato (file, strings, checksec) antes de abrir un desensamblador.
• El nombre del challenge (unobfuscated strings) suele ser la mayor pista.