Rev on Zero's Blog

HTB - Reversing: Maze

Thu, 05 Mar 2026 16:10:00 +0700

Challenge Summary

Name: Maze
Category: Reversing
Difficulty: Medium
Solved by: Shinkiro
Goal: Recover the final valid input from multi-stage checker logic.

Root Cause

maze.exe is a PyInstaller-packed Python application that gates progress behind hidden constants and staged payloads.

Reversing the Python entrypoint reveals:

route gate string: Y0u_St1ll_1N_4_M4z3
ZIP password for enc_maze.zip: Y0u_Ar3_W4lkiNG_t0_Y0uR_D34TH

After unpacking, deeper stages eventually resolve to an ELF checker whose validation is purely arithmetic and reversible.

HTB - Reversing: Hexecution

Thu, 05 Mar 2026 15:58:00 +0700

Challenge Summary

Name: Hexecution
Category: Reversing
Difficulty: Hard
Solved by: Shinkiro
Goal: Recover the expected input for the custom VM program and derive the final flag.

Root Cause

The binary cook is a small interpreter for the DSL file recipe.asm. Instead of checking input directly, it transforms user input via a deterministic two-stage permutation pipeline and compares against a fixed 32-byte target table loaded by VM instructions.

HTB - Reversing: vvm

Thu, 05 Mar 2026 15:35:00 +0700

Challenge Summary

Name: vvm
Category: Reversing
Difficulty: Hard
Solved by: Shinkiro
Goal: Recover the password accepted by the embedded custom VM.

Root Cause

The binary does not compare the input directly. Instead, it runs a custom VM program that:

enforces input length = 32,
rearranges selected bytes into 8 little-endian 32-bit words,
applies rol32 transforms,
compares against hardcoded constants.

So the intended path is reverse-engineering VM semantics, then algebraically inverting the transformations.

EH4X CTF 2026: Writeup

Wed, 04 Mar 2026 14:00:00 +0700

Overview

This post collects the solved EH4X CTF 2026 challenges and the practical exploitation approach used for each.

Heist V1 (Blockchain)

TL;DR

The vault trusted governance too much. By setting governance to an attacker contract and abusing delegatecall execution, storage got overwritten (admin/paused), then funds could be withdrawn.

HTB - Reversing: Wayback

Wed, 04 Mar 2026 10:55:00 +0700

Challenge Summary

Name: Wayback
Category: Reversing
Difficulty: Medium
Solved by: Shinkiro
Goal: Recover generated password and decrypt ciphertext to obtain flag.

Root Cause

The binary generates a password using rand() seeded from local timestamp fields (year/month/day/hour/min/sec formula), then uses that key material in AES-CBC flow.

Given challenge-provided generation window, key recovery becomes bounded brute-force over time.

Exploit Strategy

Reverse password generator logic:
- static charset (lower/upper/symbols/digits)
- seed formula from datetime fields
- rand() % len(charset) per output char
Re-implement generator exactly with libc srand/rand behavior.
Iterate each second in the narrowed date range.
Build candidate key from generated password and attempt AES-CBC decrypt.
Stop when plaintext contains HTB{...}.

Recovered:

HTB - Reversing: Virtually Mad

Wed, 04 Mar 2026 10:50:00 +0700

Challenge Summary

Name: Virtually Mad
Category: Reversing
Difficulty: Medium
Solved by: Shinkiro
Goal: Provide VM bytecode that passes strict opcode-shape and final-state validation.

Root Cause

The checker executes user-provided opcodes in a small custom VM and validates final state exactly:

a == 0x200
b == 0xffffffff
c == 0xffffffff
d == 0
flags == 0x10000000
instruction count = 5

The opcode format and pre-check masks make the intended sequence effectively unique.

HTB - Reversing: Rega Town

Wed, 04 Mar 2026 10:45:00 +0700

Challenge Summary

Name: Rega Town
Category: Reversing
Difficulty: Easy-Medium
Solved by: Shinkiro
Goal: Recover the valid passphrase accepted by the binary.

Root Cause

Validation is split into two deterministic layers:

filter_input enforces format and character-class constraints via embedded regex patterns.
check_input multiplies ASCII values of fixed chunks and compares them to hardcoded constants.

Given both layers, the space collapses to a tiny set of candidates.

Exploit Strategy

Extract regex constraints from filter_input to build per-position candidate pools.
Extract target products from check_input for each underscore-separated chunk.
Brute-force each chunk independently using product matching.
Apply final main assertions (input[5] == '0', input[9] == 'r').
Select intended semantic candidate.

Solver Code

#!/usr/bin/env python3
import itertools
import math
import pathlib
import string
import subprocess

# Product constants used by check_input() for each chunk.
TARGETS = [
    0x7A070,
    0x5C436,
    0x6CC60,
    0x27B5776,
    0x10F9,
    0xD76A0,
    0x7465A58,
]

# Character pools inferred from regex constraints in filter_input().
POOLS = [
    ["XYZ", string.digits, string.ascii_letters + string.digits],
    ["A", string.ascii_letters + "_", string.digits],
    ["T", "h7", string.digits],
    [string.ascii_uppercase, string.digits, "n", "abcdefgh"],
    ["O", string.digits],
    ["T", string.ascii_letters, "e"],
    ["T", "nopqrstuvwx", "nopqrstuvwx", "nc|"],
]


def ascii_product(s: str) -> int:
    return math.prod(ord(c) for c in s)


def solve_chunk(charsets, target):
    out = []
    for tup in itertools.product(*charsets):
        s = "".join(tup)
        if ascii_product(s) == target:
            out.append(s)
    return out


def maybe_check_binary(flag: str) -> bool | None:
    bin_path = pathlib.Path(__file__).with_name("rega_town")
    if not bin_path.exists():
        return None
    p = subprocess.run(
        [str(bin_path)],
        input=flag + "\n",
        text=True,
        capture_output=True,
        check=False,
    )
    return "Correct one of us!!" in p.stdout


def main():
    chunk_candidates = [solve_chunk(cs, t) for cs, t in zip(POOLS, TARGETS)]

    print("[+] Chunk candidates:")
    for i, cands in enumerate(chunk_candidates, 1):
        print(f"  chunk{i}: {cands}")

    all_flags = []
    for parts in itertools.product(*chunk_candidates):
        flag = f"HTB{{{parts[0]}_{parts[1]}_{parts[2]}_{parts[3]}_{parts[4]}_{parts[5]}_{parts[6]}}}"

        if flag[5] != "0":
            continue
        if flag[9] != "r":
            continue

        all_flags.append(flag)

    print("\n[+] Valid candidates after assertions:")
    for f in all_flags:
        status = maybe_check_binary(f)
        if status is None:
            print(f"  {f}")
        else:
            print(f"  {f}  (binary check: {status})")

    intended = next((f for f in all_flags if f.endswith("Town}")), all_flags[0])
    print("\n[+] Intended flag:")
    print(f"  {intended}")


if __name__ == "__main__":
    main()

Flag

HTB{Y0u_Ar3_Th3_K1ng_O7_The_Town}

0x1 - Learn CTF: Reverse Engineering

Mon, 23 Feb 2026 15:30:00 +0700

re-010 — Network byte-transform checker

Summary

Type: Reversing (ELF64, stripped, PIE)
Behavior: TCP server flag checker
Port: 31338
Expected input length: 37 bytes
Result: :) on success, :( on failure
Flag: CBC{c72b6b1feb2dbb3132380e1a9f967441}

Notes

The binary does not read from stdin directly; it binds/listens and validates client input over a socket.
Validation is split into 3 blocks of 16 transformed-byte checks using constant tables in .rodata.
Recovered plaintext chunks:
- CBC{c72b6b1feb2d
- bb3132380e1a9f96
- 7441}
Combined final flag:

CBC{c72b6b1feb2dbb3132380e1a9f967441}

Validation

# run service
./chall

# in another shell
python3 - << 'PY'
import socket
flag='CBC{c72b6b1feb2dbb3132380e1a9f967441}'
s=socket.create_connection(('127.0.0.1',31338))
print(s.recv(200))
s.sendall(flag.encode()+b'\n')
print(s.recv(200))
PY

Expected response contains :).

Rev on Zero's Blog

HTB - Reversing: Maze

Challenge Summary

Root Cause

HTB - Reversing: Hexecution

Challenge Summary

Root Cause

HTB - Reversing: vvm

Challenge Summary

Root Cause

EH4X CTF 2026: Writeup

Overview

Table of Contents

Heist V1 (Blockchain)

TL;DR

HTB - Reversing: Wayback

Challenge Summary

Root Cause

Exploit Strategy

HTB - Reversing: Virtually Mad

Challenge Summary

Root Cause

HTB - Reversing: Rega Town

Challenge Summary

Root Cause

Exploit Strategy

Solver Code

Flag

0x1 - Learn CTF: Reverse Engineering

Table of Contents

re-010 — Network byte-transform checker

Summary

Notes

Validation