Un-mad-ning The CubeMadness1 [HTB Writeup] - 27/03/2022
Hey Theređź‘‹
medium-to-markdown@0.0.3 convert node index.js https://medium.com/@birnadin/un-mad-ning-the-cubemadness1-htb-writeup-adde2aa0545c
Un-mad-ning The CubeMadness1 [HTB Writeup]
[
](https://medium.com/@birnadin?source=post_page-----adde2aa0545c--------------------------------)
·
5 min read·Mar 26, 2022
—
Listen
Share
Hey There👋, how y’all holding up? Without further ado, let’s get to business.
HTB(Hack The Box) has released a new challenge type called “GamePwn” recently with a challenge so far. And it is nonetheless, CubeMadness1. It is ranked as “very easy” but for a beginner it also is not(I guess 🤷‍♂️). So here’s my writeup on it.
What we need?
Software wise…
- The game(Downloaded it from HTB) : What we gonna pwn
- The Cheat Engine (CE from herewith): What we gonna pwn with
Disclaimer!
Before downloading Cheat Engine setup please turn off your Antivirus solution as it could flag CE as malware. I had to do this even when using the CE. You also need to be an Administrator to install the CE.
Install the CE and extract the zip file you obtained[password found below the hash of the file on the HTB challenge pane] and run the .exe with the HTB icon(the actual game)
Knowledge wise… (FEEL FREE TO SKIP IF YOU PREFER)
- Apart from other challenges, this one doesn’t actually requires any code-authoring. You can get away with few basic concepts. Even though knowledge on how executables work is preferrable. Let me get you the few necessary concepts first
Data storage
- All the information you see on the screen is either from the registers or RAM itself. Nothing is from HDD/SSD during real-time.
- RAM + HDD/SSD makes up a Virtual Memory managed by the OS. And a part of this memory is assigned to a process by the OS. This memory sector is then divided into HEAP and STACK for that particular process.
- Data that needs to be persist and managed manually by the process is stored on the HEAP and function-bound data on the STACK.
- Process(actually the developer) assumes that its HEAP and STACK can only be written/read by itself or its children. But the OS(Kernel) also actually can. This lets us do what we want in certain time and what we will do for the challenge.
How data is accessed
- A data in the RAM is accessed using a unique id(termed ADDRESS of that cell) by the CPU.
- Changing this will alter flow/behavior of the process. Same goes for altering a datum in a cell too, and that’s our key to the challenge.
How we gonna do this?
Launch the game(filename), I will assume that you already got yourself wrapped around this game, if not go ahead and give it a try.
Launch CE and attach the process to the CE
1. Click here to open process selector2. Attach the HackTheBox CubeMadness1.exe
Type 0 and scan.
Change the value to 0 and hit “New Scan” ensuring scan type is “Exact Value”
Here we are scanning the memory area assigned to the game and get the address of the cell with value recognized. I almost got about million, which is way too high to digest, so let’s filter it.
Press Spacebar to jump and grab a cube.
Now go to CE and change 0️ ➡️ 1 and change the scan type to ⚠️“Increased by”⚠️ and hit scan.
Now change the value to 1 and the scan type to ⚠️“Increased value by” the hit ⚠️“Next Scan”
Now go to the game and get 2 cubes
Then in CE change 1➡️ 2 and hit scan
We took 2 cubes at one to eliminate any false positives that may occur or any anti cheat tech developer employed.
Now you get the idea, now the results must have significantly dropped. Again get 1 cube and change the value to 1 and scan.
Then get 2 cubes and hit scan after changing the value to 2.
Now what you see in the results pane is far fewer that what we had. Select them and hit the red arrow(in down-right corner) of the pane.
Select the constant results and hit the arrow icon
Then in the bottom panel, you can select the values and hit enter to change the value in those addresses. You can explore changing to whatever but 20 will get the job done as the description of the Challenge states…
“Gotta collect them all.”
Flag Captured
- You should see the flag on the game screen somewhere. If not, then try starting with 1 instead of 0 from the beginning and follow the same idea.
Enjoy the day 🤗.
What Else?
Here are some resources you may find useful…
[
Cheat Engine
Register/log in to start contributing to this wiki. You can post any modding related information on this wiki related…
wiki.cheatengine.org
Issues · cheat-engine/cheat-engine
New issue Have a question about this project? Sign up for a free GitHub account to open an issue and contact its…
github.com
Cheat Engine
Trouble running Cheat Engine? Check out the known github issue here on how to solve it Read before download: Cheat…
](https://www.cheatengine.org/?source=post_page-----adde2aa0545c--------------------------------)[
Cheat Engine :: Index
Cheat Engine The Official Site of Cheat Engine Forum Topics Posts Last Post Cheat Engine Anything Cheat Engine related…
forum.cheatengine.org
](http://forum.cheatengine.org/?source=post_page-----adde2aa0545c--------------------------------)[
Differences between Stack and Heap
Stack and a Heap ? Stack is used for static memory allocation and Heap for dynamic memory allocation, both stored in…
net-informations.com
Adieuđź‘‹
That’s it for this writeup, if you encounter anything or have doubt or such write to be via Instagram(@birnadin.e or via mail or the comments. I would love to hear it from you. Till then this is BE signing-off🛑.