HTB Writeup - LootStash

A giant stash of powerful weapons and gear have been dropped into the arena - but there’s one item you have in mind. Can you filter through the stack to get to the one thing you really need?

This is the description we are provided with when starting the challenge. The challenge belongs to the Reversing category and the Very easy difficulty.

We are also given a zip file containing a single executable: stash

Upon running the executable we get the following output:

Diving into the stash - let's see what we can find.
.....
You got: 'Penance, Skull of Dark Souls'. Now run, before anyone tries to steal it!

Hmm… Interesting. Let’s run it again.

Diving into the stash - let's see what we can find.
.....
You got: 'Limbo, Trinket of the Champion'. Now run, before anyone tries to steal it!

Again?

Diving into the stash - let's see what we can find.
.....
You got: 'Midnight, Crystal of the Wolf'. Now run, before anyone tries to steal it!

Ok. So it looks like every time the program runs a random object is prompted. My first thought here was: Are all these item descriptions hardcoded together with the item names or do they also get randomly selected?

To figure this out and maybe get some more information I decided to run strings on the executable. And this are some of the strings I got:

Nimble, Tribute of Corruption
Deluge, Insignia of the Sky
Daydream, Wit of Ashes
Mystery, Instrument of the Lone Victor
Brilliance, Idol of the Forgotten
Dawne, Reach of Wasted Time
Blightspore, Harp of Shadow Strikes
Reflection, Heirloom of Secrecy
Nymph, Visage of the Crown
Phantomsong, Incarnation of the Wind
Harmony, Allegiance of Souls
Barrage, Globe of Truth
Doombinder, Dawn of Hate
Flameguard, Bond of Ending Misery
Featherfall, Hope of the Daywalker
Riddle, Lantern of the Daywalker
Souleater, Pledge of Immortality
Benediction, Idol of Due Diligence
Ebony, Ravager of the West
Scarlet, Beads of the Harvest
Dawnlight, Fetish of Chaos
Crescent, Globule of Decay
Spark, Token of the Daywalker
Stardust, Legacy of the Flame
Phantom, Bead of the Incoming Storm
Quicksilver, Seal of Nightmares
HTB{n33dl3_1n_a_l00t_stack}
Glimmer, Prophecy of Magic
Chaos, Sphere of the Sky
Torchlight, Tribute of the Phoenix
Dementia, Ravager of the Dead

Yeah, it looks like the descriptions are hardcod- Oh. There is the flag.

Lesson of the day: never forget to run strings on your executables, kids!

To whoever is reading this, thank you, stay safe, and more importantly, stay invisible.