CubeMadness1 — HackTheBox

Description

"Gotta collect them all." - A Unity game challenge where you need to find the hidden flag.

Files:

• challenge.zip (password: hackthebox) containing:
  • HackTheBox CubeMadness1.exe (Windows executable)
  • GameAssembly.dll (IL2CPP compiled game logic)
  • UnityPlayer.dll
  • HackTheBox CubeMadness1_Data/ (game assets folder)

Analysis

Technology Identification

Unpacking the archive revealed a typical Unity game structure compiled with IL2CPP:

unzip -P hackthebox challenge.zip
file gamepwn_cubemadness1/*
# PE32+ executables and Unity data directory

Key IL2CPP indicators:

• GameAssembly.dll — compiled game logic
• global-metadata.dat — IL2CPP metadata
• No Assembly-CSharp.dll (which would be present with Mono)

Unity Asset Structure

Unity stores resources in files:

• sharedassets0.assets — main assets (textures, models, sounds)
• sharedassets0.assets.resS — binary resource data
• level* — level data

Solution

Extracting Textures with UnityPy

UnityPy is a Python library for working with Unity assets:

#!/usr/bin/env python3
"""
Unity Asset Extractor for CTF
Extracts textures from Unity games
"""
import UnityPy
import os

# Load the game data folder
env = UnityPy.load("gamepwn_cubemadness1/HackTheBox CubeMadness1_Data")
os.makedirs("extracted", exist_ok=True)

counter = 0
for obj in env.objects:
    if obj.type.name == "Texture2D":
        data = obj.read()
        counter += 1
        name = getattr(data, 'm_Name', f'texture_{counter}')
        if not name:
            name = f'texture_{counter}'
        try:
            img = data.image
            img.save(f"extracted/{name}.png")
            print(f"Saved: {name}.png ({img.size})")
        except Exception as e:
            print(f"Error with {name}: {e}")

print(f"\nTotal textures extracted: {counter}")

Extraction Results

The script extracted 112 textures, including:

• UI elements (buttons, backgrounds)
• Game textures (cubes, capsules)
• Splash screen — splash.png

Flag Discovery

The file splash.png (1280x720 pixels) — the game's splash screen — contained the flag as green text on a black background:

HTB{REDACTED}

This is leetspeak for "CUBE MADNESS UNMADDENED" — a wordplay on the challenge name.

Alternative Approaches

AssetStudio (GUI)

On Windows you can use AssetStudio — a GUI tool:

1. Open the *_Data folder
2. Asset List → Filter by Type → Texture2D
3. Export Selected

strings + grep

Quick check for the flag in binaries:

strings -a GameAssembly.dll | grep -i "HTB{"
strings -a sharedassets0.assets | grep -i "HTB{"

Tools

Tool	Purpose
UnityPy	Python library for extracting Unity assets
AssetStudio	GUI tool for Windows
Il2CppDumper	Recovering C# structures from IL2CPP
Ghidra + Il2CppInspector	Reversing IL2CPP code

Lessons

1. Splash screens are a common place for flags in game CTFs
2. Unity assets are easily extracted with standard tools
3. Challenge name is often related to the flag (CubeMadness → REDACTED)
4. IL2CPP complicates code reversing but does not protect assets

References

• UnityPy — Python Unity asset extractor
• AssetStudio — GUI asset viewer
• Il2CppDumper — IL2CPP metadata extractor