CubeMadness1 — HackTheBox

Description

"Gotta collect them all." - A Unity game challenge where you need to find the hidden flag.

Files:

• challenge.zip (password: hackthebox) containing:
  • HackTheBox CubeMadness1.exe (Windows executable)
  • GameAssembly.dll (IL2CPP compiled game logic)
  • UnityPlayer.dll
  • HackTheBox CubeMadness1_Data/ (game assets folder)

Analysis

Technology Identification

Unpacking the archive revealed a typical Unity game structure compiled with IL2CPP:

unzip -P hackthebox challenge.zip
file gamepwn_cubemadness1/*
# PE32+ executables and Unity data directory

Key IL2CPP indicators:

• GameAssembly.dll — compiled game logic
• global-metadata.dat — IL2CPP metadata
• No Assembly-CSharp.dll (which would be present with Mono)

Unity Asset Structure

Unity stores resources in files:

• sharedassets0.assets — main assets (textures, models, sounds)
• sharedassets0.assets.resS — binary resource data
• level* — level data

Solution

Extracting Textures with UnityPy

UnityPy is a Python library for working with Unity assets:

#!/usr/bin/env python3
"""
Unity Asset Extractor for CTF
Extracts textures from Unity games
"""
import UnityPy
import os

# Load the game data folder
env = UnityPy.load("gamepwn_cubemadness1/HackTheBox CubeMadness1_Data")
os.makedirs("extracted", exist_ok=True)

counter = 0
for obj in env.objects:
    if obj.type.name == "Texture2D":
        data = obj.read()
        counter += 1
        name = getattr(data, 'm_Name', f'texture_{counter}')
        if not name:
            name = f'texture_{counter}'
        try:
            img = data.image
            img.save(f"extracted/{name}.png")
            print(f"Saved: {name}.png ({img.size})")
        except Exception as e:
            print(f"Error with {name}: {e}")

print(f"\nTotal textures extracted: {counter}")

Extraction Results

The script extracted 112 textures, including:

• UI elements (buttons, backgrounds)
• Game textures (cubes, capsules)
• Splash screen — splash.png

Flag Discovery

The file splash.png (1280x720 pixels) — the game's splash screen — contained the flag as green text on a black background:

HTB{CU83_M4DN355_UNM4DD3N3D}

This is leetspeak for "CUBE MADNESS UNMADDENED" — a wordplay on the challenge name.

Alternative Approaches

AssetStudio (GUI)

...