LightningFast - HackTheBox

Challenge Description

A Unity IL2CPP Windows game where you need to get 1,000,000 points to buy the flag via /buyflag endpoint.

Files provided:

• LightningFast.exe - Main Unity game executable
• GameAssembly.dll - IL2CPP compiled game code
• global-metadata.dat - IL2CPP metadata

Initial Analysis

Identifying the Game Type

The presence of GameAssembly.dll and global-metadata.dat immediately identifies this as a Unity IL2CPP game. IL2CPP (Intermediate Language to C++) is Unity's AOT (Ahead-of-Time) compilation technology that converts C# code to C++.

Static Analysis with Il2CppDumper

First, we extract C# class definitions from the IL2CPP binary:

# Extract metadata and generate dummy DLLs
Il2CppDumper.exe GameAssembly.dll global-metadata.dat output/

This reveals several interesting classes:

• Player.Post() - method that sends score data to server
• ScoreHandler - uses ObscuredInt (XOR encrypted values from Anti-Cheat Toolkit)
• ShopMenuHandler.BuyFlag() and GetFlag() methods

Server Endpoint Discovery

Initial probing of the server reveals:

# Check the buyflag endpoint
curl "http://94.237.61.249:48085/buyflag"
# {"result":"You need 1000000 more points."}

# Try the ack endpoint
curl "http://94.237.61.249:48085/ack"
# Returns acknowledgment

The /buyflag endpoint confirms we need 1,000,000 points.

Ghidra Analysis

Decompiling GameAssembly.dll in Ghidra shows:

• Anti-Cheat Toolkit (ACTk) is used for memory protection
• ObscuredInt XOR-encrypts values in memory
• Score submission happens via HTTP POST

However, the exact request format remained unclear from static analysis alone.

Dynamic Analysis - The Breakthrough

Setting Up Windows Environment

Since static analysis wasn't revealing the full picture, we set up a Windows VDS to run the game:

1. Windows Server 2022 VDS
2. Installed the game
3. Used pktmon (built-in Windows packet monitor) to capture traffic

Traffic Capture

# Start packet capture
pktmon start --capture --file game_traffic.etl

# Play the game, die to trigger score submission

# Stop capture
pktmon stop

# Convert to pcap format
pktmon etl2pcap game_traffic.etl -o game_traffic.pcap

Critical Discovery

Analyzing the captured traffic revealed the key insight:

The game first requests /endpoints which returns dynamic endpoint names!

curl "http://94.237.61.249:48085/endpoints"
# {"getter":"0odiDs","setter":"V5Uumf"}

The server uses dynamic endpoint names to obscure the API:

• getter endpoint (e.g., /0odiDs) - returns current score
• setter endpoint (e.g., /V5Uumf) - sets the score

Testing the Endpoints

# Get current score
curl "http://94.237.61.249:48085/0odiDs"
# {"score":30}

# The setter endpoint accepts POST requests with score data

Exploitation

With the dynamic endpoints discovered, exploitation is straightforward:

Step 1: Get Dynamic Endpoint Names

curl "http://94.237.61.249:48085/endpoints"
# {"getter":"0odiDs","setter":"V5Uumf"}

Step 2: Set Score to 1,000,000

curl -X POST "http://94.237.61.249:48085/V5Uumf" \
  -H "Content-Type: application/json" \
  -d '{"score":1000000}'
# {"result":"Score updated"}

Step 3: Buy the Flag

curl "http://94.237.61.249:48085/buyflag"
# {"result":"HTB{REDACTED}"}

Complete Exploit Script

#!/usr/bin/env python3
"""
LightningFast - HackTheBox Game Pwn
Exploits dynamic API endpoints to set arbitrary score
"""

import requests

BASE_URL = "http://94.237.61.249:48085"

def solve():
    # Step 1: Get dynamic endpoint names
    print("[*] Fetching dynamic endpoints...")
    r = requests.get(f"{BASE_URL}/endpoints")
    endpoints = r.json()
    
    getter = endpoints['getter']
    setter = endpoints['setter']
    print(f"[+] Getter: /{getter}")
    print(f"[+] Setter: /{setter}")
    
    # Step 2: Check current score
    r = requests.get(f"{BASE_URL}/{getter}")
    print(f"[*] Current score: {r.json()}")
    
    # Step 3: Set score to 1000000
    print("[*] Setting score to 1000000...")
    r = requests.post(
        f"{BASE_URL}/{setter}",
        json={"score": 1000000}
    )
    print(f"[+] Response: {r.json()}")
    
    # Step 4: Buy the flag
    print("[*] Buying flag...")
    r = requests.get(f"{BASE_URL}/buyflag")
    result = r.json()
    print(f"[+] Flag: {result['result']}")

if __name__ == "__main__":
    solve()

Key Takeaways

1. Dynamic Analysis Over Static

For Game Pwn challenges, running the actual game and capturing network traffic is often faster than deep reverse engineering. The game's behavior reveals what static analysis might miss.

2. Check Common API Endpoints

Always try common API discovery endpoints before deep reversing:

• /endpoints
• /api
• /config
• /swagger
• /openapi.json

3. Dynamic Endpoint Names

Servers may use dynamic/randomized endpoint names to obscure the API structure. The /endpoints discovery endpoint is a common pattern.

4. Anti-Cheat Bypass

While ACTk protects memory values with ObscuredInt, it doesn't protect the network layer. Server-side validation was insufficient.

5. The Hint

The challenge hint "Goscurry is not a lie" referenced speed - the game was about quick reflexes, but the real solution was about quick API discovery.

Alternative Approaches

Without Windows

The challenge could have been solved without running the game:

1. String analysis: The /endpoints path was visible in binary strings
2. Endpoint fuzzing: Common endpoint wordlist would find /endpoints
3. More careful metadata analysis: Il2CppDumper output contained hints

Memory Manipulation (Harder Path)

With Cheat Engine and ACTk bypass:

1. Find ObscuredInt XOR key
2. Modify score in memory
3. Trigger score submission

This approach is more complex due to ACTk protections.

Tools Used

Tool	Purpose
Il2CppDumper	Extract C# class definitions from IL2CPP
Ghidra	Decompile GameAssembly.dll
pktmon	Windows built-in packet capture
Wireshark/tshark	Analyze pcap files
curl	HTTP requests
Python requests	Exploit scripting

Key Indicators for This Technique

Use this approach when you see:

• Unity IL2CPP game (GameAssembly.dll + global-metadata.dat)
• Network-connected game with server-side score tracking
• Anti-cheat making memory manipulation difficult
• HTTP/HTTPS traffic to game server
• Score-based unlocks or purchases