gamepwnfreemedium

SokobanHTB

hackthebox

Task: Extract the flag from an intentionally unsolvable SFML Sokoban game binary. Solution: Reverse engineer the binary to find TEA-encrypted ciphertext in .rdata, derive the 4-integer decryption key from X-mark target pixel positions on the game grid (using tile size and offset formulas), and decrypt with standard TEA 32-round decryption.

$ ls tags/ techniques/
game_hackingreverse_engineeringpe64tea_ciphersfmlsokoban
tea_decryptionkey_derivation_from_game_statestatic_reversing

$ cat /etc/rate-limit

Rate limit reached (20 reads/hour per IP). Showing preview only — full content returns at the next hour roll-over.

SokobanHTB -- HackTheBox

Description

Sokoban is a great logic game, just push the boxes on X marks and win the flag! Oh wait, someone placed the box outside the walls...

Challenge provides a Windows PE64 executable (SokobanHTB.exe) built with SFML (C++) and three PNG assets (player.png, X.png, box.png). The game implements a classic Sokoban box-pushing puzzle, but one box is placed outside the playable grid, making the puzzle intentionally unsolvable through normal gameplay.

Flag format: HTB{...}

Analysis

Step 1: Initial Recon

file SokobanHTB.exe
# PE32+ executable (console) x86-64, for MS Windows

strings SokobanHTB.exe | grep -i "sokoban\|player\|box\|font\|flag"
# player.png, X.png, box.png
# C:\Windows\Fonts\arial.ttf
# Sokoban HTB

The binary is a standard Windows console application using SFML for graphics rendering.

Step 2: Reverse Engineering the Binary (Ghidra/radare2)

Disassembly revealed the Sokoban map stored at 0x1400b8e10 in the .rdata section as 32-bit integers. The grid is 7 columns x 8 rows:

Map values: 0=empty, 1=wall, 2=X-mark(target), 3=box, 4=player

Row 0: .  #  #  #  #  .  .
Row 1: #  #  P  X  #  .  .     <- Player(P) at (2,1), Target(X) at (3,1)
Row 2: #  .  B  .  #  .  .     <- Box at (2,2)
Row 3: #  .  B  .  #  #  #     <- Box at (2,3)
Row 4: #  .  B  #  .  .  #     <- Box at (2,4)
Row 5: #  X  .  .  .  X  #     <- Targets at (1,5) and (5,5)
Row 6: #  #  .  .  #  #  #
Row 7: .  #  #  #  #  .  .

Grid rendering parameters:

  • Tile size: 64 pixels
  • X offset: 320px
  • Y offset: 90px

...

$ grep --similar

Similar writeups