$ cat writeup.md…
$ cat writeup.md…
hackthebox
Task: Extract the flag from an intentionally unsolvable SFML Sokoban game binary. Solution: Reverse engineer the binary to find TEA-encrypted ciphertext in .rdata, derive the 4-integer decryption key from X-mark target pixel positions on the game grid (using tile size and offset formulas), and decrypt with standard TEA 32-round decryption.
$ cat /etc/rate-limit
Rate limit reached (20 reads/hour per IP). Showing preview only — full content returns at the next hour roll-over.
Sokoban is a great logic game, just push the boxes on X marks and win the flag! Oh wait, someone placed the box outside the walls...
Challenge provides a Windows PE64 executable (SokobanHTB.exe) built with SFML (C++) and three PNG assets (player.png, X.png, box.png). The game implements a classic Sokoban box-pushing puzzle, but one box is placed outside the playable grid, making the puzzle intentionally unsolvable through normal gameplay.
Flag format: HTB{...}
file SokobanHTB.exe # PE32+ executable (console) x86-64, for MS Windows strings SokobanHTB.exe | grep -i "sokoban\|player\|box\|font\|flag" # player.png, X.png, box.png # C:\Windows\Fonts\arial.ttf # Sokoban HTB
The binary is a standard Windows console application using SFML for graphics rendering.
Disassembly revealed the Sokoban map stored at 0x1400b8e10 in the .rdata section as 32-bit integers. The grid is 7 columns x 8 rows:
Map values: 0=empty, 1=wall, 2=X-mark(target), 3=box, 4=player
Row 0: . # # # # . .
Row 1: # # P X # . . <- Player(P) at (2,1), Target(X) at (3,1)
Row 2: # . B . # . . <- Box at (2,2)
Row 3: # . B . # # # <- Box at (2,3)
Row 4: # . B # . . # <- Box at (2,4)
Row 5: # X . . . X # <- Targets at (1,5) and (5,5)
Row 6: # # . . # # #
Row 7: . # # # # . .
Grid rendering parameters:
...
$ grep --similar