Hissss - HackTheBox Challenge Writeup

Challenge Information

Challenge Description

Can you slither around the authentication?

A reversing challenge requiring analysis of a compiled binary to bypass authentication mechanisms and retrieve the flag.

Solution Overview

The challenge involved reversing a PyInstaller-compiled Python executable. By extracting and decompiling the Python bytecode, we discovered the authentication logic and identified the correct password to submit.

Key Steps

Step 1: Identify the Binary Type

First, we examined the provided binary to understand its structure:

ls -la /path/to/challenge/
file auth

The binary was identified as a PyInstaller executable, a common Python packaging tool that bundles Python applications into standalone binaries.

Step 2: Extract PyInstaller Contents

Using pyinstxtractor-ng, we extracted the embedded Python bytecode:

# Extract the PyInstaller archive
pyinstxtractor.py auth

# List the extracted contents
ls -la auth_extracted/

This revealed the compiled Python modules, including auth.pyc containing the main authentication logic.

Step 3: Decompile Python Bytecode

We installed and used decompyle3 to decompile the .pyc file back to readable Python source:

# Install decompyle3
pip3 install --quiet --break-system-packages decompyle3

# Decompile the bytecode
cd /tmp/hissss
decompyle3 auth_extracted/auth.pyc

Step 4: Analyze Authentication Logic

The decompiled source revealed the authentication mechanism. The program expected user input and compared it against a hardcoded password string.

Step 5: Extract and Test the Password

From the analysis, we identified the required password:

# Test the authentication with the discovered password
echo "0p3n_s3sam3!" | ./auth

The successful authentication returned the flag: HTB{REDACTED}

Tools Used

Key Learnings

1. PyInstaller Detection: PyInstaller binaries contain distinctive markers like _MEIPASS in their strings output, making them identifiable for extraction.

2. Bytecode Decompilation: Modern .pyc files can be effectively decompiled back to readable Python source code, exposing hardcoded credentials and authentication logic.

3. Authentication Bypass: In poorly secured applications, authentication logic embedded in client-side code (even compiled binaries) can be reversed to discover expected passwords.

4. Tool Chain: The combination of extraction tools (pyinstxtractor-ng) and decompilers (decompyle3) is essential for analyzing Python-based compiled applications.

5. String Analysis: Initial reconnaissance using strings command can quickly identify file format, compression methods, and other structural hints before deeper analysis.

Flag

HTB{REDACTED}

Solved in: 29 turns | Completion Time: 2026-07-13