Intro

This year I had the pleasure to be invited at leHACK 2025, one of (if not) the biggest hacking convention in France. The talks and hosts were amazing ! Special shoutout to Tuxlu, with whom I had the pleasure to discuss during the event.

On Saturday evening, a public wargame was hosted with PWN, Reverse, Web, Game Hacking and Cryptography challenges. Though I typically enjoy solving Forensics challenges, I here had to adapt and change categories.

This blog post will thus contain the writeups for the challenges I managed to solve with my team.

See ya !

---

Game Hacking 🎮

The challenges were aligned with the four levels of Tuxlu’s Flag Quest game. This game was specially made for this event and its trailer can be watched here.

Level 1 - Platforming King

Difficulty: Easy
Flag: leHack{PWN_4DV3NTUR3R}

The game starts with an introduction scene where our character founds the F.L.A.G. (Faster than Light Acceleration Generator) but it gets stolen by their enemies, the Siedparis.

This first level revolves around platforming mechanics and, while at first nothing stands out, we rapidly face our difficulty

We fire up CheatEngine and start collecting coins to isolate the correct location in memory that we’ll need to modify in order to move on in the level. Once found, we modify it to 250 and beat this first step.

Next, the way gets blocked by a wall. The solution here is to find the character’s position in memory. To do so, we move our character back and forth to narrow down the possible memory locations.

Once found, we can alter them to teleport our character on the other side of the wall.

But we are immediately informed that this technique won’t work anymore

Indeed, if we try it, we get insta-killed

We progress further and in the level and are given the ability to double jump. However, this ability is taken away only two platforms later, leaving us with no way to reach the next platform.

We repeat the same process as before, with the exception of a small parameter. Indeed, by default CheatEngine only searches for 4-Bytes values and I had the feeling this time the value would be binary. I thus set the search parameter to ALL, and started the level again and again to change the state of the value in charge of enabling or disabling the power-up.

Once found, we can re-enable the double jump ability and progress to the next platform

We can finally finish this first level and obtain the flag !

Level 2 - Solid Lore

Difficulty: Easy
Flag: leHACK{SOLID_LORE_SKIPPER}

This level is a reference to early Metal Gear dialog scenes that aims at giving us more lore about the scenario of the game

However, the antagonist does so verryyyy slowly, and it takes a long time to go through the whole dialog.

To speed things up, we are going to use CE’s Speedhack feature…

…and get the flag :)

Achievments

The game also contained achievments, some I managed to obtain. Here is the detailed list :

1- Game breaking bug!

2- diaLOGic

3- Lore master

This achievment was obtained if you listened through the whole dialog without Speedhacking.

4- brainscan

In the third level of the game, this old man gives you a hint to find a piece of info in memory.

Web 🌐

Kubain (EASY)

Difficulty: Easy
Flag: LeHack{hacking_a_pod_is_nice}

When we visit the URL of the chall, we arrive on this page

Each cigar category is clickable and is used to check the stock of each of them. I immediately notice something interesting in the URL: https://kubain.wargame.rocks/stock?cigar=cohiba

We test this theory by trying to view the content of another file, in this case /etc/passwd https://kubain.wargame.rocks/stock?cigar=../../etc/passwd

Success! Now that we know that the parameter given in the URL is essentially just passed to the “cat” command, we may exploit it to display the content of another command. To do so, we use the “%0A” delimeter and check the content of the “/app” folder: https://kubain.wargame.rocks/stock?cigar=%0Als -la /app/

We enumerate the content of the folders here, and find a suspicious “flag.yml” inside the “kubernetes” folder…

…and open it to get the flag in base64 encoding

Finally, we decode it using cyberchef

---