HTB SpookyPass

Overview

SpookyPass was the opposite of Callfuscated: a small, friendly reversing target where the key was not overcomplicating the solve. The binary retained useful symbols and contained the password in readable data.

Initial Triage

The target was extracted from:

Spooky.zip

using the standard HTB archive password:

hackthebox

Target binary:

rev_spookypass/pass

String triage immediately revealed a likely password:

s3cr3t_p455_f0r_gh05t5_4nd_gh0ul5

Program Logic

The program logic was straightforward:

1. Print a welcome prompt.
2. Read user input with fgets.
3. Strip the trailing newline using strchr.
4. Compare the input with strcmp.
5. If the password matches, reconstruct and print the flag.
6. Otherwise, print a failure message.

The prompt and failure message were:

Welcome to the SPOOKIEST party of the year.
Before we let you in, you'll need to give us the password:
You're not a real ghost; clear off!

Flag Reconstruction

The flag was not directly stored as one plain string. Instead, it was reconstructed from a global integer array named conceptually like parts. The array held character values:

'H','T','B','{','u','n','0','b','f','u','5','c','4',
't','3','d','_','5','t','r','1','n','g','5','}'

When converted back to characters, this yields:

HTB{un0bfu5c4t3d_5tr1ng5}

Verification

The recovered password was verified by running:

printf 's3cr3t_p455_f0r_gh05t5_4nd_gh0ul5
' | ./pass

Output:

Welcome to the SPOOKIEST party of the year.
Before we let you in, you'll need to give us the password: Welcome inside!
HTB{un0bfu5c4t3d_5tr1ng5}

Lessons Learned

• Not every reversing challenge needs heavy tooling.
• Fast triage with strings, symbols, and basic control-flow inspection can solve simple crackmes quickly.
• Even when a password is visible, verify the success path to distinguish password from final flag.