All Articles
HTB Challenge
Apr 27, 2026 1 min read

Unzip the file with unzip -P ██████████ SpookyPass.zip:

Archive:  SpookyPass.zip
   creating: rev_spookypass/
  inflating: rev_spookypass/pass

NOTE: Grab password for the zip file from the challenge web page

Change directory to rev_spookypass with cd rev_spookypass

Lists its content with ls

pass

With file command we can determine file type as file pass:

pass: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=3008217772cc2426c643d69b80a96c715490dd91, for GNU/Linux 4.4.0, not stripped

Which shows us that its a executable file which can be executed with ./pass:

Welcome to the SPOOKIEST party of the year.
Before we let you in, you'll need to give us the password:

Which asks for a password, but since this is a binary, directly viewing it with cat produces unreadable output. Instead, we can extract human-readable strings using strings:

/lib64/ld-linux-x86-64.so.2
fgets
...<SNIP>...
Before we let you in, you'll need to give us the password:
s3█████████████████████████████l5
...<SNIP>...
.bss
.comment

The string s3█████████████████████████████l5 appears right after the password prompt, making it a strong candidate for the correct password.

NOTE strings worked because binaries often store readable text and passwords are sometimes hardcoded

Copy the retrieved password to your clipboard, and execute the binary with ./pass

Welcome to the SPOOKIEST party of the year.
Before we let you in, you'll need to give us the password: s3█████████████████████████████l5
Welcome inside!
HTB{████████████████████}

PRO TIP: Always check strings before deeper reversing