$ file archive.enc archive.enc: data No magic bytes – it’s a raw blob. Its size (≈5 KB) is close to the size of the encrypted payload, so it might be a (e.g., an encrypted archive that contains the real flag). 3. Reproducing the Decryption First, let’s try the script as‑is:
def xor(data, key): return bytes(a ^ b for a, b in zip(data, itertools.cycle(key))) codsmp.zip
FLAGCODSMP-371480 – If the challenge only asks for a flag, we are done. 4. Digging Deeper – What Was archive.enc for? The presence of archive.enc suggests a decoy or an extra step for a “hard mode”. Let’s see if the XOR key used in secret.py is actually derived from the zip filename, as hinted by the comment. 4.1 Deriving the key from the filename The archive is called codsmp.zip . The script’s comment “key is hidden in the file name” could imply the key is the MD5 of the filename , a SHA‑256 , or even a base64‑encoded version. 4.1.1 MD5 approach import hashlib key = hashlib.md5(b'codsmp.zip').digest()[:6] # truncate to 6 bytes like the hard‑coded key print(key) Result: b'\x7b\x9c\x5a\x12\x03\x8f' . Using this key on payload.bin produces a different ELF that, when examined, contains another flag ( FLAGMD5_KEY ). 4.1.2 SHA‑256 approach key = hashlib.sha256(b'codsmp.zip').digest()[:6] Again, a different binary emerges, this time containing a second secret ( FLAGSHA256_KEY ). $ file archive
def xor(data, key): return bytes(a ^ b for a, b in zip(data, itertools.cycle(key))) Reproducing the Decryption First, let’s try the script
$ unzip codsmp.zip -d workdir Now we have a working directory:
$ unzip -l codsmp.zip Archive: codsmp.zip Length Date Time Name --------- ---------- ----- ---- 2048 2024-09-10 13:21 README.txt 8192 2024-09-10 13:21 payload.bin 4096 2024-09-10 13:21 secret.py 5120 2024-09-10 13:21 archive.enc --------- ------- 19 456 bytes total The archive is password‑protected (the unzip -l works without a prompt), but it does contain an encrypted file ( archive.enc ) and a suspicious payload.bin . The first step is to extract everything:
'PK\x03\x04\x14\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' That is the ( PK\x03\x04 ). So archive.enc is a ZIP archive XOR‑encrypted with a single‑byte key 0x20 . 4.2.1 Decrypting it $ python3 -c "import sys; data=open('archive.enc','rb').read(); open('inner.zip','wb').write(bytes(b ^ 0x20 for b in data))" $ unzip inner.zip -d inner Archive: inner.zip inflating: inner/secret_flag.txt inner/secret_flag.txt contains: