reversemedium

Обычная капибара (Usual Capybara)

hackerlab

Task: UPX-packed PE64 with oversized .data section containing a decoy JPEG dropper and a hidden XOR-encrypted PE binary. Solution: unpack UPX, discover hidden PE via single-byte XOR 0xFA, extract it, identify AES-128-CBC parameters from OpenSSL-linked code, decrypt embedded image to reveal flag.

$ ls tags/ techniques/
opensslpe64static_analysisxormingwaes_cbchidden_binaryupxwindows_pemulti_layerembedded_pe
upx_unpackingsingle_byte_xor_decryptionembedded_pe_extractionaes_128_cbc_decryptionopenssl_static_analysishex_string_as_raw_key
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Create a free account with GitHub to get started.

$ssh [email protected]