Gen-Z Found My Registry — metactf

Description

No separate organizer description was provided with the artifact beyond the registry export chal.reg.

English summary: the challenge provides a Windows registry export for the Services hive. The goal is to identify the malicious persistence entries, recover the hidden payload spread across legitimate service keys, and decode it into the flag.

Analysis

Artifact triage shows that chal.reg is a UTF-16 Windows Registry export of HKLM\SYSTEM\CurrentControlSet\Services. Most of the file contains normal service definitions, but three added services stand out immediately as malicious persistence:

• HKLM\SYSTEM\CurrentControlSet\Services\+7
  • ImagePath = cmd.exe /c start cmd
  • ObjectName = LocalSystem
  • Parameters\evens = ""
• HKLM\SYSTEM\CurrentControlSet\Services\-6
  • ImagePath = cmd.exe /c start cmd
  • ObjectName = LocalSystem
  • Parameters\odds = ""
• HKLM\SYSTEM\CurrentControlSet\Services\MALWARESVC
  • ImagePath = cmd /c start cmd.exe
  • ObjectName = LocalSystem

The ImagePath values clearly launch a command shell as LocalSystem, so these keys are suspicious on persistence grounds alone. The more important clue is the naming and parameter scheme of +7 and -6: they strongly suggest a decoding rule based on position parity.

The registry also contains hidden numbered single-character string values inserted into legitimate service keys. Ordered by number, the payload is:

1=J, 2=Z, 3=}, 4=`, 5=I, 6=M, 7=L, 8=t, 9=w, 10=n, 11=9, 12=,, 13=t, 14=X, 15=6, 16=_, 17=e, 18=m, 19=n, 20=,, 21=e, 22=a, 23=7, 24=o, 25=9, 26=v

Exact locations of the hidden values:

• WinRM = J
• BALLOON = Z
• GoogleChromeElevationService = }
• `EhStorTcgDrv = ``
• DeviceAssociationService = I
• FileCrypt = M
• CmBatt = L
• LicenseManager = t
• bowser = w
• adsi = n
• applockerfltr = 9
• CompositeBus = ,
• UGatherer = t
• DsRoleSvc = X
• Synth3dVsc = 6
• LanmanServer = _
• Ramdisk = e
• MsRPC = m
• PimIndexMaintenanceSvc_7ad40 = n
• percsas3i = ,
• mshidumdf = e
• PhoneSvc = a
• KPSSVC = 7
• ql2300i = o
• hvservice = 9
• Winsock = v

Concatenating those characters gives the encoded string:

JZ}`IMLtwn9,tX6_emn,ea7o9v

The malicious services provide the decode logic:

• +7 with Parameters\evens means apply ASCII +7 to even positions.
• -6 with Parameters\odds means apply ASCII -6 to odd positions.

Applying that alternating rule to the 26-character payload yields the flag.

Solution

1. Confirm that chal.reg is a UTF-16 export of HKLM\SYSTEM\CurrentControlSet\Services.
2. Triage service entries and identify the obviously malicious additions +7, -6, and MALWARESVC because they launch cmd as LocalSystem.
3. Notice that +7 references evens and -6 references odds, which suggests a parity-based transform rather than just persistence.
4. Extract the hidden numbered single-character values scattered across legitimate service keys and sort them from 1 through 26.
5. Join the characters into JZ}\IMLtwn9,tX6_emn,ea7o9v`.
6. Decode odd positions with ASCII -6 and even positions with ASCII +7.
7. Read the recovered plaintext flag.

Full working solve script:

#!/usr/bin/env python3

payload = {
    1: "J", 2: "Z", 3: "}", 4: "`", 5: "I", 6: "M", 7: "L", 8: "t",
    9: "w", 10: "n", 11: "9", 12: ",", 13: "t", 14: "X", 15: "6", 16: "_",
    17: "e", 18: "m", 19: "n", 20: ",", 21: "e", 22: "a", 23: "7", 24: "o",
    25: "9", 26: "v",
}

encoded = "".join(payload[i] for i in range(1, 27))

decoded = []
for pos, ch in enumerate(encoded, start=1):
    code = ord(ch)
    if pos % 2 == 0:
        decoded.append(chr(code + 7))
    else:
        decoded.append(chr(code - 6))

flag = "".join(decoded)

print(encoded)
print(flag)

Expected output:

JZ}`IMLtwn9,tX6_emn,ea7o9v
DawgCTF{REDACTED}