CorpSyncAudit

CACTF2026

Task: stripped MinGW x64 Windows PE (compliance/audit tool) hides a backdoor whose payload is steganographically encoded in the date/time and Region fields of one crafted sync log. Solution: deobfuscate repeating-key XOR strings, reverse a custom FNV-1a region table (5-bit alphabet), unpack per-line date fields, recover the fixed 0xf07ec6a4 fingerprint from the PEB-walk hash resolver, and rebuild 396 bytes of windows/x64/exec shellcode whose net-user command carries a base64-encoded flag.