Challenge Context#

The challenge provided a phishing email and a small PCAP. The email claimed to be an urgent invoice and pointed the victim to an encrypted payload.

Attack Chain#

1
phishing_email.eml
2
  -> invoice URL and decryption key
3
  -> PCAP HTTP response body
4
  -> XOR decrypt invoice.enc
5
  -> Python loader
6
  -> base64 + zlib payload
7
  -> embedded flag XORed with C2 config

Reconnaissance#

The email revealed:

1
URL: http://malicious.local/invoice.enc
2
key: Sup3rS3cr3tK3y

The PCAP contained one HTTP GET for /invoice.enc and a 485-byte binary response.

Exploitation#

First layer: repeated-key XOR with the email key produced Python code:

1
import base64, zlib
2
exec(zlib.decompress(base64.b64decode(b'eJxtUdtq...')))

Instead of executing it, decode it safely. The decompressed malware contained:

1
enc_flag = [47, 87, 58, 39, 62, 58, 58, 46, 57, 0, 19, 44,
2
            30, 37, 46, 51, 29, 93, 102, 112, 83, 50, 58, 56]
3
key = "C2_SERVER_READY_x99"

Flag recovery:

1
flag = ''.join(chr(enc_flag[i] ^ ord(key[i % len(key)])) for i in range(len(enc_flag)))
2
print(flag)

Flag#

1
leet{hlkk_Ai_awled_3ami}

Lesson Learned#

Do not execute malware loaders just because they are Python. Decode each layer statically and treat C2 configuration as likely key material.

Cover: Wallhaven xe86w3.