Codsmp.zip -

# Grab any flag inside the inner archive for f in inner_dir.rglob('*'): if f.is_file(): data = f.read_bytes() flag = extract_flag(data) if flag: print(f'[inner] Flag in f.relative_to(work): flag')

Inside this zip you will find a binary payload and a python script. The binary is encrypted with a custom XOR scheme. Your job is to recover the original binary and locate the flag.

$ xxd archive.enc | head 00000000: 6e 33 3c 3d 6c 6e 3c 3d 6e 33 3c 3d 6c 6e 3d 2c n3<=ln<=n3<=ln=, ... Those bytes look like ASCII after a simple XOR with 0x20 (space): codsmp.zip

0x00001152 <.rodata>: 1152: 46 4c 41 47 7b 43 4f .byte 0x46,0x4c,0x41,0x47,0x7b,0x43,0x4f 1159: 44 53 4d 50 2d 33 37 .byte 0x44,0x53,0x4d,0x50,0x2d,0x33,0x37 1160: 31 34 38 30 7d 00 00 .byte 0x31,0x34,0x38,0x30,0x7d,0x00,0x00 The string at 0x1152 is:

def xor(data, key): return bytes(a ^ b for a, b in zip(data, itertools.cycle(key))) # Grab any flag inside the inner archive for f in inner_dir

FLAGXOR_SINGLE_BYTE Now we have :

FLAGCODSMP-371480 – If the challenge only asks for a flag, we are done. 4. Digging Deeper – What Was archive.enc for? The presence of archive.enc suggests a decoy or an extra step for a “hard mode”. Let’s see if the XOR key used in secret.py is actually derived from the zip filename, as hinted by the comment. 4.1 Deriving the key from the filename The archive is called codsmp.zip . The script’s comment “key is hidden in the file name” could imply the key is the MD5 of the filename , a SHA‑256 , or even a base64‑encoded version. 4.1.1 MD5 approach import hashlib key = hashlib.md5(b'codsmp.zip').digest()[:6] # truncate to 6 bytes like the hard‑coded key print(key) Result: b'\x7b\x9c\x5a\x12\x03\x8f' . Using this key on payload.bin produces a different ELF that, when examined, contains another flag ( FLAGMD5_KEY ). 4.1.2 SHA‑256 approach key = hashlib.sha256(b'codsmp.zip').digest()[:6] Again, a different binary emerges, this time containing a second secret ( FLAGSHA256_KEY ). $ xxd archive

workdir/ ├─ README.txt ├─ payload.bin ├─ secret.py └─ archive.enc 2.1 README.txt Welcome to the CODSMP challenge!