Nice easy challenge for a change. Meet Elfie!
Running the exe shows this lovely goat which I assume is called Elfie. Nothing remarkable about the app apart from the fact I can type in it.
I took a look at the binary in Ghidra but it looked to be rather complicated and it turned out it is because it’s actually a Python code execution engine. I determined this by checking it out in Detect It Easy
So, how was this made? Well, there is the ability to take a python script and convert it to an exe using PyInstaller as what was mentioned in DiE. Now, if we can get to the original python code, then this challenge could be a lot simpler. There is a tool already called pyinstxtractor which does exactly that. Running this against the exe dumps all the python files contained within the binary.
Now, we see a file called elfie.pyc which is a compiled version of the original script. There are ways to decompile these but surprisingly to me, once I got it open in VSCode, many of the original strings were there.
The above is classic obfuscation, and to extract any meaningful data manually is labour intensive. Remember however when you see stuff like this, always remember to look for where it’s being used, and inject yourself into that. At the very bottom of this script, there’s a base64decode function which basically takes all the strings that were built and decodes them and runs them. Instead of running them, let’s just write the output to disk.
Old Code
exec(base64.b64decode(OOO0OOOOOOOO0000O000O00O0OOOO00O + ...))New Code
with open('out.txt', 'w') as f:
f.write(OOO0OOOOOOOO0000O000O00O0OOOO00O + ...)I removed the invalid bytes at the start and finish of the pyc file and saved it as a .py file and ran it in python. I just piped it to decode it on the command line:
cat out.txt | base64 -dIt outputted a ton of more b64 code, so I decoded that again and a lot of new python appeared. This time however there was a very clear signal in the code:
Reversing this reveals the flag. I will admit I stumbled into this blindly so it was more luck than anything.
Elfie.L0000ves.YOOOO@flare-on.com
If you enter this into the elfie exe, you get a new image!
