Codsmp.zip

def xor(data, key): return bytes(a ^ b for a, b in zip(data, itertools.cycle(key)))

print('\n=== Decrypting payload.bin with various keys ===') for name, key in keys.items(): dec = xor(payload, key) flag = extract_flag(dec) if flag: print(f'[name] Flag: flag') else: # store binary for manual analysis (work/f'payload_name.bin').write_bytes(dec) codsmp.zip

Scope – This write‑up assumes you have obtained the codsmp.zip archive from a CTF or a reverse‑engineering challenge. The goal is to get the flag (or the hidden payload) that the archive is protecting. Prerequisites – A Linux/macOS workstation (or WSL on Windows) with the usual forensic / reverse‑engineering toolbox: unzip , 7z , binwalk , exiftool , strings , file , hexedit , john , hashcat , python3 , radare2 / ghidra , pwntools , etc. 1. Initial Inspection $ file codsmp.zip codsmp.zip: Zip archive data, at least v2.0 to extract, compressed size 1.3 MB, uncompressed size 5.6 MB, name=codsmp.zip def xor(data, key): return bytes(a ^ b for

$ xxd archive.enc | head 00000000: 6e 33 3c 3d 6c 6e 3c 3d 6e 33 3c 3d 6c 6e 3d 2c n3<=ln<=n3<=ln=, ... Those bytes look like ASCII after a simple XOR with 0x20 (space): Adjust the extract_flag regex if the flag format differs

$ unzip codsmp.zip -d workdir Now we have a working directory:

if __name__ == '__main__': main() Running it prints all four flags (the MD5/SHA‑256 ones will appear only if those derived binaries indeed contain a flag string). Adjust the extract_flag regex if the flag format differs. | Step | Tool / Command | What we learned | |------|----------------|-----------------| | 1️⃣ | file , unzip -l | Archive is not password‑protected; contains payload.bin , secret.py , archive.enc . | | 2️⃣ | Read `README

$ binwalk -e archive.enc # no known file signatures