Clear it in 3 steps
-
Start the environment
-
Investigate the target
-
Submit the flag
All challenges
In progress
Extract Malware Payload from Memory
Mission
Analyze the recovered memory-string record `memstrings.txt` and reconstruct the obfuscated second-stage payload. Base64-decode the `stage2=` data, undo its single-byte XOR, and retrieve the flag from the recovered dropper's campaign tag.
Hints
Hint 1 Show
The stage2= line in memstrings.txt is the obfuscated second-stage payload (Base64)
Hint 2 Show
After base64-decoding, brute-force the single-byte XOR key (0x00-0xff) for plaintext starting with #!/bin/sh
Hint 3 Show
The recovered dropper's campaign-tag line holds the flag (grep will not find it)