unpackme.py picoCTF 2022 Solution

Description

1. Step 1

   Inspect the decoder

   Observation

   I noticed the script used Fernet decryption with a hardcoded key and then called exec() on the plaintext result, which suggested that swapping exec() for print() would expose the hidden payload without blindly running unknown code.

   The script imports Fernet from the cryptography library, uses the hardcoded key string correctstaplecorrectstaplecorrec (base64-encoded) to construct a Fernet object, decrypts the embedded payload, and finally calls exec on the decrypted source. Printing plain.decode() reveals the cleartext code.

   What didn't work first

   Tried: Running the original script unmodified to see what it outputs.

   The unmodified script executes the decrypted payload directly via exec(), which may prompt for a password or perform other actions without ever printing the flag. You need to intercept the payload before exec() runs - replace exec(plain.decode()) with print(plain.decode()) so the hidden source is displayed instead of silently executed.

   Tried: Trying to base64-decode the embedded payload manually without using the Fernet key.

   The payload is Fernet-encrypted, not just base64-encoded. A raw base64 decode produces binary ciphertext, not readable Python source. Fernet decryption requires both the key and the correct library call - you must use the hardcoded key already in the script along with Fernet().decrypt() to get the plaintext.

   Learn more

   Self-modifying or self-decoding scripts use a two-stage approach: the outer script contains an encoded payload and decryption logic; when run, it decodes the payload and executes it dynamically. Python's exec() function runs a string as Python code, making this pattern possible in a single file.

   This technique is widely used in malware obfuscation: malicious scripts are encoded (Base64, XOR, zlib, etc.) to evade signature-based antivirus detection. The outer loader decodes and executes the real payload in memory. Multiple layers of encoding are common - each layer decodes the next. Security analysts "unpack" each layer by intercepting the decoded payload before execution, exactly as this challenge demonstrates.

   The safe approach is to replace exec(payload) with print(payload) - this reveals what the script would execute without actually running it. In a sandboxed environment, you can run the original safely, but in real incident response, you always analyze before executing unknown code.

   When PyCDC or uncompyle6 actually matter. They are only needed if the challenge ships compiled bytecode (a .pyc file or a frozen executable like PyInstaller output) without the matching source. This particular challenge ships plain Python source with a Fernet-encrypted payload inside, so neither tool is required: the "decompile" step is just printing the decrypted string. Save PyCDC/uncompyle6 for cases where you only have .pyc bytecode, and use Python's built-in dis module if you want to disassemble code objects you produced with compile().

2. Step 2

   Recover the credentials

   Observation

   I noticed the decrypted payload printed a password prompt alongside plaintext output when exec() was replaced, which suggested the hidden source embedded both the password and the flag in its printed output.

   Executing the modified file prints a message containing both the password (batteryhorse) and flag. Revert to the original script if desired and supply the password to reproduce the flag output.

   What didn't work first

   Tried: Looking for the flag directly in the original .py source file by searching for 'picoCTF'.

   The flag is inside the encrypted Fernet payload, not visible in the outer script source. A text search or strings command on the file will only find the base64-encoded ciphertext, which looks like random characters. The flag only becomes readable after decryption.

   Tried: Installing pycdc or uncompyle6 to decompile the script, expecting a .pyc bytecode file.

   The challenge ships plain Python source (.py), not compiled bytecode (.pyc). Decompilers like pycdc and uncompyle6 operate on bytecode and have no effect here. The correct approach is to intercept the decrypted string at runtime by swapping exec() for print().

   Learn more

   Fernet is a symmetric authenticated encryption scheme built on AES-128-CBC with HMAC-SHA256. It is designed so that decryption fails loudly if the ciphertext has been tampered with. Because the key is hardcoded in the same script as the payload, it provides obfuscation rather than real security - anyone who reads the source can extract the key and decrypt immediately, exactly as this challenge demonstrates.

   Dynamic analysis - running code in a controlled environment and observing behavior - often reveals secrets that static analysis misses. For obfuscated malware, analysts run samples in sandboxes (like Any.run, Cuckoo Sandbox, or CAPE Sandbox) and capture: network connections, file system changes, registry modifications, and spawned processes. Replacing exec with print is the manual equivalent.

   Python's compile() and dis.dis() provide another approach: compile the string to a code object and disassemble it to bytecode, which is readable without execution. This is safer for analyzing potentially dangerous payloads and is the foundation of Python reverse engineering tools.

Flag

Always inspect self-modifying scripts before running them; a simple print statement exposes the payload safely.