Author:
namphong12

Language:
Rust

Upload:
3:38 PM 10/01/2025

Platform
Windows

Difficulty:
3.0

Quality:
3.5

Arch:
x86-64

Description

Filename: unpackme (Linux/macOS) or unpackme.exe (Windows). Format: Portable Executable (PE) on Windows or ELF on Linux/macOS. Size: Depends on compilation, but usually around 1-5 MB (with Rust, the executable can be large due to the runtime). Filetype: Console application, written in Rust, requires a password to display the flag.

• Comments
• Writeups

You must be logged in to post a comment

nightxyz on 9:56 PM 10/02/2025: Password : SecretPass123 But Flag is strange.

karabatik on 9:22 AM 10/03/2025: I confirmed that the first stage is a Rust-based dropper that generates and executes a payload at %USERPROFILE%\AppData\Local\cache_*.bin. After capturing the payload, I examined it and found ReadConsoleW/WriteConsoleW wrappers, prompt strings, and a straightforward memcmp validation routine. The expected password is hardcoded as "SecretPass123" (clearly visible through memcmp xrefs in the IAT). When entered correctly, the program outputs "Correct password! Here is your flag: " followed by the first 15 bytes of a global data header XORed with 0x2A, which is why you see symbols instead of human-readable text on the console—it's an intentional decoy design. I verified this live by running the payload directly from CMD/PowerShell and entering the password; failed attempts yield "Wrong password! Try harder." while successful ones produce the prefix plus the XORed 15-byte output mentioned above. Aside from TLS callbacks and Rust runtime artifacts, there's no meaningful anti-debug or cryptographic complexity involved. The solution boils down to identifying the payload's hardcoded password and understanding that the success path outputs an XORed header rather than plaintext.

You must be logged in to submit a writeup