I immediately opened the network section of ChromeDevTools, given the previous challenge Some Assembly Required 1. I quickly found the WASM file named aD8SvhyVkb, and the first thing I did was download it and run strings on it, just like I did for the first challenge in this series of three challenges:
Strings
The last string immediately caught my attention, and I suspected it might be the flag, possibly encoded. So, let’s proceed with the exploitation phase.
🔬 Vulnerability Analysis
Potential Vulnerabilities
XOR Encryption Weakness
🎯 Solution Path
Exploitation Steps
Initial setup
Having obtained the flag string, we can now proceed with the exploitation phase and decoding.
Exploitation
To analyze it, the first thing I did was insert it into CyberChef using the Magic filter with Intense Mode enabled, which successfully revealed the valid flag. As we can see from the next CyberChef screenshot, the encoding was simply done using an XOR operation with the character 8.
Flag capture
Manual Flag
🛠️ Exploitation Process
Approach
The automatic exploit downloads the wasm file from the server, then uses subprocess to execute strings on the downloaded file. It then extracts the last string from the output, removing the + character at the beginning. Finally, it applies an XOR operation with the character 8 and prints the flag.
