Игра (Game)

Platform: hackerlab | Category: Misc | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2025-12-26 | Status: Solved Techniques: File signature analysis (magic bytes), Password cracking with John the Ripper, Unicode escape sequence decoding, ZIP header repair (MZ to PK)

Summary

Task: A game file (Game.exe) that does not run. Solution: Fixed ZIP signature (MZ to PK), cracked password with John the Ripper, decoded Unicode escape sequences to get the flag.

Игра (Game) — HackerLab

Description

Мой друг разработал очень интересную, по его словам, игру, но она у меня не открывается. Хелп ми!

(My friend developed a very interesting game, according to him, but it won't open for me. Help me!)

File: task.zip → Game.exe

Analysis

Step 1: Checking the file type

 bash read-only • copy allowed Copy
file Game.exe
# Game.exe: data (or undefined type)

xxd Game.exe | head -5
# 00000000: 4d5a 0304 1400 0900 0800 ...  MZ..............

The file starts with MZ (DOS/PE executable signature), but the structure doesn't match an executable file. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 2: Structure analysis

Upon careful examination of the hex dump, we can see that after the first two bytes there's a structure typical for a ZIP archive:

• 03 04 — version needed to extract
• 14 00 — flags
• 09 00 — compression method (Deflate)

A ZIP archive should start with PK (0x50 0x4B), not MZ (0x4D 0x5A).

Step 3: Fixing the signature

 bash read-only • copy allowed Copy
# Replace first 2 bytes from MZ to PK
printf 'PK' | dd of=Game.exe bs=1 count=2 conv=notrunc

# Verify
file Game.exe
# Game.exe: Zip archive data, at least v2.0 to extract

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 4: Extraction attempt

 bash read-only • copy allowed Copy
unzip Game.exe
# Archive:  Game.exe
#    skipping: flag.txt                need password

The archive is password-protected!

Step 5: Password cracking

 bash read-only • copy allowed Copy
# Extract hash for John the Ripper
zip2john Game.exe > game.hash

# Run brute force
john game.hash --wordlist=/usr/share/wordlists/rockyou.txt

# Result:
# spiderman        (Game.exe/flag.txt)

Password: spiderman

Step 6: Extraction and decoding

 bash read-only • copy allowed Copy
unzip -P spiderman Game.exe
# Archive:  Game.exe
#   inflating: flag.txt
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

cat flag.txt
# \u{43}\u{4f}\u{44}\u{45}\u{42}\u{59}\u{7b}\u{6e}\u{23}\u{6c}\u{6c}\u{5f}\u{62}\u{79}\u{74}\u{33}\u{5f}\u{62}\u{33}\u{5f}\u{6c}\u{31}\u{6b}\u{65}\u{7d}

The flag is encoded in Unicode escape sequences in \u{XX} format.

Step 7: Unicode decoding

 python read-only • copy allowed Copy
import re

encoded = r"\u{43}\u{4f}\u{44}\u{45}\u{42}\u{59}\u{7b}\u{6e}\u{23}\u{6c}\u{6c}\u{5f}\u{62}\u{79}\u{74}\u{33}\u{5f}\u{62}\u{33}\u{5f}\u{6c}\u{31}\u{6b}\u{65}\u{7d}"

# Extract hex values and convert to characters
flag = ''.join(chr(int(x, 16)) for x in re.findall(r'\\u\{([0-9a-fA-F]+)\}', encoded))
print(flag)

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution (full script)

 python read-only • copy allowed Copy
#!/usr/bin/env python3
"""
HackerLab - Игра (Game)
ZIP archive recovery and flag decoding
"""

import re
import subprocess
import os

def fix_zip_signature(filename):
    """Fixes ZIP file signature from MZ to PK"""
    with open(filename, 'r+b') as f:
        header = f.read(2)
        if header == b'MZ':
            f.seek(0)
            f.write(b'PK')
            print(f"[+] Fixed signature: MZ -> PK")
            return True
        elif header == b'PK':
            print("[*] Signature already correct (PK)")
            return True
        else:
            print(f"[-] Unknown signature: {header}")
            return False
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

def crack_zip_password(filename):
    """Cracks ZIP password using John the Ripper"""
    # Create hash
    hash_output = subprocess.check_output(['zip2john', filename], stderr=subprocess.DEVNULL)
    
    with open('game.hash', 'wb') as f:
        f.write(hash_output)
    
    # Run John
    subprocess.run(['john', '--wordlist=/usr/share/wordlists/rockyou.txt', 'game.hash'], 
                   capture_output=True)
    
    # Get password
    result = subprocess.check_output(['john', '--show', 'game.hash']).decode()
    # Format: filename/entry:password:...
    password = result.split(':')[1] if ':' in result else None
    
    return password
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

def decode_unicode_escapes(text):
    """Decodes Unicode escape sequences in \\u{XX} format"""
    return ''.join(chr(int(x, 16)) for x in re.findall(r'\\u\{([0-9a-fA-F]+)\}', text))

def main():
    filename = 'Game.exe'
    
    # 1. Fix signature
    fix_zip_signature(filename)
    
    # 2. Crack password (or use known one)
    password = 'spiderman'  # crack_zip_password(filename)
    print(f"[+] Password: {password}")
    
    # 3. Extract
    subprocess.run(['unzip', '-P', password, '-o', filename], capture_output=True)
    
    # 4. Read and decode flag
    with open('flag.txt', 'r') as f:
        encoded = f.read().strip()
    
    flag = decode_unicode_escapes(encoded)
    print(f"[+] Flag: {flag}")
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

if __name__ == '__main__':
    main()

Signature Reference

Alternative Methods

Fixing via hex editor

 bash read-only • copy allowed Copy
# Using hexedit
hexedit Game.exe
# Replace 4D 5A with 50 4B in the first two bytes

One-liner Unicode decoding

 bash read-only • copy allowed Copy
cat flag.txt | python3 -c "import re,sys; print(''.join(chr(int(x,16)) for x in re.findall(r'\\\\u\{([0-9a-fA-F]+)\}', sys.stdin.read())))"

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍