Змеиная магия (Snake Magic)

Platform: hackerlab.pro | Category: Reversing | Type: Challenge | Difficulty: Easy | OS: Windows | Author: XESXOR | Date: 2025-12-25 | Status: Solved Techniques: PyInstaller EXE extraction with pyinstxtractor, Python bytecode decompilation with uncompyle6, ASCII code to string conversion, MD5 hash calculation

Summary

The name "Змеиная магия" (Snake Magic) is a direct hint at Python (snake = змея).

Змеиная магия (Snake Magic) — HackerLab

Description

Перед вами загадочный EXE, который охраняет Священный Грааль CTF - флаг!

The name "Змеиная магия" (Snake Magic) is a direct hint at Python (snake = змея).

Analysis

Step 1: File Type Identification

 bash read-only • copy allowed Copy
file snake_magic.exe
# PE32+ executable (console) x86-64, for MS Windows

strings snake_magic.exe | grep -i python
# python38.dll
# _MEIPASS
# PYZ-00.pyz

Characteristic signs of PyInstaller:

• References to python38.dll — Python 3.8 runtime
• _MEIPASS — PyInstaller temporary directory
• PYZ-00.pyz — archive with Python modules ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 2: Extracting PyInstaller Contents

 bash read-only • copy allowed Copy
python3 pyinstxtractor.py snake_magic.exe
# [+] Processing snake_magic.exe
# [+] Pyinstaller version: 2.1+
# [+] Python version: 38
# [+] Length of package: 5234567 bytes
# [+] Found 123 files in CArchive
# [+] Possible entry point: task.pyc

Main file: task.pyc

Step 3: Bytecode Decompilation

 bash read-only • copy allowed Copy
uncompyle6 snake_magic.exe_extracted/task.pyc

Decompiled code:

 python read-only • copy allowed Copy
import hashlib

def check_password(password):
    magic_numbers = [112, 121, 116, 104, 111, 110]
    expected = ''.join(chr(n) for n in magic_numbers)
    return password == expected
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

def generate_flag(password):
    hash_value = hashlib.md5(password.encode()).hexdigest()
    return f"CODEBY{{{hash_value}}}"

def main():
    password = input("Enter the password: ")
    if check_password(password):
        print(f"Correct! Flag: {generate_flag(password)}")
    else:
        print("Wrong password!")

if __name__ == "__main__":
    main()

Step 4: Logic Analysis

Magic numbers are ASCII codes:

 python read-only • copy allowed Copy
magic_numbers = [112, 121, 116, 104, 111, 110]

# Decoding:
''.join(chr(n) for n in magic_numbers)
# 'python'

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Password: python

Step 5: Flag Calculation

 python read-only • copy allowed Copy
import hashlib
password = "python"
md5_hash = hashlib.md5(password.encode()).hexdigest()
print(f"CODEBY{{{md5_hash}}}")
# CODEBY{REDACTED}

Solution

 python read-only • copy allowed Copy
#!/usr/bin/env python3
"""
Solution for "Змеиная магия" (Snake Magic)
HackerLab - Reverse Engineering
"""

import hashlib

# Magic numbers from decompiled code
magic_numbers = [112, 121, 116, 104, 111, 110]
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Decode ASCII codes to string
password = ''.join(chr(n) for n in magic_numbers)
print(f"Password: {password}")  # python

# Calculate MD5 hash
md5_hash = hashlib.md5(password.encode()).hexdigest()
print(f"MD5: {md5_hash}")  # REDACTED

# Form the flag
flag = f"CODEBY{{{md5_hash}}}"
print(f"Flag: {flag}")

Tools

pyinstxtractor

Extracting PyInstaller EXE contents:

 bash read-only • copy allowed Copy
pip install pyinstxtractor
python3 pyinstxtractor.py target.exe

uncompyle6

Decompiling Python 2.7-3.8 bytecode:

 bash read-only • copy allowed Copy
pip install uncompyle6
uncompyle6 file.pyc > file.py

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

For Python 3.9+ use pycdc or decompyle3.

Alternative Approaches

1. Dynamic analysis: Run EXE in Windows/Wine and enter password "python"
2. strings + grep: Sometimes the flag or password can be found directly in strings
3. pyi-archive_viewer: Built-in PyInstaller tool for viewing the archive ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍