Ransom

Platform: HackTheBox | Category: Reversing | Difficulty: Easy | Author: D3v0o0Nu11 | Date: 2026-02-10

Description

We received an email from Microsoft Support recommending that we apply a critical patch to our Windows servers. A system administrator downloaded the attachment from the email and ran it, and now all our company data is encrypted. Can you help us decrypt our files?

Solution Approach

Core idea: Identify the weakness from source review or fingerprinting first. Iterate with incremental payloads instead of guessing.

Steps

1. First, unzip the .zip file given.

2. Hmm.. We got PE32+ file and encoded .exe file.

3. Let's decompile the PE32+ file.

4. When i tried to check few functions, i found encrypt function and encryptFile function that could be our interest.

5. Notice when i tried to hover the local_17 value. I got CESREPUS as characters.

6. Then for the local_f value in characters is RU and local_d value in character is E.

7. Concate all of them shall give us ERUCESREPUS.

8. Actually we can try to patch the loop here, so we can get the original decrypted file. But, i prefer use a python script to solve this challenge.

9. Before conduct the script, i tried to strings the excel file.

10. Hmm.. Looks like the text we got is reversed, remember it may stored in little endian. Hence the correct string is SUPERSECURE.

11. Let's make the script:

 py read-only • copy allowed Copy
from pwn import *
import os

os.system('clear')

key = list(b'SUPERSECURE')
encFile = read('login.xlsx.enc')

result = []

### applied the same concept as the for loop, but this time we substract it.

counter = 0
for i in encFile:
    result.append(i - key[counter % len(key)])
    counter += 1

flag = result
print(flag)

OUTPUT

1. Copy all of it and paste it on cyberchef.

2. Got a clue here, based from it i think it's an excel file??

3. Save the output to a file with xlsx extension.

4. Got the flag!

Flag

REDACTED

Lessons Learned

1. Identify the weakness from source review or fingerprinting first.
2. Iterate with incremental payloads instead of guessing.
3. Reuse the same pattern in future engagements.