| Variant | Flag | |---------|------| | Default key ( b'codsmp' ) | FLAGCODSMP-371480 | | MD5‑derived key | FLAGMD5_KEY | | SHA‑256‑derived key | FLAGSHA256_KEY | | Single‑byte XOR (0x20) on archive.enc | FLAGXOR_SINGLE_BYTE |
'PK\x03\x04\x14\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' That is the ( PK\x03\x04 ). So archive.enc is a ZIP archive XOR‑encrypted with a single‑byte key 0x20 . 4.2.1 Decrypting it $ python3 -c "import sys; data=open('archive.enc','rb').read(); open('inner.zip','wb').write(bytes(b ^ 0x20 for b in data))" $ unzip inner.zip -d inner Archive: inner.zip inflating: inner/secret_flag.txt inner/secret_flag.txt contains: codsmp.zip
$ xxd archive.enc | head 00000000: 6e 33 3c 3d 6c 6e 3c 3d 6e 33 3c 3d 6c 6e 3d 2c n3<=ln<=n3<=ln=, ... Those bytes look like ASCII after a simple XOR with 0x20 (space): | Variant | Flag | |---------|------| | Default
FLAGXOR_SINGLE_BYTE Now we have :