Arson CTF

ahmed alaa

Sep 5, 2025

--

Listen

Share

It’s all started when i executed the script that my friend sent to me can you retrieve the flag that was stolen?

After downloading the .pcap file , look for the GET requests

Press enter or click to view image in full size

I discovered a suspicious PowerShell script host.ps1 being downloaded

Press enter or click to view image in full size

• AES encryption was used

look for the POST request of the packet that sent to the attacker

Press enter or click to view image in full size

Decrypt the value to get the flag

To do this i reused the decrypt function found in attacker PowerShell script.

create decrypt.ps1 file

Press enter or click to view image in full size

Steps to run the file :

→ Open PowerShell as Administrator

→ Go to the file path

→ if error occur run→ Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass

→ run the script → .\decrypt.ps1