$ unzip -l codsmp.zip Archive: codsmp.zip Length Date Time Name --------- ---------- ----- ---- 2048 2024-09-10 13:21 README.txt 8192 2024-09-10 13:21 payload.bin 4096 2024-09-10 13:21 secret.py 5120 2024-09-10 13:21 archive.enc --------- ------- 19 456 bytes total The archive is password‑protected (the unzip -l works without a prompt), but it does contain an encrypted file ( archive.enc ) and a suspicious payload.bin . The first step is to extract everything:
0x00001152 <.rodata>: 1152: 46 4c 41 47 7b 43 4f .byte 0x46,0x4c,0x41,0x47,0x7b,0x43,0x4f 1159: 44 53 4d 50 2d 33 37 .byte 0x44,0x53,0x4d,0x50,0x2d,0x33,0x37 1160: 31 34 38 30 7d 00 00 .byte 0x31,0x34,0x38,0x30,0x7d,0x00,0x00 The string at 0x1152 is: codsmp.zip
def xor(data, key): return bytes(a ^ b for a, b in zip(data, itertools.cycle(key))) $ unzip -l codsmp