zwesty
Write-ups / Day 2 / Script
Day 2 · Fri, Oct 2 · Script

Host With the Most

Prey slaughtered

Static triage of PowerShell and JScript (Windows Script Host), decoding packed configs, ATT&CK mapping, JS syntax forms, scripted timed runs

STTMClaude Homebase Both

Flags are shortened to their first 8 and last 4 characters because they're unique per team.

Challenge ID
script-analysis-day-02-encoded-intent (+ /time_trial, /mastery)
Solved
2026-10-07: Single Solve, Time Trial, and Mastery all CORRECT. 5 h 11 min from the first start (14:02 UTC) to the Mastery CORRECT (19:13 UTC), most of it waiting for the JScript part
Player
Zwesty (solo), with Claude Code (Opus 5.5) and the Homebase agent (GPT-6 Luna)

The challenge

"Windows Script Host has JScript plans for execution, download, upload, and impact. Carry your PowerShell findings forward, tell a function call from an invocation or a property access, and work out which script hands off to which."

87 questions (Single Solve and Time Trial) about one AES-encrypted evidence.zip (password infected, from the Power Play lesson page), and 174 in Mastery (two sets).

Group Files Questions Format
PowerShell (Day 1's samples) resource- / collection- / impact-sample.ps1 15: scenario, ATT&CK, three indicators each enum, T####[.###], exact text
JScript 9 files: host-context, memory-stage, embedded-write, remote-write, local-dispatch, staged-handoff, outbound-transfer, impact-plan, relay-handoff (.js) 72: role, ATT&CK, adapter, campaign, one indicator, plus three style questions role enum; function-style declaration / anonymous_expression / named_expression; invocation-style direct / call / apply; property-style dot / bracket_literal / mixed

Reading the prompt: what it said we'd need

Clue What it pointed to What I did about it
"Carry your PowerShell findings forward" Day 1's Power Play samples come back Reused the Power Play solver and its confirmed ATT&CK pairs: 15/15 on the first submit
"JScript plans" Each .js rebuilds a plan (steps, adapter, values) that names the answers The Homebase agent decoded the plans statically
"tell a function call from an invocation or a property access" The three style questions Read from the syntax, not the behaviour
"which script hands off to which" staged-handoff.js → resource-sample.ps1, relay-handoff.js → local-dispatch.js Role and ATT&CK for the hand-off scripts

Safety

Static only. No script was run: files were read straight out of the AES zip into memory and parsed. The artifacts stayed on our Kali VM and on the Homebase. Indicators below are defanged.

What was in the files

  • The PowerShell samples are Power Play's format (a Base64 JSON descriptor plus a $nativeTypes list), with new values.
  • Each JScript file is an "inert static-analysis fixture (wsh_jscript_windows)": encoded material, a decode function and a recover function that rebuild a plan, and an inspect_* function that never runs. The variants differ in how the plan is packed and in their JS syntax, which is what the style questions test.
  • Time Trial and Mastery used the same template with new values. Mastery's two sets differed in 16 of 27 plain answers and 18 of 27 style answers; roles and ATT&CK were the same in both.

Single Solve

  1. PowerShell (Claude, 14:02 UTC): Power Play's solver gave all 15 (T1496, T1555.003, T1486 plus the indicators): accepted, 72 left.
  2. JScript: Claude's safety filter stopped one step of the analysis, and we didn't work around it. The JScript part was solved by the Homebase agent instead, from a kit Claude packaged (solvers, briefs, and a slot for the agent's own analyser).
  3. JScript (the Homebase agent, 17:47–17:51 UTC): its static analyser answered all 72. It submitted in batches (plain fields, styles, roles, ATT&CK) and tested each doubtful answer alone: - Style: remote-write.js assigns function inner() to a variable, so it's a named_expression, not a declaration. - Role: relay-handoff.js is staged_chain. The question's own list doesn't include relay, and relay was rejected. - ATT&CK: launchers and hand-offs take their own interpreter, T1059.007, the rule that held in every script language.
  4. CORRECT at 17:51:37 UTC (87/87). 4 wrong answers in total, each a deliberate single test.

Solvers: Claude's chained solver (which reaches Power Play's solver) plus the Homebase agent's JScript analyser, run together by our runner.

Time Trial

started_at  2026-10-07T18:04:27.123Z   deadline 2026-10-07T18:04:32.123Z   (5 s)
coverage    87/87 (core 15 + jscript 72)
start       2204 ms
artifact    1295 ms
solve        201 ms
submit       971 ms
TOTAL       4672 ms
result      CORRECT   flag 637d0eb5…d5a2

Correct on the first run, with about 0.3 s to spare. Most of the time was network calls from the Homebase.

Mastery

Attempt 1 (18:16 UTC): stopped before submitting. The delivery was one outer zip holding evidence-01.zip and evidence-02.zip, and Claude's Day 4–7 solvers had lost the "which inner zip" matching that Power Play's solver had. They found two resource-sample.ps1 files and stopped instead of guessing: nothing wrong was submitted, but the clock ran out. The fix: one shared helper that picks a question's file by set and by inner zip, used by every solver, with its own tests. The Homebase agent then updated its analyser to use it (174/174 offline).

Retry 1 (19:13 UTC): CORRECT.

started_at  2026-10-07T19:13:24.530Z   deadline 2026-10-07T19:13:30.530Z   (6 s)
delivery    two downloads this time: 01-evidence.zip 12,733 B, 02-evidence.zip 12,468 B (hashes checked)
coverage    174/174 (core 30 + jscript 144)
retry       3362 ms
start        396 ms
artifact     840 ms
solve        401 ms
submit      1634 ms
TOTAL       6633 ms (client side; the submit still landed inside the server's clock)
result      CORRECT   flag ee6501d2…792e

Time to solve

All three modes were solved on 2026-10-07 by 19:13:27 UTC, 5 h 11 min after the first start. The PowerShell answers were accepted in 18 s, but the Single Solve only completed at 17:51:37, 3 h 49 min in, once the Homebase agent had done the JScript; the Time Trial went through first time in 4.67 s, and the Mastery passed on its retry (6.6 s client side) after the first attempt stopped safely and expired.

Takeaways

  • Compounding pays off: Day 1's solver answered 15 of 87 on the first try.
  • Split the work by who can do it. Claude did the PowerShell, the runner, and the packaging; the Homebase agent did the JScript Claude couldn't. A slot for the agent's analyser plus a facts-only brief made the handover clean.
  • Submit in batches, then isolate. One wrong answer fails a whole batch, so split it and test each doubtful answer alone. Every wrong submit here was a deliberate test, not a guess.
  • Mastery can arrive in two shapes: one outer zip with inner zips, or one download per set. Solvers must pick files by set and by inner zip; a shared helper now does that for every challenge.
  • Hand-off scripts map to their own interpreter, here T1059.007, just as in Batch, VBScript, Python, Bash, and Node.