AutoIt Takes Two · Huntress CTF 2026

The challenge

"Two inert AutoIt workflows arrived as a matched set, and each one carries half the story. Correlate them with everything you've proven so far, and decide which pairing is genuine and which is just going through the motions."

855 questions about the specimens in one evidence.zip (Day 11 had 811). The lane compounds: every earlier day's specimens come back, and today adds a new polyglot host, AutoIt (.au3), with four specimens (benign utility, downloader, launcher, staged chain) of 11 questions each = 44 new questions.

Question family (per AutoIt specimen)	Question	Format
`role`	"Classify the inert source role."	enum (benign_utility, downloader, dropper, impact, launcher, persistence_descriptor, relay, staged_chain, stager, uploader, advanced_syntax)
`attack`	Map the decoded ordered behaviour graph to one primary technique, using the stated precedence	ATT&CK technique or language-specific sub-technique
`adapter`, `campaign`, `file-path` / `url`	"Recover the modeled language adapter", "… synthetic campaign identifier", "… url indicator"	exact text
`stage-count`	"Recover the modeled stage count."	integer
`steps`	"Recover the ordered behavior graph using > separators."	ordered tokens joined by `>`
`host-profile`, `obfuscation`, `stage-profile`, `next-language`	host or container, encoding profile, multi-stage profile, next language in the handoff	exact text

Answer kinds across all 855: 506 exact text, 143 enum, 96 pattern, 54 integer, 54 ordered tokens, 2 ATT&CK IDs.

Reading the prompt: what it said we'd need

Clue	What it pointed to	What I did about it
"inert AutoIt workflows"	a new host for the polyglot template, AutoIt	Nothing new: the Day 8 core treats each host as one more wrapper around the same template fields
"a matched set … each one carries half the story"	specimens that only make sense together	No question asked about pairs directly; every answer came per specimen
"Correlate them with everything you've proven so far"	the lane compounds; old specimens and old answers carry over	The solver sent the confirmed answers for every earlier specimen
"which pairing is genuine and which is just going through the motions"	two specimens that look alike but differ in role	This is where we tripped: the JScript `chain` and `relay` specimens look alike, and our add-on labelled both `relay`. Both were `staged_chain`. Whether the prompt meant that pair is my reading, not confirmed

Safety

The specimens are inert, malware-styled scripts. The solver reads them as text in memory; nothing is run.
This write-up was built from the solver's records, the saved Game Master replies, and the request log only. The specimens weren't reopened for it.

What was in the files

Single Solve: one evidence.zip with every lane-to-date specimen; the four new ones are AutoIt .au3 files. From the solver's record of its answers:

Specimen	role	attack	steps	obfuscation	next-language
benign utility	`benign_utility`	`none`	`decode_configuration>return_configuration`	`plain_hex`	`powershell`
downloader	`downloader`	`T1105`	`acquire_remote>dispatch_process`	`base64`	`jscript`
launcher	`launcher`	`T1059`	`decode_embedded>write_file>dispatch_process`	`hex_base64`	`batch`
staged chain	`staged_chain`	`T1059`	`profile_host>decode_configuration>dispatch_language`	`fragmented_hex`	`vbscript`

All four had host profile standalone. Campaigns look like AUTOIT-1dda6094; URLs are under .example.invalid. The attack answers for AutoIt are the parent T1059: ATT&CK has no AutoIt sub-technique, and the format accepts the parent technique. - Time Trial: the same 855 questions on a fresh evidence.zip (93 KB). Mastery: two sets, 1,710 questions, one zip (188 KB).

Single Solve

The 08:58 scheduled run never reached Script: it hit HTTP 429 at 09:00:20 ET right after Android's Single Solve.

The 09:08 manual rerun (Android, Binary, and Script, 10 s between challenges) used the Day 8 core for this challenge and sent in its usual order:

Batch	Sent	Result	Open after
core (all 44 AutoIt answers among them)	725	accepted	130
Batch vocabulary (16 single-answer batches)	16	accepted	114
JScript plain	60	accepted	54
JScript styles	27	accepted	27
JScript roles	9	incorrect (13:09:47 UTC)

The solver stops a challenge on the first incorrect batch, so the JScript attack batch and the nine VBScript control labels weren't sent. 828 of 855 were in.

Why the roles batch failed (worked out offline): today's role question describes staged_chain as a graph ending in handoff_script, and relay as decode_configuration → locate_interpreter → dispatch_next_stage. The JScript specimens staged-handoff.js and relay-handoff.js both decode to acquire_remote → write_file → dispatch_process → handoff_script, so both are staged_chain (also what Days 10 and 11 accepted for the same graphs). Our add-on answered relay whenever the word "relay" appeared in the prompt. Our bug, not a server change.

The fix: in the JScript add-on, a graph ending in handoff_script gives staged_chain, and relay only for the decode_configuration → locate_interpreter → dispatch_next_stage graph. Replayed on all 40 saved Script attempts, only Day 12's two roles changed. Claude then sent the rest with the fixed add-on, about 6 s apart:

Batch	Sent	Result
JScript roles (fixed: chain `staged_chain`, relay `staged_chain`)	9	accepted
JScript attack (unchanged)	9	accepted
VBScript control, one label per submit	9	8 accepted, the last CORRECT

Single Solve CORRECT at 13:14:22.873 UTC (09:14:23 ET), flag a433f99e…405b. The rejected relay values were never resent. The fix went into the morning solver's add-on at 09:17 ET; the copy on the Homebase still had the old rule at the time.

Time Trial

CORRECT on the first attempt. Plain start by hand; 30 s clock, unique_attempts_remaining: 0, unranked (single attempt).

started_at  2026-10-12T13:14:44.981Z
deadline    2026-10-12T13:15:14.981Z   (30 s)
answers     855, one submit
vs started_at (client clock): start +197, artifact +614, solve +722, ready +724, submit +1781 ms
stamped     13:14:46.165Z (+1.18 s after started_at)
result      CORRECT   flag 740c0de4…b066

Mastery

CORRECT on the first attempt (2 sets, 1,710 answers, 30 s clock, unique_attempts_remaining: 0, unranked).

started_at  2026-10-12T13:14:55.630Z
deadline    2026-10-12T13:15:25.630Z   (30 s)
answers     1710, one submit
vs started_at (client clock): start +301, artifact +700, solve +939, ready +942, submit +2451 ms
stamped     13:14:57.142Z (+1.51 s after started_at)
result      CORRECT   flag 918da0b9…5ace

No ranked time. Day 12's routes didn't accept a ranked-clock request even after the 2026-10-15 pool fix.

Time to solve

The 09:08 manual rerun started the Single Solve at 13:09:13 UTC and had 828 of 855 answers in within 32 s before the JScript roles batch came back incorrect; after the offline fix, the Single Solve went CORRECT at 13:14:23, 5 min 10 s from the start, about 3.5 min of it spent on the stop and the diagnosis. The unranked Time Trial (1.18 s) and Mastery (1.51 s) each went CORRECT on the first submit, for 5 min 44 s from the first start to the last CORRECT.

Takeaways

A keyword is not a rule. The add-on matched the word "relay" in the prompt instead of the graph it describes. The fix keys the role on the decoded graph, which is what the question defines.
Stop on the first incorrect batch paid off: only one batch of 9 was wrong, the bad values were never resent, and the replay over 40 saved attempts showed the fix changed nothing else.
The generic template core carried a new host (AutoIt) unchanged: all 44 new answers went in with the first core batch.