zwesty
Write-ups / Day 14 / Script
Day 14 · Wed, Oct 14 · Script

Trust the Process

Prey slaughtered

Compounding script triage; MSBuild project files as a script host (trusted developer utility proxy execution); reading a staged chain's decoded behaviour graph; ATT&CK mapping

STTMClaude Homebase Both

Flags are shortened to their first 8 and last 4 characters because they're unique per team.

Challenge ID
script-analysis-day-14-msbuild-trusted-project-abuse (+ /time_trial, /mastery)
Solved
2026-10-14: all three modes CORRECT by 09:02:21 ET, 1 min 9 s after our automated morning solver started the Single Solve. No new code was needed: the existing solver chain answered all 971 questions, today's 44 MSBuild questions included, with nothing rejected
Player
Zwesty (solo), with Claude Code (Opus 5.5): solved by our automated morning solver (a scheduled script on our Kali VM) with our Script solver chain

The challenge

"An MSBuild project looks like routine build plumbing until you follow its properties into its targets. Recover the property and target flow, compare it with earlier execution chains, and find where a trusted toolchain is doing untrusted work."

971 questions about the specimens in one evidence.zip (Day 13 had 913). The lane compounds: every earlier day's specimens come back, and today adds a new polyglot host, msbuild_xml, with four specimens (benign utility, downloader, launcher, staged chain) of 11 questions each = 44 new questions.

Question family (per MSBuild specimen) Example question Format
role "Classify the inert source role." enum (benign_utility, downloader, launcher, staged_chain, …)
attack Map the decoded behaviour graph to one primary technique, using the stated precedence ATT&CK ID
host-profile "Identify the script host or source container." exact text
obfuscation "Recover the ordered encoding profile." exact text
stage-profile "Recover the multi-stage relationship profile." exact text
next-language "Recover the next script language in the inert handoff." exact text
adapter, campaign, file-path / url, stage-count, steps the usual exact fields of the polyglot template exact text, integer, >-joined tokens

Reading the prompt: what it said we'd need

Clue What it pointed to What I did about it
"MSBuild project", "trusted toolchain doing untrusted work" MSBuild (a signed Microsoft build tool) running code from a project file: trusted developer utility proxy execution Nothing new: the polyglot template treats msbuild_xml as one more host
"follow its properties into its targets" The project's properties feed its targets, which hold the decoded chain Our core solver already decodes the template's fields, whatever the host
"compare it with earlier execution chains" The fields match earlier days' polyglot specimens (PHP, AutoIt, Lua, WMI MOF, …) Same field families, same answers vocabulary

Safety

  • The specimens are inert, malware-styled scripts. The solver reads them as text in memory; nothing is run.
  • This write-up was built from the solver's report and the saved Game Master replies only. The specimens themselves weren't reopened for it.

What was in the files

  • Single Solve: one evidence.zip with every lane-to-date specimen; the four new ones are MSBuild XML projects. The staged-chain specimen's answers, from the solver's report: host profile standalone, obfuscation base64, stage profile two_stage_download_execute, next language vbscript.
  • Time Trial: the same 971 questions on a fresh evidence set. Mastery: two sets, 1,942 questions.
  • The timed sets' staged-chain specimens gave the same four values (the report lists them for the Time Trial and for Mastery set2).

Single Solve

The solver ran the challenge through our Day 8 core solver and the usual add-ons, then sent in its usual order:

Batch Answers accepted What it covers
core 841 (all 44 MSBuild answers among them) every template field, all hosts
Batch vocabulary (17 batches) 17 Batch control and expansion labels
JScript plug-ins (plain, styles, roles, attack) 105 JScript-specific fields
VBScript control (8 batches) 8 VBScript control labels; the last one completed the set
  • 33 submits from 13:01:13 to 13:02:05 UTC, spaced 1 s apart (the rate-limit spacing).
  • Single Solve CORRECT at 09:02:05 ET, flag d5a9cdbb…ed37.
  • The solver's "rejected on another question before (still sent)" lines are its usual warning: those labels (while_once, do_once, direct, for_once) were wrong on some other script once, and are right here.

Time Trial

CORRECT on the first attempt. 30 s clock, unique_attempts_remaining: 0, unranked.

started_at  2026-10-14T13:02:11.932Z
deadline    2026-10-14T13:02:41.932Z   (30 s)
answers     971
start 771 ms · artifact 432 ms · solve 98 ms · submit 1631 ms · TOTAL 2933 ms
stamped     13:02:13.310Z (+1.38 s after started_at)
result      CORRECT   flag 80b9e0a7…7e6c

Mastery

CORRECT on the first attempt (2 sets, 1,942 answers, 30 s clock, unique_attempts_remaining: 0, unranked).

started_at  2026-10-14T13:02:20.252Z
deadline    2026-10-14T13:02:50.252Z   (30 s)
answers     1942
start 1045 ms · artifact 496 ms · solve 212 ms · submit 1873 ms · TOTAL 3629 ms
stamped     13:02:21.860Z (+1.61 s after started_at)
result      CORRECT   flag 3fd06491…7ca5

Time to solve

All three modes were solved by 09:02:21 ET, 1 min 9 s after the Single Solve was started; the 33 Single Solve batches took 52 s and were all accepted, and the unranked Time Trial and Mastery each went through on the first submit.

Takeaways

  • A generic template solver pays off. The Day 8 core answered a brand-new host (MSBuild XML) without a change, because the generator wraps the same template fields in a new container.
  • The 1 s submit spacing is now the biggest part of the Single Solve (52 s for 33 batches). That's the price of not tripping the per-team rate limit, and the lane still finished by 09:02.
  • The vocabulary work of Days 3–9 keeps paying: every Batch and VBScript control label came from the rules confirmed on those days.