zwesty
Write-ups / Day 16 / Script
Day 16 · Fri, Oct 16 · Script

Same Same, But Different

Prey slaughtered

Script deobfuscation, behaviour equivalence across obfuscated variants, staged-chain profiling

STTMClaude Homebase Both

Flags are shortened to their first 8 and last 4 characters because they're unique per team.

Challenge ID
script-analysis-day-16-obfuscation-equivalence (+ /time_trial, /mastery)
Solved
2026-10-16, all three modes, 1 min 23 s from the first start (13:01:52 → 13:03:15 UTC)
Player
Zwesty (solo), with Claude Code (Opus 5.5): solved by our automated morning solver (a scheduled script on our Kali VM)

The challenge

"Obfuscation equivalence": scripts that look different but behave the same. As every Script day, the question set compounds: every earlier day's fields for each script (representation, transform, key, ATT&CK, roles, control labels) plus Day 16's own. Written from our solver's report and request log only; the specimens weren't reopened for the write-up.

Reading the prompt: what it said we'd need

Clue What it pointed to What I did about it
"Same Same, But Different" / "obfuscation equivalence" Variants of one behaviour under different encodings The existing chain decodes each variant to the same plan
New timed fields polyglot-msbuild_xml-staged-chain-* An MSBuild XML project that stages a second language The existing chain answered them unchanged (host profile, obfuscation, stage profile, next language)

Safety

Script specimens are hostile. Static analysis only, on our Kali VM; nothing executed. Excerpts aren't quoted here.

What was in the files

Per the solver's report: VBScript stagers, droppers, uploaders, launchers, impact, and chain scripts, each with its control wrapper, plus an MSBuild XML "polyglot" project in the timed sets whose answers were: host profile standalone, obfuscation base64, stage profile two_stage_download_execute, next language vbscript.

Single Solve

The solver sent the core chain's 967 answers in one batch (accepted, 128 remaining), then the plug-ins' answers in their groups. Six VBScript control labels went one at a time through the Day 15 ranked fallback, each accepted on its first value: stager, dropper, uploader, launcher, impact, chain. The last one returned the flag (CORRECT 13:02:51). The "rejected on another question before" notes are warnings for values that were wrong on other questions on earlier days; none was rejected here.

Time Trial and Mastery

Time Trial (ranked): 1,095 answers · start 862 ms · artifact 534 ms · solve 72 ms · submit 1857 ms · TOTAL 3328 ms
result CORRECT  flag 52662640…1704

Mastery (ranked): 5,475 answers · start 5630 ms · artifact 687 ms · solve 233 ms · submit 3852 ms · TOTAL 10410 ms
result CORRECT  flag 377717e5…bb3c

The Mastery's 5.6 s start was the server, not our solve (233 ms for 5,475 answers).

Time to solve

All three modes were solved by 13:03:15 UTC (09:03:15 ET), 1 min 23 s after the first start, with nothing rejected. The Single Solve took about a minute because of one-at-a-time label sends; the ranked Time Trial and Mastery each went through on the first submit.

Takeaways

  • The compounding chain covered a new day without changes. Day 15's literal-first Batch expansion and ranked fallback held up on Day 16's variants.
  • The Single Solve's one-at-a-time label sends were the slow part (~55 s). Labels accepted for days could go in one batch; one at a time is only needed for judgement answers. Done the same morning: the solver's Single Solve path now tries every plug-in answer in one merged batch first; an offline replay of this Single Solve took 2 submits instead of 26.