zwesty
Write-ups / Day 17 / Script
Day 17 · Sat, Oct 17 · Script

Fetch Quest

Prey slaughtered

Download-chain analysis across many script hosts, ATT&CK mapping

STTMClaude Homebase Both

Flags are shortened to their first 8 and last 4 characters because they're unique per team.

Challenge ID
script-analysis-day-17-download-graph (+ /time_trial, /mastery)
Solved
2026-10-17, all three modes, by 09:01:00 ET
Player
Zwesty (solo), with Claude Code (Opus 5.5): solved by our automated morning solver (a scheduled script on our Kali VM)

The challenge

A "download graph" day: every earlier day's script fields, plus downloaders across many hosts. Written from our solver's report and request log only; the specimens weren't reopened.

Safety

Script specimens are hostile; static analysis only, on our Kali VM. No excerpts quoted.

What was in the files

Per the solver's report: benign and downloader/stager variants in Bash, Batch, Node.js, VBScript, Python (source, PyArmor, PyInstaller one-file, wheel), and "polyglot" hosts (AppleScript, AutoHotkey, AutoIt, Lua, MSBuild XML, Perl, PHP, Ruby, TypeScript, WMI MOF). Downloaders map to T1105 (Ingress Tool Transfer); benign utilities to none.

The modes

  • Single Solve: core batch of 1,010 answers accepted, then one merged plug-in batch of 129 → CORRECT. That's the merged batch built the day before, on its first live day: 2 submits instead of ~26.
  • Time Trial and Mastery: straight after, ranked.
Single Solve   CORRECT 09:00:43
Time Trial     CORRECT 09:00:51  flag 35345bb1…1119   solve 47 ms, submit +2.29 s
Mastery        CORRECT 09:01:00  flag 3aa935ba…2b34   solve 238 ms, submit +3.49 s

Time to solve

All three modes were solved by 09:01:00 ET, about a minute after release, each on the first submit; the Time Trial and Mastery were ranked.

Takeaways

  • The merged plug-in batch worked live: the Script lane finished one minute after release, the first lane done.
  • The compounding chain answered a dozen new host languages with no code change.