zwesty
Write-ups / Day 18 / Script
Day 18 · Sun, Oct 18 · Script

Orphan Process

Prey slaughtered

Script de-obfuscation (string-array reassembly), HEX/Base64/fragment decoding, ATT&CK mapping

STTMClaude Homebase Both

Flags are shortened to their first 8 and last 4 characters because they're unique per team.

Challenge ID
script-analysis-day-18-process-story (+ /time_trial, /mastery)
Solved
2026-10-18, all three modes, from our solver's start (09:01:29 ET) to Mastery CORRECT 09:09:56 ET
Player
Zwesty (solo), with Claude Code (Opus 5.5): our automated morning solver (a scheduled script on our Kali VM), then a Claude helper agent for this lane

The challenge

A "process story" day: every earlier day's script fields (1,194 questions on the Single Solve, 132 files) plus 55 new questions on five Google Apps Script (.gs) files. The prompt talks about process trees and a child claiming a parent it never had, but no question asked about that.

Safety

Script specimens are hostile: read as text on our Kali VM, never run. No excerpts quoted beyond marker names.

What was in the files

The new .gs files (benign utility, downloader, launcher, staged chain, and a Google Docs sidebar host) carry the same analysis plan as every polyglot fixture since Day 8, but hidden differently: no one-line HUNTRESS_ANALYSIS_V1:<ENC>-… header. Instead a HUNTRESS_ANALYSIS_V1:SPLIT marker, then a constant array of string pieces joined at runtime; the joined text is the encoded plan (HEX, Base64, HB64, or fragments). The body holds a second split copy. The timed sets used the same template and brought no new question types.

The modes

  • Morning solver: our shared solver stopped before sending anything ("expected one analysis header, found 0").
  • Claude helper agent (09:02–09:10): in a separate copy of the solver, taught the header reader to rebuild the split array and decode it, refusing on zero or several split names or an unknown prefix, and checking the plan against the body's second copy (all five agree). Checks: tests 8/8, coverage 1194/1194, every saved Script Single Solve (Days 2–17) unchanged.
  • Single Solve: core batch of 1,066 accepted, merged plug-in batch of 128 → CORRECT. Values sent verbatim from the plan; nothing rejected.
Single Solve   CORRECT 09:09:19  flag 5273…c92c
Time Trial     CORRECT 09:09:47  flag 9c57…55aa   solve 57 ms,  submit +2.43 s  (ranked)
Mastery        CORRECT 09:09:56  flag a4d5…f16d   solve 253 ms, submit +3.80 s  (ranked, 5 sets)

After the timed runs: a full regression check of all 81 saved Script sets (78 identical, 0 changed, today's 3 newly answered), then the change was made permanent in the solver chain.

Time to solve

All three modes were solved by 09:09:56 ET, 8 min 27 s after the solver started the Single Solve; most of that was building and checking the split-array reader. The Single Solve went through at 09:09:19 with nothing rejected, and the ranked Time Trial (+2.43 s) and Mastery (+3.80 s) each went through on the first submit.

Takeaways

  • Script was the day's last lane (+9 min 56 s): a new hiding shape in one language can stop a 1,194-question set.
  • Prompts can over-promise: the process-tree story brought no new question types; coverage stayed 100%.
  • Timed first, full regression check after kept the check's few minutes off the finish time.