Next, Next, Finish · Huntress CTF 2026

The challenge

"An NSIS installer script clicks through its own setup wizard while carrying a little something extra. Separate the real setup actions from the modeled payload behavior, and recover every cross-language handoff from the final bytes. You won't need to press Next once."

Every earlier day's script fields plus 44 new ones: 1,417 questions on the Single Solve (Day 21 had 1,373; none were dropped). Written from the solver's report, the start reply's question list, and the Game Master request log; the specimens weren't reopened (only their names and sizes were listed from the zip directory).

The four new specimens each carried the lane's usual question family:

answer_id (per specimen)	Question	Format
`…-role`	"Classify the inert source role."	enum (`benign_utility`, `downloader`, `dropper`, `impact`, `launcher`, `persistence_descriptor`, `relay`, `staged_chain`, `stager`, `uploader`, `advanced_syntax`)
`…-attack`	Map the decoded ordered behaviour graph to one primary ATT&CK technique, by the stated precedence	technique or sub-technique ID, or `none` for benign
`…-adapter`, `…-campaign`, `…-url` / `…-file-path`	Recover the modelled adapter, campaign ID, and indicator	exact text
`…-stage-count`	"Recover the modeled stage count."	base-10 integer
`…-steps`	"Recover the ordered behavior graph using > separators."	tokens joined by `>`
`…-host-profile`	"Identify the script host or source container."	exact text
`…-obfuscation`, `…-stage-profile`, `…-next-language`	Encoding profile, multi-stage profile, next language in the handoff	exact text

Reading the prompt: what it said we'd need

Clue	What it pointed to	What I did about it
"An NSIS installer script"	A new language family: Nullsoft installer scripts (`.nsi`)	Relied on the core chain's general reader; it handled the four `.nsi` polyglots with no change
"clicks through its own setup wizard", "You won't need to press Next once", "Next, Next, Finish" (title)	The installer's wizard pages are noise; nothing needs to run	Static only: the solver reads the script text from the encrypted zip and never builds or runs an installer
"carrying a little something extra"	The modelled payload: role and ATT&CK technique	The usual `role` and `attack` fields
"Separate the real setup actions from the modeled payload behavior"	The behaviour graph, apart from the installer boilerplate	The `steps` field (for example `decode_embedded>write_file>dispatch_process`)
"recover every cross-language handoff from the final bytes"	The `obfuscation` and `next-language` fields	The chain gave `powershell`, `jscript`, `batch`, and `vbscript` for the four specimens

Safety

Script specimens are hostile: static analysis only, on our Kali VM. The solver parses the text of the encrypted evidence.zip members; no specimen was executed, no installer was compiled or run, and no indicator was contacted. No code excerpts are quoted here, only the answer values, with URLs defanged.

What was in the files

Single Solve: evidence.zip, 137,890 bytes, 153 encrypted members (Day 21's 149 plus four NSIS scripts). The 44 new questions came from four NSIS polyglots, 11 fields each, all with host profile standalone:

Specimen (`polyglot-nsis-…`)	Role	Attack	Adapter	Stages	Steps	Obfuscation	Stage profile	Next language
`benign-utility.nsi` (2,302 bytes)	`benign_utility`	`none`	`local_parser`	3	`decode_embedded>write_file>dispatch_process`	`hex_base64`	`three_stage_decode_write_launch`	`powershell`
`downloader.nsi` (1,824)	`downloader`	`T1105`	`http_client`	3	`profile_host>decode_configuration>dispatch_language`	`fragmented_hex`	`cross_language_handoff`	`jscript`
`launcher.nsi` (1,677)	`launcher`	`T1059`	`process_builder`	2	`decode_configuration>return_configuration`	`plain_hex`	`single_descriptor`	`batch`
`staged-chain.nsi` (1,173)	`staged_chain`	`T1059`	`operation_graph`	2	`acquire_remote>dispatch_process`	`base64`	`two_stage_download_execute`	`vbscript`

Indicators: campaign IDs NSIS-<8 hex>; URLs of the form hxxps://nsis-<10 hex>.example[.]invalid/stage; the benign utility's file path /tmp/huntress-nsis/.<16 hex>.stage. - Time Trial: evidence.zip, 136,626 bytes, 153 members, the same 1,417 questions. All four NSIS scripts had the same shapes; only the campaign IDs, URLs, and file path changed. - Mastery: one 817,854-byte zip of 6 sets (evidence-01.zip … evidence-06.zip, 135,688 to 137,167 bytes), 8,502 questions. Every set's four NSIS scripts matched the Single Solve's shapes with their own IDs.

The shapes are Day 21's, moved along by one name. Day 21's GitHub Actions specimens had the same four graph / obfuscation / stage-profile / stage-count bundles. Today each bundle sits on the next file name: the benign utility has Day 21's downloader bundle, the downloader the launcher's, the launcher the staged chain's, and the staged chain the benign utility's. Role, attack, adapter, and next language stayed with the file name. So the attack value follows the name, not the graph: the "benign utility" has a decode-write-launch graph but attack none, and the "launcher" has the benign-looking decode_configuration>return_configuration graph but attack T1059. The Game Master accepted the core chain's values for all 44 fields. Why they're built this way wasn't checked, because the specimens weren't reopened.

Single Solve

The solver solved it with no stop. It picked up today's challenge ID with its core script solver, which uses the split-header reader added on Day 19, and sent two batches:

Core batch, 1,287 answers → accepted, 130 remaining. All 44 new fields were in it and all were accepted. The solver flagged 52 values it had seen rejected on other questions before (mostly none and T1105 attack values, two of them on today's new specimens: the benign utility's none and the downloader's T1105) and sent them anyway, as it is set to; none was rejected here.
Merged add-on batch, 130 answers → CORRECT. These were the fields the solver's add-on readers own: 72 JScript, 17 Batch, 8 VBScript, and 33 for the WSF, HTA, and SCT hosts.

The split between the two batches moved by two fields against Day 21 (still 130 add-on fields): batch-dropper-expansion moved to the add-on batch, and vbscript-impact-control moved back to core. No code changed, so this follows the day's evidence; the exact reason wasn't checked.

started_at  2026-10-22T13:01:32.213Z
deadline    none (Single Solve)
answers     1,287 (core) + 130 (add-ons merged) = 1,417
start        572 ms
artifact     468 ms
solve        363 ms
core submit       537 ms   accepted, remaining 130
add-ons submit   1844 ms
TOTAL       3789 ms   (solved_by 13:01:35.035Z, +2.82 s after started_at)
result      CORRECT   flag 12bc2fd4…70e7

No new solver, tests, or rehearsal were written today. The core solver is unchanged since 2026-10-18; the script that sends the batches was last changed on 2026-10-21, after Day 21's run (what changed wasn't checked for this write-up).

Time Trial

CORRECT on the first attempt, ranked (95 s clock, up from 90 s on Day 21; 1,417 answers). The start reply showed unique_attempts_remaining: 31.

started_at  2026-10-22T13:01:41.474Z
deadline    2026-10-22T13:03:16.474Z   (95 s)
answers     1417
start        843 ms
artifact     715 ms
solve         89 ms
submit      1008 ms
TOTAL       2657 ms   (submit +2.04 s after started_at)
result      CORRECT   flag 656f60d2…1a49

Mastery

CORRECT on the first attempt, ranked (6 sets, 200 s clock; Day 21 had 5 sets and 170 s).

started_at  2026-10-22T13:01:49.666Z
deadline    2026-10-22T13:05:09.666Z   (200 s)
answers     8502 across 6 sets
start       1346 ms
artifact     834 ms
solve        469 ms
submit      1614 ms
TOTAL       4275 ms   (submit +3.36 s after started_at)
result      CORRECT   flag d09f6718…de3f

Time to solve

All three modes were solved by 09:01:53 ET, 22 s after the solver's first start request at 09:01:31 ET and 1 min 53 s after release; the Metadata, Warmups, and Android lanes ran first. Each mode went through on the first submit, and both timed modes were ranked.

Takeaways

The general reader keeps paying off. A new host format (NSIS installer scripts) went through the existing chain with no code change, for the fourth day running.
Specimen names aren't answers. Today's shapes were Day 21's moved along by one file name, while role and attack stayed with the name. Reading each file, not guessing from its name, is what got all 44 right.
The rejected-before warning is advice, not a stop. 52 flagged values were right for these questions again.
This lane finishes last only because it runs last. On time today, the last CORRECT among Claude's lanes was 09:01:53 here; the Warmups retry (09:05:03) set the morning's actual finish.