NCSC 2025 Reverse Writeup

Mohammad Nour Al Murie

6 min readAug 7, 2025

<قُلْ إِنَّ الْفَضْلَ بِيَدِ اللَّهِ يُؤْتِيهِ مَن يَشَاءُ ۗ وَاللَّهُ وَاسِعٌ عَلِيمٌ>

The process of my work for every challange :

Basic Static :

File Command ( Type in windows )

Detect it easy → Check the Language and if it Packed

Strings and “floss”

Check The PE ( PE properties ) → CFF explorer , PE total

Use capa -vvv or just to see the overview capa only

Advanced Static :

IDA or Ghidra or Recaf for Apk or Dnspy for Dotnet

Basic Dynamic :

Process Hacker , Task Viewer , Process Monitor , “””Api Monitor””””

Advanced Dynamic :

X64dbg or Ida ( windows ) , gdb or r2 or edb ( elf )

Study The Codeeeeeeeeeeeeeeeeeeeeeeeeee

Leave ChatGpttttttttttttttttttttttttttttttttttttttt

Use GOOOOOOOOOOOOOOOOOGLEEEEEEEE

Casp3rTheGhost :

First we need to Identify the type of this file using DIE(Detect it easy) :

So its PE( protable executable ) and C lang used on it

lets try strings if we can caught anything usefull :

Nothing useful as expected because its an Packed PE

Keep going to IDA to see if its can help us :

Even Ida was not helpfull so what now ? “i skipped the basic dynamic”

Lets use a debugger like x64dbg to see where it drop the pack or unpack it

After some instruction moving in x64dbg was not usefull

So decide to attach the PE on the x64dbg while running and see the memory map to moniter the unpacked memory that he used :

On the memory map on the :

Press enter or click to view image in full size

Memory map 0x64dbg

We can see that there’s a memory Rw

Why Rw ?

ER → The programe Now begin executed

Rw -> Code being unpacked or modified ( Not always )

RX -> Code being executed (after unpacking)

R → Passive data/code, less useful for unpacking phase

So now its obvious right ? i think we found it

Lets see the memory dump :

YESSSS!! we Found it :

NCSC{FXQ!#X0302365b9909e1e07……}

NCSC Agent (QA) :

As perivous lets run DIE(Detect it easy) on it :

Just running DIE we got that its a python exe so let unpacke it using :

Get Mohammad Nour Al Murie’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

pyinstxtractor.py : https://github.com/extremecoders-re/pyinstxtractor/blob/master/pyinstxtractor.py

This tool try to give you the PYC file that was used to compile the file :

after instxtract that files got this :

Now let’s turn these files to python files using ( https://pylingual.io/ )

Got this py :

# Decompiled with PyLingual (https://pylingual.io)
# Internal filename: NCSC_Agent.py
# Bytecode version: 3.13.0rc3 (3571)
# Source timestamp: 1970-01-01 00:00:00 UTC (0)

import socket as s0c
import random as r4n
import string
import argparse
import pickle
import time
from Crypto.Cipher import AES
from Crypto.Util.Padding import pad, unpad
BLOCK_SIZE = 16
_0 = 'cyberwarriors-challenges.skidz.io'
_1 = 1235
r4n.seed(1337)
_k3y = ''.join(r4n.choices(string.ascii_letters + string.digits, k=16))
_d0 = {'send_log': 'Sends logs back to server', 'sys_info': 'prints system info', 'health': 'Check EDR server health', 'help': 'Show this help message'}

class INFO:

    def __init__(self, username, privileges, cmd, data):
        self.username = username
        self.privileges = privileges
        self.cmd = cmd
        self.data = data

def encrypt(serialized_data: bytes, key: bytes) -> bytes:
    cipher = AES.new(key, AES.MODE_ECB)
    padded_data = pad(serialized_data, BLOCK_SIZE)
    encrypted = cipher.encrypt(padded_data)
    return encrypted

def _sh(debug: bool=False):
    with s0c.socket(s0c.AF_INET, s0c.SOCK_STREAM) as _s:
        _s.connect((_0, _1))
        _s.sendall(_k3y.encode())
        _r = _s.recv(1024).decode().strip()
        if 'Unauthorized' in _r:
            print('[!] Failed to auth')
            pass
        return None
if __name__ == '__main__':
    parser = argparse.ArgumentParser(description='Custom NCSC EDR Agent')
    parser.add_argument('-d', '--debug', action='store_true', help='Enable debug mode.')
    args = parser.parse_args()
    _sh(args.debug)

So after analysis it , it takes a key as input and produce an output then you should send some command from “ _d0 “ to get the flag :

i tried “ pull_log “ maybe and i got the flag “ I can’t access the machine :) “

To get the flag you need to connect to

HOST = 'cyberwarriors-challenges.skidz.io'
PORT = 1235
INITIAL_KEY = 'MHwKkZxW5t9mO4gY'

using pwntools or socket or what ever you want and the flag will appear

Notes ( First Blood )

As perivous lets run DIE(Detect it easy) on it :

Its look like its obfuscated or packed with themida and its a PE

so lets try strings :

Nothing benfit but i know it DotNet from some Strings like Assembly Verison ( Maybe )

So i tried Ida and i did’nt got anything also dnspy ,.. ghidra Nothing

So decide to go dynamic analysis …. I skipped Basic dynamic ( For a while)

So yes X64 didn’t help me so i tried Windbg also the same so i know it use an anti-debug so i decide not to deep on it and try to see the memory maybe something usefull will appear…

so Yes I have back to Basic dynamic using “ Task Explorer and Process hacker “ and suspend the program while running then inspect the memory with “ permission RW ( Read Write ) as we talk about it before “

I used Task explorer to freeze the process that terminated and get its values like thread was running or memory dump ….

So after a while of search i found a Base64 on a dump that contain a Rar file

So i extracted that base64 from the hex using “CyberChef”

Then debase64 :

UmFyIRoHAQAzkrXlCgEFBgAFAQGAgABbpmONVQIDPMAABKYAIFoIuVuAAwAIRmxhZy50eHQwAQADD+5TyknYt2g1Mg8D/WEHpuHAP29x35uUiEAIJ42my3smG5JyEHPnw1gZudIQCgMCAGEflt/92wGHp/SA/FMu30sSxIPBQ4dbb7n0iKdmrRsGXMdZo5UTwCDqdTZKxe3aSd+dp28CVgrNd6lcMwG+l2eaLluPjhK2HXdWUQMFBAA=

And yepppp we found the rar that has the flag.txt so lets unrar it

But wait wee need a password ……

So my teammate Mustafa decide to do a John the ripper to get the password ( What an idea ;) )

┌──(kali㉿kali)-[~]
└─$ john --format=RAR5 --wordlist=/usr/share/wordlists/rockyou.txt rar.hash

Using default input encoding: UTF-8
Loaded 1 password hash (RAR5 [PBKDF2-SHA256 512/512 AVX512BW 16x])
Cost 1 (iteration count) is 32768 for all loaded hashes
Will run 8 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
5201314          (download (1).rar)     
1g 0:00:00:00 DONE (2025-08-07 11:19) 9.090g/s 4654p/s 4654c/s 4654C/s 123456..letmein
Use the "--show" option to display all of the cracked passwords reliably
Session completed.

We found the password “5201314” now lets get the flaaaaaaaag!!!!