Lost in Translation

A monster — 75 obfuscated scripts, 615 answer fields — across PowerShell, JScript, VBScript, Batch, Python, Bash, Node and PHP. Each language family hides a JSON descriptor a different way. The PowerShell samples are the gentlest: a base64 blob you just decode.

$ grep -o "FromBase64String('[^']*'" resource-sample.ps1 | cut -d"'" -f2 | base64 -d
{"campaign":"...","url":"https://cdn-9b1bbf80ba.example.invalid/0d62eac7dcb5.bin",
 "wallet":"wallet_d861bee5f75b9fc68c1c91e0a1f50ab5","mutex":"Global\\HuntressLab_b50274260bb2"}

The JScript ones each pick a different trick — XOR with a 5-byte key over base64, decimal lists split on -, hex with a +20 shift, a reversed array XOR'd with one byte, or plain char codes — while the VBScript/Bash/Node files helpfully label their own scheme in a Codec_... = "representation|transform|key" constant, which answers the codec questions outright. Everything was decoded in Python; nothing ran. A decoded descriptor ends up looking like:

{
  "jscript-stager-role": "stager",
  "jscript-stager-adapter": "MSXML2.XMLHTTP.6.0",
  "jscript-stager-url": "https://1720f90c5d.example.invalid/edd8856c.dat",
  "jscript-dropper-adapter": "ADODB.Stream",
  "jscript-launcher-adapter": "regsvr32.exe"
}

The real challenge wasn't decoding — it was the grading: all-or-nothing, no per-field feedback, so one wrong label out of 615 sinks the whole submission. The breakthrough was realizing partial submissions get graded, so I split the answers into sections and submitted them separately to isolate the ~39 label fields whose exact vocabulary the files never state.

That isolation surfaced the grader's own naming scheme: launcher/chain/relay take the language's interpreter sub-technique (T1059.003 Batch, .005 VBScript, .006 Python, .004 Bash, .007 JScript/Node), uploaders are T1041, and control-flow labels look like for_once, do_once, while_once, call_subroutine, goto_dispatch, if_guard. The very last holdout, batch-uploader-control, turned out to be if_guard. All 615 — flag captured.