Detective

Recon

We are given a file named dotnet.exe. Despite the name, analysis in Ghidra shows that it is not a .NET binary at all — it is a Python program packed into an executable. The decompiled main is full of dlsym lookups for CPython API symbols such as Py_DecRef, Py_DecodeLocale, Py_Finalize, and Py_InitializeFromConfig, which is the tell-tale signature of a PyInstaller-style Python launcher.

This closely matches the scenario described in this CTFtime write-up. We first tried the pydumpck tool to decompile the extracted obfuscatsnake.pyc, but it failed:

Decompiling the obfuscated script

Instead, we used pylingual.io to decompile obfuscatsnake.pyc. It succeeded, revealing a tiny but heavily nested loader:

The script is a string of code repeatedly compressed with zlib and base64-encoded, wrapped many times over. The core is this decode lambda:

_ = lambda __: __import__('zlib').decompress(__import__('base64').b64decode(__[::-1]))

lastbytes = b'uc6T8/h///7z+rkn7L7cav7ZZ7MAYsI/lry5m8oBZUPHSYbk1whjvcxWxlMvdn . . .'

while b"exec" in _(lastbytes):
    lastbytes = _(lastbytes)[11:-3]

print(lastbytes.decode("utf-8"))

Note the [::-1] — each layer is a reversed base64 string. Peeling every layer of reverse → base64-decode → zlib-decompress eventually reaches the innermost payload.

Finishing in CyberChef

The rest of the deobfuscation was done in CyberChef with a Reverse → From Base64 → Zlib Inflate → … recipe, which resolves to a Pastebin URL:

Opening the raw Pastebin content reveals a string of Braille characters:

Decoding that Braille with CyberChef's From Braille operation gives the flag: