CloudyHeist

Author: 0xIDA
Platform: FlagYard · Category: forensics · Difficulty: Medium

Solvers

• odl.py

Summary

HIPAA client incident image: AnyDesk remote access exfiltrated stage.zip; recovered staged payload from CloudStore/data (ZIP), Base64 note → XOR 0x11 → flag.

Solution

Step 1: AnyDesk remote access + outbound transfer

From user profile (FlagStore.zip):

• AppData/Roaming/AnyDesk/connection_trace.txt — incoming sessions from AnyDesk ID 1367727428
• file_transfer_trace.txt — outbound upload of stage.zip (~230 B) completed successfully

ad.trace points staging under:

C:\Users\FlagYard\AppData\Local\Microsoft\Windows\CloudStore

Step 2: Decode CloudStore payload

CloudStore/data is a ZIP containing notes.txt (Base64). Decode:

Panzer
Encoding: XOR with 11 (HEX)
Encoded Flag: W}pvHj"rw$#$u"(!  rr((!w%)!%))&!srt %#l

import base64, zipfile
from pathlib import Path
with zipfile.ZipFile("CloudStore/data") as z:
    note = z.read("notes.txt").decode().strip()
msg = base64.b64decode(note).decode()
enc = msg.split("Encoded Flag:")[1].strip()
flag = bytes(b ^ 0x11 for b in enc.encode()).decode()
print(flag)

Flag

FlagY{3cf525d39011cc990f48048870bce142}

Tools

• unzip / selective extract from large profile ZIP
• Python Base64 + XOR

Key takeaway

Follow remote-access tool logs (AnyDesk) to file-transfer traces, then recover the staged archive even when the transfer itself is gone — here disguised as Windows CloudStore data.