RegReflector

Author: 0xIDA

Solvers

• solve.py

Platform: FlagYard · Category: forensics · Difficulty: Hard

Flag

FlagY{968798755218d7f42db548b0245e6263}

Challenge

Employee ran a fake Chrome installer; artifacts include Windows registry hives and user profile data. Hint: comeflywithme / XOR with 0x1f.

Exploitation chain

1. Download RegReflector.zip from the challenge file host.
2. Inspect registry values in NTUSER.DAT: large hex blobs named like hDF82oB / orhmkbye.
3. Hex-decode → XOR deobfuscation → JS eval stage → PowerShell base64 → in-memory shellcode.
4. Both registry payloads yield parts of an encoded flag string.
5. Final XOR with key 0x1f recovers the flag.

Attack chain

Registry → Hex → XOR → JavaScript → PowerShell → Shellcode → XOR(0x1f) flag