SUPER
Decoding an XOR-encoded file gives us an MS-DOS VHD
Last updated
Was this helpful?
Decoding an XOR-encoded file gives us an MS-DOS VHD
Last updated
Was this helpful?
HOT
author: WhiteHoodHacker
The file is encrypted with a repeating XOR cipher
The file, when opened, shows the string "SUPERHOT" repeated over and over again in some parts, like the beginning of the file.
In other parts, however, there appears to be some scrambled data.
Using "SUPERHOT" as the XOR key, we decode the file.
It turns out the key was indeed "SUPERHOT", as the decoded file was a valid disk image.
Indeed, the large portions of zeroes were encoded into repeating "SUPERHOT"s.
Checking the magic bytes at the beginning of the file allows us to fingerprint the file type.
From this list of file signatures, we can tell that this is a VHD file.
Mounting the VHD with guestmount -a decoded -i ./mnt -v, I started exploring the filesystem. The first thing we can try to find out is the OS version. This was easily found to be MS-DOS 6.22 - really old!
In the filesystem root, there was an interesting LOG1.IRC file. It hints at a superhot.exe that requires "changing directories many times to reach".
This referred to an interesting SUPER directory in the filesystem root.
It only contains a directory named HOT, which then contains a SUPER directory again. This continues until we have SUPER/HOT/SUPER/HOT/SUPER/HOT/SUPER/HOT/SUPER/HOT. However, superhot.exe was nowhere to be found.
The chat logs did suggest that someradgamer might have deleted the file ("I'm SUPER deleting this now") before his computer started malfunctioning.
I looked around a little more, and I guess I "lucked out" when at the corner of my eye, I noticed an UNDELETE.EXE executable in the DOS directory.
I did not know the existence of this command, but I had a feeling that it must have had something to do with it - we're looking for a deleted file, after all. It appears that the UNDELETE command exists on MS-DOS 5.0 to 6.22, allowing users to recover deleted files if no new files or changes have been made on the disk since the deletion.
Perhaps we can recover the deleted superhot.exe? Let's find out!
Create a new VM on VirtualBox, selecting "DOS" as the OS.
When prompted to add a virtual hard disk, select the decoded VHD file.
Click on Create, and we have our very own MS-DOS VM! To test our theory, let's navigate to the C:\SUPER\HOT\SUPER\HOT\SUPER\HOT\SUPER\HOT\SUPER\HOT folder and run UNDELETE.EXE.
This indeed finds a recoverable file, and we are prompted to enter the first character of ?UPERHOT.EXE. This would obviously be the character S.
The file is successfully "undeleted", and we can run superhot.exe to get the flag.
This was the major gatekeeper, but as the hint stated, the file is encrypted with a repeating XOR cipher. This explains the repeated "SUPERHOT"s, since . Thus, null bytes (zeros) XOR-ed with "SUPERHOT" would yield "SUPERHOT".
